c o m p u t e r s & s e c u r i t y 3 0 ( 2 0 1 1 ) 7 4 8 e7 6 90167-4048/$ e see front matter ª

The catchword "compliance" dominates the actual debate about Identity Management and information security like few before. Companies need to comply with a variety of internal and external standards and regulations like the US SOX act. Identity Management is seen as a main provider of compliance in modern companies. However, its organisational aspects are underestimated in many projects, lacking a comprehensive approach to introduce in-house Identity Management. This work is based on the experiences gained from industry projects using Identity Management functionalities to strengthen security and to reach a high level of compliance. We develop a structured process-oriented methodology for introducing an Identity Management Infrastructure for organisations using drivers from IT security management to evaluate, rank, and implement subprojects. The methodology consists of an iterative process which enables even large and unstructured organisations to reach a suitable and profitable level of Identity Management by emphasising on organisational aspects rather than taking a merely technical approach.

No abstract

Due to compliance and IT security requirements, company-wide identity and access management within organizations has gained significant importance in research and practice over the last years. Companies aim at standardizing user management policies in order to reduce administrative overhead and strengthen IT security. These policies provide the foundation for every identity and access management system no matter if poured into IT systems or only located within responsible identity and access management (IAM) engineers' mind. Despite its relevance, hardly any supportive means for the automated detection and refinement as well as management of policies are available. As a result, policies outdate over time, leading to security vulnerabilities and inefficiencies. Existing research mainly focuses on policy detection and enforcement without providing the required guidance for policy management nor necessary instruments to enable policy adaptibility for today's dynamic IAM. This paper closes the existing gap by proposing a dynamic policy management process which structures the activities required for policy management in identity and access management environments. In contrast to current approaches, it utilizes the consideration of contextual user management data and key performance indicators for policy detection and refinement and offers result visualization techniques that foster human understanding. In order to underline its applicability, this paper provides an evaluation based on real-life data from a large industrial company.

Abstract. Defining valid enterprise-wide roles needs to be carried out on the basis of a predefined Role Development Methodology. Hybrid role development combining elements from Role Engineering and Role Mining is the most promising way to define enterprise-wide roles, however no such model has been published yet. We close this gap by analysing existing approaches and proposing HyDRo, a tool-supported methodology that facilitates existing identity information and access rights without neglecting the importance of information like managers' knowledge about their employees.