- 10 open source companies to watch
- Mythbuster busts his own tale
- $208 million petascale computer gets green light
- Sony recalls 73,000 Vaio laptops
- Chrome and Firefox and add-ons
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:App Performance | On Demand Security | Networking Solution | SOA | Value of WDS
Dave Kearns provides the information you need to evaluate, install and maintain your corporate identity management system.
Conversations I’ve had recently with knowledgeable people in the industry are leading me towards a roadmap, or maybe an atlas – or, possibly, a timeline of identity services. That is, there seems to exist a continuum along which your identity projects should travel beginning with identifying the users and other objects in your system.
My friend Archie Reed (he’s a “distinguished technologist” in HP’s Security Office) – even though he violently disagrees with me – helped me to better define the object that is a virtual directory and place it in the identity system context. This is needed to get from the multifarious identity stores throughout the enterprise to a single one, at least as perceived by other applications and services. This then enables a provisioning system to normalize and standardize authentication systems throughout the organization – from account setup through single sign-on to automated password reset.
Later, in chatting with Brian Cleary, Aveksa's new vice president of marketing, we agreed that provisioning needed to be in place in order to successfully implement role management. But roles, by themselves, aren’t much good for anything. Rather, roles are a necessity in order to build a reasonably effective entitlement management solution. Even Bridgestream’s vice president of marketing Ed Zou (with whom I also spoke recently) was willing to admit that roles aren’t an end in themselves but a building block for more “interesting” activities.
It’s roles plus rules that provide the fine grained access control that entitlement management promises. But we can now see that entitlement management isn’t the end point; it’s just another marker on the road to a fully implemented identity service. There’s another necessity for entitlement management which really doesn’t play in the role space and that’s the “identity of things” – objects (computers, printers, phones, cars, conference rooms, etc.), applications and services - which are the targets of the entitlements that are managed.
Once the entitlement management, with its fine grained access control, is in place we can move on to the next major plateau – context-based access. That’s even finer grained control, because it can vary by time-of-day, day-of-the-month, user-location, state-of-the-target and just about any other contextual condition we can measure: who, what, when, where, how and maybe why some user (in some role) wants to access some thing (in accordance with some rule).
Dave Kearns is a consultant and editor of IdM, the Journal of Identity Management.

Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...
Vulnerability Management For DummiesDownload this concise book "Vulnerability Management for Dummies," to learn about the simple steps...
The ROI and TCO Benefits of Data Deduplication for Data Protection in the EnterpriseThis paper examines and quantifies the costs and benefits of backup with deduplication storage as...

Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...
PoE Plus: Impact on the PoE MarketThe standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...
Harnessing the power of communications to increase workplace performanceDue to the convergence of IT and telecommunications technologies, the business workplace has been...

We have so many holes punched in our firewalls today that many industry insiders question the value...
The self-managed networkWe aren't there yet, but advances in network and systems management tools are making it possible to...
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment