CIS13: Identity Trends and Transients
1 like706 views
Eve Maler's presentation outlines key trends, transients, tropes, and transparents within IT and security, emphasizing the rise of API channels and the zero trust security model. The document discusses the challenges of adopting standards like XACML and the misconception that 'passwords are dead,' while highlighting strategies like time-to-live for access controls. Additionally, it stresses the need for a more granular approach to authorization in response to evolving technology landscapes.
CIS13: Identity Trends and Transients
- 2. Trends, Transients, Tropes, and Transparents Eve Maler, Principal Analyst, Security & Risk Cloud Identity Summit July 10, 2013
- 3. © 2012 Forrester Research, Inc. Reproduction Prohibited What are the T4 all about? 3 Less well noticed Well noticed Transparents Transients Trends Tropes ClosertotruthinessClosertoessentialtruth • What are they? • What is the evidence? • What should you do about them?
- 4. © 2012 Forrester Research, Inc. Reproduction Prohibited Trend: webdevification of IT 4 Source: John Musser (formerly) of ProgrammableWeb.com IN THE FUTURE, EVERY ENTERPRISE WILL OPEN AN API CHANNEL TO ITS DIGITAL PLATFORM
- 5. © 2012 Forrester Research, Inc. Reproduction Prohibited Confront the changes in your power relationship 5 value X friction Y ACCESS CONTROL IS ABOUT PROTECTION AND MONETIZATION
- 6. © 2012 Forrester Research, Inc. Reproduction Prohibited 6 Source: April 5, 2013 Forrester report “API Management For Security Pros” A lot of identities float around an API ecosystem
- 7. © 2012 Forrester Research, Inc. Reproduction Prohibited Open Web APIs are, fortunately, friendly to the Zero Trust security model 7 Initially treat all access requesters as untrusted. Require opt-in access. Apply identity federation through APIs. Source: November 15, 2012, Forrester report “No More Chewy Centers: Introducing The Zero Trust Model Of Information Security”
- 8. © 2012 Forrester Research, Inc. Reproduction Prohibited Trend: IAM x cloud 8 ZERO TRUST CALLS FOR DISTRIBUTED SINGLE SOURCES OF TRUTH Federate at run time Bind to authn repository Synch accounts Issue an unrelated account
- 9. © 2012 Forrester Research, Inc. Reproduction Prohibited Identity plays only an infrastructural role in most cloud platforms 9 cloud services IAM functions user base and attributes cloud identity product with an actual SKU KEEP AN EYE OUT FOR DISRUPTION COMING FROM THE “CISDH” PLAYERS
- 10. © 2012 Forrester Research, Inc. Reproduction Prohibited Transient: XACML Adoption has government/compliance drivers, few accelerators, and many inhibitors It’s critical to open up the market for long-tail policy evaluation engines Webdevified scenarios demand different patterns of outsourced authorization XACML 3 IS STUCK AT MODERATE SUCCESS AND IS HEADING FOR DECLINE
- 11. © 2012 Forrester Research, Inc. Reproduction Prohibited Authz grain needs to get…finer-grained 11 policy input resource accessed roles groups attributes entitlements domain URL path sets of API calls field XACML etc. scope- grained authz WAM
- 12. © 2012 Forrester Research, Inc. Reproduction Prohibited Plan for a new “Venn” of access control 12 AN “XACML LITE” WOULD HAVE A POTENTIALLY VALUABLE ROLE TO PLAY
- 13. © 2012 Forrester Research, Inc. Reproduction Prohibited Trope: “Passwords are dead” OH, YEAH? correct horse battery staple
- 14. © 2012 Forrester Research, Inc. Reproduction Prohibited We struggle to maximize authentication quality 14 Source: June 12, 20113 “Introducing The Customer Authentication Assessment Framework” Forrester report PARTICULARLY IN CONSUMER-FACING SERVICES
- 15. © 2012 Forrester Research, Inc. Reproduction Prohibited Authentication schemes have different characteristics 15 Source: June 12, 20113 “Introducing The Customer Authentication Assessment Framework” Forrester report, based on “The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes” ✘ ✔ ?✔ ✘ ✔ ✘ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✘ ✘ ✘ ✘ ✘ ✘ ✘ ✘ ✔ ✔ ✔ ✔ * *S2 is an affordance of passwords for “consensual impersonation”
- 16. © 2012 Forrester Research, Inc. Reproduction Prohibited Think in terms of “responsive design” for authentication 16 LEVERAGE STRENGTHS AND MITIGATE RISKS – ONCE YOU KNOW THEM User identification based on something they… Know Have Are Do
- 17. © 2012 Forrester Research, Inc. Reproduction Prohibited Transparent: time-to-live strategies EXPIRATION HAS OUTSIZED VALUE VS. EXPLICIT REVOCATION OF ACCESS IN ZERO-TRUST ENVIRONMENTS
- 18. © 2012 Forrester Research, Inc. Reproduction Prohibited Summary of the T4 18 Less well noticed Well noticed Transparent: Time-to-live strategies Transient: XACML Trends: Webdevification of IT Cloud x IAM Trope: “Passwords are dead” ClosertotruthinessClosertoessentialtruth
- 19. Thank you Eve Maler +1 617.613.8820 [email protected] @xmlgrrl