Supporting Compliant and Secure User Handling - A Structured Approach for In-House Identity Management

Abstract

The catchword "compliance" dominates the actual debate about Identity Management and information security like few before. Companies need to comply with a variety of internal and external standards and regulations like the US SOX act. Identity Management is seen as a main provider of compliance in modern companies. However, its organisational aspects are underestimated in many projects, lacking a comprehensive approach to introduce in-house Identity Management. This work is based on the experiences gained from industry projects using Identity Management functionalities to strengthen security and to reach a high level of compliance. We develop a structured process-oriented methodology for introducing an Identity Management Infrastructure for organisations using drivers from IT security management to evaluate, rank, and implement subprojects. The methodology consists of an iterative process which enables even large and unstructured organisations to reach a suitable and profitable level of Identity Management by emphasising on organisational aspects rather than taking a merely technical approach.

Adaptive identity and access management—contextual data based policies

“…[5,9]), as well as their underlying access control models has been carried out [10]. However, while the importance of IAM policies in general [5] and of organizational policies in particular [11] has been acknowledged, hardly any work specifically considers the challenge of policy detection and management in large and complex environments.…”

“…This includes modules for user management, access management, data handling and synchronization, or user provisioning [5,9]. User management is concerned with managing the identity lifecycle, whereas access management provides functionality to authenticate and authorize users.…”

“…In general, typical IAM systems are built on three pillars: processes, technologies and policies [5]. Core identity lifecycle processes like user (de)provisioning or access privilege management are implemented using available automation technologies.…”

BusiROLE: A Model for Integrating Business Roles into Identity Management

“…It deals with the storage, administration, and usage of digital identities during their lifecycle. The aforementioned identity chaos needs to be faced by implementing a centralised IdMI as shown in [7]. Its main building blocks are a Directory Service, User Management, Access Management, and an Auditing Module.…”

“…Roles are seen as means to meet compliance demands in general. Yet, implementing a technical IdMI as presented in [7] is only the starting point for getting compliant. IdM is not able to take business needs into consideration on a purely technical level.…”