Security Management Strategies for the CIORequires Free Membership to View
In addition, since 2005, identity management products have coalesced into full-blown identity and access management suites from large IT vendors like Sun Microsystems Inc., Oracle Corp., Microsoft, IBM and Novell Inc. There are four pillars to these IAM suites: identity administration, identity infrastructure, access management and auditing.
Roughly speaking, these four areas break down as follows: Identity administration sets up user roles and groups that allow access only to authorized systems. Identity infrastructure is the data store that holds user accounts and identity information, such as Active Directory or LDAP. Access management sets up user accounts with user IDs and passwords, or whatever system is used for access, like smart cards or biometrics. Finally, auditing is about reporting on accounts, such as who has access and to what systems.
Each of these pieces used to be individual products (and in some cases still are), but most have been snapped up and bolted in to IAM suites.
Compliance has driven the growth of these suites, as federal regulations like SOX, HIPAA and GLBA, and industry standards like PCI DSS have forced companies to account for user access to their systems. These regulations require enterprises to assign unique IDs to each user, be able to report regularly on who has access to systems and what the users are doing on those systems.
On another level, access control differs from identity management in that access control is strictly concerned with providing authentication credentials, such as user IDs and passwords or smart cards. The point is to provide users access, not prove their identity. This narrow focus, according to identity management experts, leads to cases of mistaken identity. People who shouldn't have access to systems, like malicious users, masquerade as legitimate users to gain unauthorized access. In this way, identity management revolves around verifying users -- ideally with multiple pieces of proof of their identity -- before issuing credentials.
For more information:
- Learn about good features to look for when searching for access control software.
- Open source vs. commercial network access control products: Find out which one is right for your enterprise.
This was first published in October 2008
Join the conversationComment
Share
Comments
Results
Contribute to the conversation