Identity Management

Wednesday, February 20, 2008

The Laws and Flaws of Identity

Kim Cameron's Seven Laws of Identity

Technical identity systems must only reveal information identifying a user with the user’s consent.
The solution that discloses the least amount of identifying information and best limits its use is the most stable long-term solution.
Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.
A universal identity system must support both “omni-directional” identifiers for use by public entities and “unidirectional” identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.
A universal identity system must channel and enable the inter-working of multiple identity technologies run by multiple identity providers.
The universal identity metasystem must define the human user to be a component of the distributed system integrated through unambiguous human-machine communication mechanisms offering protection against identity attacks.
The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies.

And Mike Neuenschwander's Seven Flaws of Identity

Failure of the weakest links mustn't lead to catastrophe - encrypting the channel doesn't stop dumpster diving.
Not putting the role before the start role engineering is important, but it doesn't drive the project.
Not every identity nail requires the technology hammer - technology may be fine, but without governance, it will fail.
Use of a system invites abuse of it so test the architecture with attack vectors.
Identifying things doesn't make them more secure - identification can improve security, but it's not the inevitable outcome.
Identity isn't about the individual - it's about the relationship; identity management encompasses the services communities need for organization.
There are a lot more than seven flaws.

Friday, June 23, 2006

Online articles...

Banking Security Summit, 2006
http://www.cxotoday.com/cxo/jsp/article.jsp?article_id=74090&cat_id=909

Network Computing feature on multi-factor authentication
http://www.nc-india.com/features/stories/64796.html

Technology Senate, 2005
http://www.networkmagazineindia.com/200511/eventsts200520.shtml

Access Management
http://www.cxolinux.com/India/News/Enterprises_Secure_With_Novell_Access_Manager_3/551-76894-1200.html

Access Management
http://www.expresscomputeronline.com/20061211/technology07.shtml

Next generation security threats - InfoSecurity June 2009
http://fanaticmedia.com/infosecurity/archive/June09/Portwise.htm

Identity and Authentication: Securing Future Digital Access
http://fanaticmedia.com/infosecurity/archive/Sep09/IDA%20Cover%20story.htm

Trends in Internet Banking Security
http://www.24framesdigital.com/iba/081009/tejas_lagad.html

How mobile is your banking?
http://economictimes.indiatimes.com/money-banking/How-mobile-is-your-banking/articleshow/5217563.cms

CRO Magazine (Nov 2009) - PortWise 4.8 Supports Cloud Security
http://www.finsight-media.com/html/int.htm

Cyber Crime: Gaining New Threat Vectors - InfoSecurity Nov 2009
http://fanaticmedia.com/infosecurity/archive/Nov09/Cyber%20Crime%20-%20Gaining%20New%20Threat%20Vectors.htm

Authentication Tokens: A paradigm Shift - InfoSecurity Feb 2010
http://fanaticmedia.com/infosecurity/archive/Feb10/Authentication%20Tokens%20story.htm

Tuesday, January 31, 2006

Seven identity management project risks

Mark Dixon has intiated a discussion on the Seven identity management project risks. Here they are:

1) Poor pre-project preparation.
2) Poor requirements definition.
3) Large initial scope.
4) Inexperienced resources.
5) Poor project methodology.
6) Scope creep (the project grows bigger each time someone takes another look at it).
7) Not using available support.

http://blogs.sun.com/roller/page/identity?entry=seven_identity_management_implementation_risks

Tuesday, January 10, 2006