SEC835

1. SEC835 Identity and Access Management Overview

2. Tasks of IAM Specify the rules of electronic identity Maintain identity Validate identity Define access privileges Validate access privileges

3. Identity • Basic identity • User’s ID generated to be used by a given application • Federated identity • User’s ID assembled from many sites in distributed environment • With a single ID a user can communicate to many sites

4. Identity lifecycle • User provisioning • Create an electronic identity and access privileges • Identity lifecycle • Electronic identity is an object that change its state from being created to being destroyed. • Between the two ends it can have other states to reflect the user’s state, e.g. pending, not-active. • Identity assurance • The method of determining that the electronic identity belongs to the right person

5. Authentication • Identity validation • Verify that this identity is correct (belongs to the group of valid identities) • Identity proof • Verify that the validated identity belongs to the right person. We need validation factors to do that. That is user’s authentication. • Credential issuing • Match the valid identity to relevant access privileges. Two things together are known as a user’s credentials. • Credential assurance • Credentials also need assurance since they may be intercepted and misused (impersonation attack) • Graded authentication • Authentication may be completed in stages, starting from more simple one (e.g. one factor) and growing up to more secure if there are business needs.

6. Authentication factors • Something you know • Password • Secret word • Something you have • Smart Card • Token • Something you are • Biometrics (finger prints, eyes retina)

7. A single factor authentication • Password • Must be strong • Long • Complicated structure • Not using dictionary • Changed regularly • Always change system generated password • Periodic changes of user-selected passwords • Stored hashed or encrypted • Hash cannot be restored • Resistant to brute-force attacks • Measures of precautions against information disclosure attacks • Information disclosure through security holes in the application

8. Two-factor authentication • Second factor – identify the type • RSA certificate (PKI technology) • Smart card (Entrust card) • Telephone factor • Secret words • Fingerprints • Out-of-band authentication • Use additional input, that does not belong to the system

9. Authentication mechanisms • Basic authentication • Mechanism provided by web browsers • This is weak authentication • Form-based authentication • Mechanism that is built and controlled by the application • Recommended for commercial applications • Required to implement two-factor authentication • Single Sign On (SSO) • The access control mechanism that allow authenticating a user just once when a user needs access to a few applications.

10. Strong authentication mechanism Strong identity –at least two factors Strong authentication protocol combined with secure session management and supported with other security mechanisms like encryption Form-based authentication

11. Access control • Access Control List (ACL) • Map identity to resources and show allowed actions in terms of Read/Write/Update • Role-based access control • Application considers the end users roles • Privileges are assigned to the roles, not to peoples • Privileges specify access to functions and data • Attribute-based access control • Privileges take into account the level of sensitivity of data and functions in addition to the roles.

12. Role-based Access Control • Often used for eCommerce applications • The users have been assigned with their roles in business processes, e.g. operator, teller, customer service representative, etc. • Privileges have been assigned to roles, not to individuals • All users that play the same role have the same level of privileges • Individuals move in and out but roles sustain

13. Attribute-based Access Control • Differentiate access privileges within a group of users who play the same role • Data attributes values or characteristics of functions are used as differentiating factors • Examples • Operator has the right to read data but do not have the right to delete them • Teller has the right to perform transactions that are below $500. For greater amount of money she needs her manager

14. RBAC vs. ABAC • ABAC provides more granular access control than RBAC • Both are used for eCommerce • ABAC always assume custom development • RBAC tools is a part of nowadays Application Servers (Web Sphere, Web Logic)

15. Access control policy • Access control policy sets the rules for • ID and password creating • Length, characters to be used • Assigning privileges • Map privileges to business functions or attributes • Maintaining identity and access privileges • Periodical changes, review, etc.

16. Access Control (cont.) • Additional security measures • Least privileges • Give the minimum privileges, sufficient to perform job duties • Need to know • One has the access to data or functions on “need to know” basis • Separation of duties • Sensitive functions always require more than one person to complete

17. Access Control Implementation • ID and passwords are stored in LDAP or RDB • Privileges for RBAC or for ABAC are stored in RDB or in a special data repository • Passwords must be hashed • Application must implement different views for different roles

18. View Patterns for RBAC • Full View with Exceptions • The operations available in an application are made visible to users, but access attempts are guarded. • Limited View • A user can see, and access, only the operations he/she is entitled to use.

19. IAM technology conceptual architecture

20. Strong access control requirements • A strong access-control mechanism must be: • Policy based • Centralized at a single point • Invoked on every access request • Cannot be avoided • Reliable in that its operation cannot be subverted by hostile parties • Auditable

21. Strong Access Control Mechanism Checklist • Ensure that the access-control matrix is built for all development stages of the application (business, architecture, and design). • Ensure that all URLs and business functions are protected, as well as data. • Ensure that the request for data stored in the RDB goes through the access-control mechanism. At this point, the process must be authenticated and access privileges verified. • Avoid having files or libraries located at the Web root directory. • Block access to all file types that are not used by the application. • Keep virus protection and patches up-to-date.

22. Data classification • How to determine the need in strong access control mechanism? • Each organization has its data classification policy • Data is classified by the degree of sensitivity in terms of confidentiality and integrity • Standard classification includes: • Highly confidential • Confidential • Public • This provides a clue to how strong the access control mechanism must be, and reflect the requirements to each category of users

23. Users discretion • Users have different level of privileges to access to data • Overall consideration of privileges assumes • Need to know • What operations are required (R/W/U) • How sensitive is the data

24. Access Management Features • Access Management • Given that the account is viable, the application will use it to protect its assets by • Identify a user • Authenticate a user • Check a user’s privileges to access the system assets • Provide the access in accordance to the privileges • Strong authentication, session management, and access control patterns are recommended. • In a distributed environment we recommend using a Single Sign-On (SSO) component as the Portal’s access-management front-end.

25. Top IAM technologies • SunMicrosystems • IBM • Oracle

26. Second factor choice • How to decide about the second factor? • Read the article • Provide written answer to the following question: • 1. For each of the factors, please identify the category of an authentication mechanism (out of three known categories: smth you know, smth you have, smth you are). • Work individually or with your teammates (up to 3 people) • Send the answer by email today