IDPro Body of Knowledge最新文献

{"title":"Introduction to Privileged Access Management","authors":"André Koot","doi":"10.55621/idpro.101","DOIUrl":"https://doi.org/10.55621/idpro.101","url":null,"abstract":"Privileged Access Management (PAM) plays a crucial role in modern cybersecurity. Organizations can significantly enhance their security posture and protect valuable assets by addressing the issues and risks associated with privileged accounts. Implementing a combination of robust policies, technologies, and best practices will help organizations manage the risks effectively while ensuring the availability, integrity, and confidentiality of their systems and data.This article introduces the concepts of managing privileged access and will touch on non-human accounts, including those that are both interactive and non-interactive. It will show that not all privileged access accounts should be treated in the same way. It will explore the scenarios in which PAM solutions can help organizations gain control of privileged access. Different use cases for PAM solutions are explained and illustrated with architecture diagrams. Critically, even when implementing PAM systems, practitioners cannot neglect the human factor (which requires policy, training, and controls). This article concludes with best practices for implementation, adoption considerations, and core guiding principles.","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"120 5","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-03-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140238081","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Multi-factor Authentication","authors":"Khaled Zaky, de Saxe","doi":"10.1007/978-3-319-58808-7_5","DOIUrl":"https://doi.org/10.1007/978-3-319-58808-7_5","url":null,"abstract":"","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127632393","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Words of Identity","authors":"Espen Bago","doi":"10.55621/idpro.86","DOIUrl":"https://doi.org/10.55621/idpro.86","url":null,"abstract":"Identity and Access is a complex topic covering a wide range of topics and sub-areas. Getting a grasp on this is difficult for anyone; understanding the subject well enough to explain it to others and collaborate is even more challenging. A natural starting point for understanding a complex topic or area is to seek to learn the native language, such as the professional jargon of the area. And many of us start precisely that way, by searching out dictionaries containing words and terms of “IAM” and its sub-components.There are many such dictionaries to be found. And the subtle—and not-so-subtle—differences in the definitions found in these illustrate the challenge this article aims to alleviate. We may have a de facto “language of Identity and Access,” but this language has no formal structure to its semantics.Our area of technology and business is characterized by an abundance of words having multiple meanings. These are confusing or frustrating for beginners and experienced practitioners alike. This article is intended as a guide for keeping track of ambiguous words and terms often encountered in our industry, as well as to show that this deficiency in understanding may be even more significant in Identity and Access than in other places.The article offers examples of where terms are ambiguous and definitions seem to vary across the industry. These examples serve as an aid both to lessen confusion and encourage better and clearer usage of the terms. This article also discusses reasons for the differences and offers some suggestions on countering this challenge in the line of work.","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"118 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122781276","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Strategic Alignment and Access Governance","authors":"A. Koot","doi":"10.55621/idpro.90","DOIUrl":"https://doi.org/10.55621/idpro.90","url":null,"abstract":"In today’s digital age, for an organization to succeed, it must have a strong IT function. That IT function will not be at its best, however, if it is missing a close partnership with the business components of the organization. In many organizations, IAM is seen as an IT responsibility. While some IAM-related tasks and activities can be considered IT-related, others are not. Without a clear understanding of the different tasks and responsibilities in the field of IAM, the success of IAM-related programs will be limited.This article argues for the need for explicit strategic alignment, also referred to as business-to-IT alignment, between IT efforts around IAM, particularly access management, and the business needs of an organization. Lack of this type of alignment leads to failed IAM projects and blocked business maturity growth.p { line-height: 115%; text-align: left; orphans: 2; widows: 2; margin-bottom: 0.25cm; direction: ltr; background: transparent }a:link { color: #000080; so-language: zxx; text-decoration: underline }","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"2 3","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133016941","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Techniques To Approach Least Privilege","authors":"Matthew Carter","doi":"10.55621/idpro.88","DOIUrl":"https://doi.org/10.55621/idpro.88","url":null,"abstract":"This article will describe the lifecycle and techniques that access control practitioners should consider as they grant, validate, and refine permissions as they iterate toward least privilege. The article will compare just-in-time (JIT) approaches with long-standing permissions, balancing productivity with security. The article will explore the risks of using historical data to refine permissions. The reader will learn about refining least privilege in the context of an identity lifecycle and for a specific activity. The article will be agnostic in terms of cloud, hybrid and on-prem, as well as tools.","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121884870","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Identity and Access Management Workforce Planning","authors":"K. Myers","doi":"10.55621/idpro.85","DOIUrl":"https://doi.org/10.55621/idpro.85","url":null,"abstract":"This article offers a practical approach to help identity and access management (IAM) practitioners and managers understand how to advise organization leadership on identity and access management workforce planning. While workforce planning is usually a Human Resources (HR) task, the IAM practitioner, their hiring managers, and their HR teams should know the tasks, knowledge, and skills expected across the IAM industry. By capturing the tasks, knowledge, and skills across the various identity and access management service areas, this competency model is tailorable to fit most organizations’ needs to include any sector-specific training. Using the U.S. Federal Government’s IAM frameworks as a working example, this article seeks to help mature the identity and access management profession and create a more consistent experience across organizations for identity and access management practitioners.","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"10 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122745914","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"User Provisioning in the Enterprise","authors":"I. Glazer, Lori Robinson, M. Hamlin","doi":"10.55621/idpro.84","DOIUrl":"https://doi.org/10.55621/idpro.84","url":null,"abstract":"User provisioning is the means by which user accounts are created and maintained in a system (e.g., database, SaaS app, operating system, etc.). When we say that a user-provisioning system maintains a user account, we mean everything from changes to attributes in the user account, changes of entitlements or privileges associated with the user account, locking and unlocking the user account, and even deletion of the user account. User provisioning is primarily an admin-time affair: a user account is created (or changed) based on an administrative action as opposed to a user’s action at the time of resource use. This article explores the uses and components of a user-provisioning system and focuses mainly on situations where user accounts are maintained in central repositories, typically enterprise and workforce settings.","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"195 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127671087","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Non-human Account Management (v3)","authors":"Graham Williamson, A. Koot, Gloria D. Lee","doi":"10.55621/idpro.52","DOIUrl":"https://doi.org/10.55621/idpro.52","url":null,"abstract":"Non-human accounts are often the “Achilles’ heel” of a robust IAM environment. While IAM professionals concern themselves with managing identities, authentication, RBAC, ABAC, governance, and auditing of user accounts, other IT staff are deploying devices and services that are given access to protected resources via hard-wired accounts, exposed services, and APIs. The management of non-human account control should be consistent with user-based account management, and controls placed on user account access to high-assurance applications should also be applied to non-human accounts. There is no single solution for dealing with non-human accounts. Some IAM professionals suggest all accounts should be managed via the same processes and same infrastructure to ensure consistent policy deployment. This consistency, they argue, should ensure that non-human accounts are not ‘left-out’ when IAM deployments occur. Others consider this impractical and recommend that purpose-specific processes be deployed for non-human accounts. But regardless of the mechanism(s) used to manage non-human accounts, ensuring that they are managed is paramount. Otherwise, non-human accounts will continue to be a cybersecurity attack vector favored by hackers for gaining access to corporate facilities.@font-face{font-family:\"Cambria Math\";panose-1:2 4 5 3 5 4 6 3 2 4;mso-font-charset:0;mso-generic-font-family:roman;mso-font-pitch:variable;mso-font-signature:-536870145 1107305727 0 0 415 0;}@font-face{font-family:Cambria;panose-1:2 4 5 3 5 4 6 3 2 4;mso-font-charset:0;mso-generic-font-family:roman;mso-font-pitch:variable;mso-font-signature:-536869121 1107305727 33554432 0 415 0;}p.MsoNormal, li.MsoNormal, div.MsoNormal{mso-style-unhide:no;mso-style-qformat:yes;mso-style-parent:\"\";margin:0in;mso-pagination:widow-orphan;font-size:12.0pt;font-family:\"Cambria\",serif;mso-ascii-font-family:Cambria;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Cambria;mso-fareast-theme-font:minor-latin;mso-hansi-font-family:Cambria;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:\"Times New Roman\";mso-bidi-theme-font:minor-bidi;}.MsoChpDefault{mso-style-type:export-only;mso-default-props:yes;font-size:11.0pt;mso-ansi-font-size:11.0pt;mso-bidi-font-size:11.0pt;font-family:\"Arial\",sans-serif;mso-ascii-font-family:Arial;mso-fareast-font-family:Arial;mso-hansi-font-family:Arial;mso-bidi-font-family:Arial;mso-ansi-language:EN;mso-fareast-language:EN-AU;}.MsoPapDefault{mso-style-type:export-only;line-height:115%;}div.WordSection1{page:WordSection1;}","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"17 5‐6","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-02-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120850440","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An Overview of the Digital Identity Lifecycle (v2)","authors":"Andrew Cameron, O. Grewe","doi":"10.55621/idpro.31","DOIUrl":"https://doi.org/10.55621/idpro.31","url":null,"abstract":"A digital identity goes through several stages during its existence, from creation, through various modifications in response to different events, to inactivation or deletion. This article walks through the types of digital identities that must be managed, along with the various stages of a digital identity, describing the typical beginning-to-end lifecycle within or across multiple systems. The lifecycles outlined in this document are not meant to be comprehensive but should be applicable over most B2B, B2C, and B2E use cases.","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"125 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-02-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132339720","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Practical Implications of Public Key Infrastructure for Identity Professionals","authors":"Rob Sherwood","doi":"10.55621/idpro.80","DOIUrl":"https://doi.org/10.55621/idpro.80","url":null,"abstract":"Public Key Infrastructure, or “PKI,” is a technology that enables authentication via asymmetric cryptography. It is widely deployed for some vital security use cases on the Internet, especially for authentication of servers via Transport Layer Security (TLS). Despite its wide use for some scenarios, there are significant challenges in deploying PKI for more widespread use among smaller organizations or consumers. Identity Professionals who need to deploy a PKI or have inherited a deployed PKI from someone else have several important considerations, including lifecycle management of keys and certificates, choosing the appropriate way to encode user identifiers and understanding cross-PKI trust.","PeriodicalId":346233,"journal":{"name":"IDPro Body of Knowledge","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116661724","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}