Welcome!

Blog Feed Post

Identity and Access Management - An Introduction

With the advent of Web 2.0 and onward, the rise of the terminology and concept we call Cloud Computing, coupled with an increase in the manner technologies are being used, not only by corporations but by individuals as well, comes an increased drive to ensure that risk is managed, effective security measures to protect identities are implemented, and efforts are expended to ensure privacy is maintained.

A few years ago, in their quest to implement and maximize on the benefits of Service-Oriented Architecture (SOA), researchers at Microsoft separated SOA into four areas (1) viz.

1.Identity and Access Management
2.Service Management
3.Entity Aggregation and
4.Process Integration
Accordingly the claim was that although these segments were technically challenging, navigating the challenges to a successful resolution would allow the groundwork required for critical IT foundations to be realized. This accomplishment in turn would then direct enterprises to a path where the full benefits of SOA could be obtained.

This article develops on an earlier article expanding on Identity and Access Management (IAM)

Identity and Access Management simply stated governs from a process and technical aspect, who has access/permission to perform an action on data and why. It can be categorised as being part of Identity and Privacy Services.

According to Frederick Chong it consists of three critical elements: policies, processes and technologies respectively.

With the growth of online attacks against corporations and individuals, Identity Management is now an intrinsic part of information security. Its aim is to establish accountability online, and can be used to reduce the risks of an unauthorized access to sensitive data and/or identity theft; thus contributing to privacy.

One can then view IAM as an amalgamation of business processes, technologies and policies which are utilized to manage and stipulate how digital identities are used when accessing resources.

Segmenting identity and access, we can view identity management in terms of three basic operations as follows:

1.The process of identifying an individual
2.The process of verification which authenticates a claim to a previously identified individual &
3.The authorization process after step 2 is completed which defines rights and privileges granted to an authenticated individual.
Following on this we can view the access portion of IAM as follows:

1.An entity - Requests Data
2.The Request is validated and granted or invalidated and denied
3.On validation. Requester is then granted defined privileges and assigned permissions on systems that is associated with an account the requester is related to e.g role based access control (RBAC) definitions say for a bank teller.
4.System Closes Access once granted operations are completed.

We can further expand these, to detail component of IAM as follows:

1.The Digital Identity - which can be viewed as a unique identifier with unique descriptive attributes of an individual, a group, device or service.
2.The Register -an information system populated with an identities: identity and attributes, here the identity's attributes level/s of trust will be defined. Of note: the accuracy of the identifying attributes is dependant on source of the data e.g. verifying SSN with SS Card etc and the credibility of the data gathering process.
3.Definitions as to how an identity's information is used.
4.A Process to manage change to an identity's attributes e.g. updating the system on a password reset by a user
5.The Process of de-registering an identity.
6.Secure Disposal of all identity information that has been de-registered.
These segments can be broadly incorporated within three main stages : Provisioning, Maintaining & De-Provisioning; which are all part of The Identity Life Cycle.

As identified in the earlier article, with the advent of web-services and the cloud, a natural progression with the topic of IAM is that of Federated Identity and Access Management.

So with all the technical details defined, why should an enterprise consider such a system ? By all means it appears to be costly, complicated and time consuming.

The answer in short: With an IAM implementation an enterprise can realize improvements in

•Security
•Risk Management
•Compliance
•Levels of Service ( both internal and external) and
•An overall reduction in an enterprises Operational expenditure (OPEX). This reduction will be realised as identity and access management processes mature and are formalized. This can lead to a significant portion of the process being able to become automated.
References

1.Frederick Chong 7/2004- Identity and Access Management- Microsoft Corporation.

2.Thomas J. Smedinghoff - Federated Identity Management:Balancing Privacy Rights, Liability Risks, and the Duty to Authenticate

Read the original blog entry...

More Stories By Jon Shende

Jon RG Shende is an executive with over 18 years of industry experience. He commenced his career, in the medical arena, then moved into the Oil and Gas environment where he was introduced to SCADA and network technologies,also becoming certified in Industrial Pump and Valve repairs. Jon gained global experience over his career working within several verticals to include pharma, medical sales and marketing services as well as within the technology services environment, eventually becoming the youngest VP of an international enterprise. He is a graduate of the University of Oxford, holds a Masters certificate in Business Administration, as well as an MSc in IT Security, specializing in Computer Crime and Forensics with a thesis on security in the Cloud. Jon, well versed with the technology startup and mid sized venture ecosystems, has contributed at the C and Senior Director level for former clients. As an IT Security Executive, Jon has experience with Virtualization,Strategy, Governance,Risk Management, Continuity and Compliance. He was an early adopter of web-services, web-based tools and successfully beta tested a remote assistance and support software for a major telecom. Within the realm of sales, marketing and business development, Jon earned commendations for turnaround strategies within the services and pharma industry. For one pharma contract he was responsibe for bringing low performing districts up to number 1 rankings for consecutive quarters; as well as outperforming quotas from 125% up to 314%. Part of this was achieved by working closely with sales and marketing teams to ensure message and product placement were on point. Professionally he is a Fellow of the BCS Chartered Institute for IT, an HITRUST Certified CSF Practitioner and holds the CITP and CRISC certifications.Jon Shende currently works as a Senior Director for a CSP. A recognised thought Leader, Jon has been invited to speak for the SANs Institute, has spoken at Cloud Expo in New York as well as sat on a panel at Cloud Expo Santa Clara, and has been an Ernst and Young CPE conference speaker. His personal blog is located at http://jonshende.blogspot.com/view/magazine "We are what we repeatedly do. Excellence, therefore, is not an act, but a habit."

Latest Stories
The current age of digital transformation means that IT organizations must adapt their toolset to cover all digital experiences, beyond just the end users’. Today’s businesses can no longer focus solely on the digital interactions they manage with employees or customers; they must now contend with non-traditional factors. Whether it's the power of brand to make or break a company, the need to monitor across all locations 24/7, or the ability to proactively resolve issues, companies must adapt to...
"We focus on composable infrastructure. Composable infrastructure has been named by companies like Gartner as the evolution of the IT infrastructure where everything is now driven by software," explained Bruno Andrade, CEO and Founder of HTBase, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"Tintri focuses on the Ops side of the DevOps, which basically is pushing more and more of the accessibility of the infrastructure to the developers and trying to get behind the scenes," explained Dhiraj Sehgal of Tintri in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Hardware virtualization and cloud computing allowed us to increase resource utilization and increase our flexibility to respond to business demand. Docker Containers are the next quantum leap - Are they?! Databases always represented an additional set of challenges unique to running workloads requiring a maximum of I/O, network, CPU resources combined with data locality.
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
Cloud promises the agility required by today’s digital businesses. As organizations adopt cloud based infrastructures and services, their IT resources become increasingly dynamic and hybrid in nature. Managing these require modern IT operations and tools. In his session at 20th Cloud Expo, Raj Sundaram, Senior Principal Product Manager at CA Technologies, will discuss how to modernize your IT operations in order to proactively manage your hybrid cloud and IT environments. He will be sharing bes...
Artificial intelligence, machine learning, neural networks. We’re in the midst of a wave of excitement around AI such as hasn’t been seen for a few decades. But those previous periods of inflated expectations led to troughs of disappointment. Will this time be different? Most likely. Applications of AI such as predictive analytics are already decreasing costs and improving reliability of industrial machinery. Furthermore, the funding and research going into AI now comes from a wide range of com...
In this presentation, Striim CTO and founder Steve Wilkes will discuss practical strategies for counteracting fraud and cyberattacks by leveraging real-time streaming analytics. In his session at @ThingsExpo, Steve Wilkes, Founder and Chief Technology Officer at Striim, will provide a detailed look into leveraging streaming data management to correlate events in real time, and identify potential breaches across IoT and non-IoT systems throughout the enterprise. Strategies for processing massive ...
SYS-CON Events announced today that GrapeUp, the leading provider of rapid product development at the speed of business, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company, specialized in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market acr...
SYS-CON Events announced today that Ayehu will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on October 31 - November 2, 2017 at the Santa Clara Convention Center in Santa Clara California. Ayehu provides IT Process Automation & Orchestration solutions for IT and Security professionals to identify and resolve critical incidents and enable rapid containment, eradication, and recovery from cyber security breaches. Ayehu provides customers greater control over IT infras...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
SYS-CON Events announced today that MobiDev, a client-oriented software development company, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex software systems for startups and enterprises. Since 2009 it has grown from a small group of passionate engineers and business...
Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more business becomes digital the more stakeholders are interested in this data including how it relates to business. Some of these people have never used a monitoring tool before. They have a question on their mind like “How is my application doing” but no id...
What's the role of an IT self-service portal when you get to continuous delivery and Infrastructure as Code? This general session showed how to create the continuous delivery culture and eight accelerators for leading the change. Don Demcsak is a DevOps and Cloud Native Modernization Principal for Dell EMC based out of New Jersey. He is a former, long time, Microsoft Most Valuable Professional, specializing in building and architecting Application Delivery Pipelines for hybrid legacy, and cloud ...