Different Approaches to In-House Identity Management - Justification of an Assumption

Abstract

The use of roles in Identity Management Infrastructures (IdMI) has proven to be a solution for reorganising and securing access structures of employees. The definition of enterprise-wide roles is one of the most challenging and costly tasks during role development projects. It needs to be carried out on the basis of a predefined Role Development Methodology (RDM). In this paper we present existing methodologies and show their respective pros and cons. Lately some researchers have informally stated that hybrid role development is the most promising way to define roles, however, there hasn't been given a well-defined justification for this decision. The main contribution of this paper is hence the deduction of evaluation criteria based on information gathered from literature, practical experiences, and shortcomings of existing role development approaches. The evaluation criteria form the basis for a comparison framework verifying the assumption that hybrid RDMs are superior to Role Engineering and Role Mining methodologies.

Optimization of Access Control Policies

“…They are not designed for classical inhouse identity management environments where employees with a defined task range are managed (cmp. Fuchs and Pernul (2007); Fuchs et al (2009)), but aim to mitigate risk when little user information is available.…”

“…application systems that manage individual user accounts and permissions for their own application context) (Fuchs and Pernul, 2007). While having an integrated data view on the identity management infrastructure is a common prerequisite for IAM measures, the creation of such a view requires significant effort and should therefore not be neglected (Fuchs et al, 2009).…”

Sicherheitsherausforderungen in hochverteilten Systemen

“…In diesem Zusammenhang wird häufig auch von föderierten IdMAnsätzen (vgl. Fuchs et al 2009) gesprochen, bei denen sich die Benutzer sicher und komfortabel bei einem zentralen Identitätsverwalter authentifizieren können. Voraussetzung für diese Form des IdM ist ein gegenseitiges Vertrauen der beteiligten Partner innerhalb der Cloud.…”

Adaptive identity and access management—contextual data based policies

“…Similar to approaches used for the cleansing of static access privilege assignments, for example presented in [31,32], the DPMP requires human expert interaction after the detection of potentially reasonable policies. In case the system suggests an unreasonable large number of new policies potentially including a high rate of false-positives (detected policy suggestions which are discarded after human review), it would add an additional burden rather than create value for an organization.…”

“…Semantic analysis [31,32] introduce a classification for every assignment based on the examination in context of other entities within the given scope. A simple example would be if only one employee within the "development" department owns the entitlement "access marketing share".…”