Identity Crisis: 7 Steps to Better Identity Management
Managing the access rights, identities and passwords of employees and other IT users has never been easy. In recent years, it's gotten more complicated as companies expand their use of outsourced services and software as a service.
As a result, IT has expanded the concept of federated identity management beyond the corporate walls and been left asking how best to provision, manage and revoke access, not just to enterprise and custom applications, but also third-party hosted apps?
Many IT managers ask this question after things have fallen apart--once they can no longer manage accounts, understand what users have access to and support logons of third-party services. A lot of heartache could be avoided by following the seven steps outlined in this report. This process will give you a deeper understanding of how identity management works in your IT environment, and what you can do to improve it.
These steps include: Identifying the technologies in your company that require identity management, where your users' accounts live and what your master authentication system is; evaluating whether you need a central authentication system; finding out what SaaS services are being used in your company; making sure you understand all workflows and determining how much IDM your organization can handle; and finally, picking a system if, indeed, that's what you need.
Table of Contents
3 Author's Bio
4 Executive Summary
5 The Identity Management Challenge
5 Figure 1: Permit External Assets on Network
6 Know What You're Managing
6 Federated IDM: What It Can Manage and Advantages
7 Know Where All the Accounts Are
8 Figure 2: State of Identity Management Use
8 Evaluate a Central Authentication System
9 Look Outward
10 Figure 3: Number of Employee Authentication Factors
11 Understand Workflows
12 Figure 4: Flow Chart Example
12 Know Your Limits
13 Picking a System
About the Author
Adam Ely is director of security for TiVo. As an InformationWeek Reports contributor, he has authored multiple research reports on data and code security. He previously led a software development group at Walt Disney Co., where he implemented secure coding standards and source code analysis processes.
Adam gained extensive experience with enterprise and cloud security while supporting applications and services for clients such as AmEx, Citi and Expedia as manager of information security with TRX. He has published numerous security vulnerabilities and papers and conducts security research with leading firms to advance threat analysis and protections.
Adam currently serves as a member of the Journal Editorial Review Committee for ISACA and sits on the advisory board for an information security consulting firm. Adam has released numerous application vulnerability advisories, authored and contributed to open source security applications, and is the co-author of the Center for Internet Security Tomcat Benchmark.
He holds an MBA from Florida State University; a BS in information technology from Capella University; and multiple certifications, including CISSP, CISA, NSA IAM and MCSE.
|
Thread View | Flat View | 1Comments |
 DId Novell get into the Identity Space after May 2010?Comment by rseepaulr3g Dec-13,2010 4:36:53 PMJust Wondering if these links appeared After May 2010http://www.novell.com/products/identitymanager/technical-information/http://www.novell.com/products/compliancemanagementplatform/http://www.novell.com/products/accessgovernancesuite/technical-information/Reply |
