IAM-TheBlog

[iam-a-blog]

Single Sign-On (SSO)

Ever wondered how by logging in to Gmail, you are also able to navigate to Google’s other children like YouTube, Google Drive, G+ etc without being prompted for an ID or password?

Single sign-on (SSO) is an authentication process that allows a user to access multiple applications with one set of login credentials. With SSO, a user logs in once and gains access to different applications without the need to re-enter log-in credentials at each application.

SSO is a common procedure in enterprises, where a client accesses multiple resources/applications. The service authenticates the end user for all the applications the user has been given rights to and eliminates further prompts when the user switches applications during the same session. On the back end, SSO is helpful for logging user activities as well as monitoring user accounts. SSO mechanisms vary, depending on application type.

However, SSO is not suited for systems requiring guaranteed access, as the loss of log-in credentials results into denial of access to all systems. Ideally, SSO is used with other authentication techniques, such as smart cards and one-time password (OTP) tokens.

Common SSO Mechanisms:

Following are the most common mechanisms used for SSO. We will not delve deep into them for now but in future blogs.

Kerberos-based - Initial sign-on prompts the user for credentials, and gets a Kerberos ticket-granting ticket (TGT). Additional applications that the user navigates to use these TGT proving the user's identity without prompting the user to re-enter credentials

Smart-card-based - Initial sign-on prompts the user for the smart card. Additional software applications also use the smart card, without prompting the user to re-enter credentials. This method either uses certificates or passwords stored on the smart card.

Security Assertion Markup Language (SAML) - SAML is an XML-based solution for exchanging user security information between an SAML identity provider and a SAML service provider.

Pros:

·         Reduce password fatigue from different username and password combinations

·         Reduce time spent re-entering passwords for the same identity

·         Reduce IT costs due to lower number of IT help desk calls about passwords

·         Mitigate risk for access to 3rd-party sites (user passwords not stored or managed externally)

·         Minimizes phishing.

·         Improves compliance through a centralized database.

·         Provides detailed user access reporting.

Cons

·         It increases the negative impact in case the credentials are available to other people and misused or if hacked. This can be prevented with high security, governance and 2-factor or multi factor authentication

·         A loss of SSO can result in denial of access to all systems unified under the SSO. A workaround is to keep highly critical applications out of SSO.

Stay tuned for future blogs. Please leave a comment or suggestions if any,

[iam-a-blog]

Identity and Access Management - Let’s get started

Information security and Identity management are both current major concerns for enterprises especially with the growing use of mobile applications and the sensitive data that these handle.

Information Security?

InfoSec is the state of being protected against the unauthorized use of information, especially electronic data, or the measures taken to achieve this without hampering organization productivity. This is largely achieved through a multi-step risk management process that identifies assets, threat sources, vulnerabilities, potential impacts, and possible controls (like industry standards on password, antivirus software, firewall, encryption software etc) followed by assessment of the effectiveness of the risk management plan.

Identity and Access Management?

IAM, IDM, IDAM are all acronyms of Identity and Access Management and is intended to be the primary focus of this blog. It is the branch of InfoSec that enables the right individuals to access the right resources (could be an application, data or even hardware) at the right times and for the right reasons. Identity is the consumer that needs to access a resource. This consumer while most of the time is best viewed as a person or a digital persona but could also be other resources like a Database or other applications.

Identity management is a process applied to ensure the integrity and privacy of identity and how it is created, managed and also how it translates to an access. This brings us to another important question, what is access? Access is essentially a Yes/No decision. Access Management is a deployment that is tasked with the Yes/No decision making in lieu with an identity.

Identity Management creates an identity and manages the attributes related to the user whereas Access Management evaluates these attribute values and authorizes the user. Note that Authorization is not the same as authentication. In simple terms, authentication is the process of verifying who you are, while authorization is the process of verifying what you have access to.

Since examples are the best way to remember concepts, let’s consider a couple of them. A certain Media Sharing Platform requires any user that uses it to create an account by registering.  During registration, some data is collected to store in the platform’s database. These are a part of Identity Management. Now, once the account is successfully created, the user has to enter his unique id and password to login to his account. This is authentication. This platform allows everybody to view each other’s shared photographs while browsing through other people’s videos is a paid feature. Whether a user has activated this paid feature or not is stored in an attribute (DB column) in the platform’s database. The storing and managing of this attribute is a part of identity management, whereas checking the attribute value once the user has logged in and tries to browse through other users’ profiles is authentication. This decision making of whether a user is a “paid user =Yes/No?”  is authorization and is handled by Access Management. If a user is authorized (paid=yes), the Access management module allows the user to browse through and play the videos and if not authorized (paid=no), the user is stopped from doing so.

As another example, consider a Windows desktop. Creating account on the desktop is the Identity Management. Logging in to the desktop is by authenticating against the Windows Local Registry and the permissions that you have on data on a specific location (Read Only, Read/Write, Delete etc) is based on the authorization level against your identity. Administrator account has all access whereas a guest account may have read-only access to Windows C drive.

Stay tuned for more blogs on IAM and it’s tools.