Identity and Access Management - An Introduction

With the advent of Web 2.0 and onward, the rise of the terminology and concept we call Cloud Computing, coupled with an increase in the manner technologies are being used, not only by corporations but by individuals as well, comes an increased drive to ensure that risk is managed, effective security measures to protect identities are implemented, and efforts are expended to ensure privacy is maintained.

A few years ago, in their quest to implement and maximize on the benefits of Service-Oriented Architecture (SOA), researchers at Microsoft separated SOA into four areas (1) viz.

1.Identity and Access Management
2.Service Management
3.Entity Aggregation and
4.Process Integration
Accordingly the claim was that although these segments were technically challenging, navigating the challenges to a successful resolution would allow the groundwork required for critical IT foundations to be realized. This accomplishment in turn would then direct enterprises to a path where the full benefits of SOA could be obtained.

This article develops on an earlier article expanding on Identity and Access Management (IAM)

Identity and Access Management simply stated governs from a process and technical aspect, who has access/permission to perform an action on data and why. It can be categorised as being part of Identity and Privacy Services.

According to Frederick Chong it consists of three critical elements: policies, processes and technologies respectively.

With the growth of online attacks against corporations and individuals, Identity Management is now an intrinsic part of information security. Its aim is to establish accountability online, and can be used to reduce the risks of an unauthorized access to sensitive data and/or identity theft; thus contributing to privacy.

One can then view IAM as an amalgamation of business processes, technologies and policies which are utilized to manage and stipulate how digital identities are used when accessing resources.

Segmenting identity and access, we can view identity management in terms of three basic operations as follows:

1.The process of identifying an individual
2.The process of verification which authenticates a claim to a previously identified individual &
3.The authorization process after step 2 is completed which defines rights and privileges granted to an authenticated individual. 
Following on this we can view the access portion of IAM as follows:

1.An entity - Requests Data
2.The Request is validated and granted or invalidated and denied
3.On validation. Requester is then granted defined privileges and assigned permissions on systems that is associated with an account the requester is related to e.g role based access control (RBAC) definitions say for a bank teller.
4.System Closes Access once granted operations are completed. 

We can further expand these, to detail component of IAM as follows:

1.The Digital Identity - which can be viewed as a unique identifier with unique descriptive attributes of an individual, a group, device or service.
2.The Register -an information system populated with an identities: identity and attributes, here the identity's attributes level/s of trust will be defined. Of note: the accuracy of the identifying attributes is dependant on source of the data e.g. verifying SSN with SS Card etc and the credibility of the data gathering process.
3.Definitions as to how an identity's information is used.
4.A Process to manage change to an identity's attributes e.g. updating the system on a password reset by a user
5.The Process of de-registering an identity.
6.Secure Disposal of all identity information that has been de-registered.
These segments can be broadly incorporated within three main stages : Provisioning, Maintaining & De-Provisioning; which are all part of The Identity Life Cycle.

As identified in the earlier article, with the advent of web-services and the cloud, a natural progression with the topic of IAM is that of Federated Identity and Access Management.

So with all the technical details defined, why should an enterprise consider such a system ? By all means it appears to be costly, complicated and time consuming.

The answer in short: With an IAM implementation an enterprise can realize improvements in

•Security
•Risk Management

•Compliance
•Levels of Service ( both internal and external) and
•An overall reduction in an enterprises Operational expenditure (OPEX). This reduction will be realised as identity and access management processes mature and are formalized. This can lead to a significant portion of the process being able to become automated.
References

1.Frederick Chong 7/2004- Identity and Access Management- Microsoft Corporation.

2.Thomas J. Smedinghoff - Federated Identity Management:Balancing Privacy Rights, Liability Risks, and the Duty to Authenticate