1 / 24

Identity the New Perimeter

Identity the New Perimeter. Adrian Seccombe Surrey University 25 th March 2010. Key questions this session will answer. Which are the key attributes of Cloud Types What are some of the key cloud choice drivers?

niel
Télécharger la présentation

Identity the New Perimeter

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Identity the New Perimeter Adrian Seccombe Surrey University 25th March 2010

  2. Key questions this session will answer • Which are the key attributes of Cloud Types • What are some of the key cloud choice drivers? • Identify primary transformational SHIFTS required to enable a secure but collaborative clouds? • Why does Identity and Access Management have to SHIFT?

  3. To Cloud or Not to Cloud? Traditional “or” Cloud

  4. Let’s get real! Traditional We are all “Hybrid” already! Cloud

  5. Unfortunately… • Our Business Partners are pressing ahead into the clouds, often unaware that they are! • We are NOT architecting our way into the Clouds • Seems like we’ve been here before…… remember the early PCs? • This is where the Jericho Forum Self Assessment Scheme will be able to help you…

  6. Some Definitions • NIST and the Jericho Forum have it wrapped! Essential Characteristics: • On-demand self-service. • Broad network access. • Resource pooling. • Rapid elasticity. • Measured Service. “NNN as a Service” “Deployment Models” Last! Private Public 3rd Hybrid Community SaaS 2nd “Cloud Cube” PaaS 1st IaaS http://csrc.nist.gov/groups/SNS/cloud-computing/index.html http://www.opengroup.org/jericho/cloud_cube_model_v1.0.pdf

  7. “NNNNN as a Service” Outcome / Value aaS Last! Process aaS 4th Orchestration Security and IdAM Software aaS A b s t r a c t I o n o c c u r s h e r e ! 3rd Platform aaS 2nd Infrastructure aaS 1st Network aaS

  8. Maturity of the Cloud Layers Outcome / Value Last! Process 4th Orchestration Security and IdAM Software 3rd A b s t r a c t I o n o c c u r s h e r e ! Platform 2nd Infrastructure 1st Cloud Maturity Scale Immature Mature

  9. The Cloud Cube revisited External Deperimeterised Internal Perimeterised Proprietary Open

  10. The Cloud Cube revisited External Private New Perimeters Internal Traditional Perimeters Proprietary Open

  11. Choose the Clouds with care! • Private Clouds are Silos(Sometimes you need Silos) • Proprietary Clouds Can Lock You In • Internal Clouds are a Stop Gap • Clouds with the Old Perimeters donot enable external collaboration

  12. The key shifts The Identity Shifts Identity the new Perimeter

  13. Identification: The presentation of an identifier so that the system can recognize and distinguish the presenter from other principals Authentication:The exchange of information in order to verify the claimed identity of a principal Privilege Management in Ten Words Identification Authentication Authorization Prove it! You can access this stuff... Who are you? • Authorization: The granting of rights, including access, to a principal, by the proper authority Principal: An entity (people, devices, applications, etc.) whose identity can be authenticated Reference: Open Group XDSF (X/Open Distributed Security Framework), ISO 10181-3

  14. Did you spot the gap? Inside the Old Perimeter • Identify: Who are you? • Authenticate: You are you • Authorise: Have this! Outside the Old Perimeter • Principal declares Identity • Identity Authenticated • Resource Requested • Resource Identified • Resource declares Rules • Rules verified • User claims capabilities /attributes • Claims verified • Access Control Decision Magic Occurs here! Entitlement Identity Shift #1 Resource Centric

  15. “Identity” Lifecycle of a Resource • Create Resource Identity • Verify Resource Identity • Set the Access Rules (eg Must be Over 18) • Enable Rule Authentication • Entitlement Check (Are you Over 18?) • Verify Claim • Evaluate • Allow Access to Resource Resource: Service, System, Code, Information

  16. Diagram Courtesy Steve Whitlock ISO Authorization Model Access Control Decision Function Asymmetrical Access Control Enforcement Function Principal Resource Identity, Access Request Resource Labels Access Additional Attributes Decision Cache Request, Identity, Attributes Relatively Dynamic Decision Environmental, Resource, & Principal Attributes; Identifiers Decision Support Information Audit Logs Relatively Static Note The Resource attributes are separate from the Resources While the principals have attributes and a place to verify them Policy Admin Rules

  17. Access Control Decision Function Symetrical Symmetrical Evolving Jericho Authorization Model Access Control Enforcement Function Principal Resource Identity, Attributes Access Request Resource Labels Access Rules Access Rules Attribute Updates Decision Cache Request, Identity, Rules, Attributes Decision Decision Support Information Verified Rules Verified Attributes Relatively Dynamic Environmental, Resource, & Principal Attributes; Identifiers Audit Logs Relatively Static Note The differences are subtle but key, Symmetrical Identity, Entitlement and Access Management Policy Admin Rules

  18. Evolving Jericho Authorization Model Access Control Decision Function Symetrical Symmetrical Access Control Enforcement Function Principal Resource Identity, Attributes Access Request Resource Labels Access Rules Access Rules Attribute Updates Decision Cache Request, Identity, Rules, Attributes Decision Decision Support Information Verified Rules Verified Attributes Relatively Dynamic Environmental, Resource, & Principal Attributes; Identifiers Audit Logs Relatively Static Note The differences are subtle but key, Symmetrical Identity Entitlement and Access Management Policy Admin Rules

  19. Identity Shift #2 Proessionals Groups Customers Federated Suppliers Organisations Collaborators Enterprise Partners Competitors Traditional (Access Control List)

  20. Identity Shift #2 Identity, Entitlement & Access Management User Centric Strangers Individual Friends Professionals Principal Family Groups Customers Federated Identity Provider Service Organisations Suppliers Governments Collaborators Enterprise Partners Competitors Resource Traditional (Access Control Lists)

  21. “Identity” Lifecycle of a Principal • Create Identity • Verify Identity • Stake Claims (Set Identity Capabilities / Attributes) • Verify Claims • Use / Present Identity • Authenticate Identity • Request Resource • State required Capability or Attribute (Claims) • Authenticate Claims

  22. Identity is the key to the Clouds Old Frame • Enterprise Centric • Access Control List • Directory Server • Authentication Svcs New Frame • Principal Centric • Resource Centric • Rules Based Access • Authentication Routing An ACTION for you ,to enable your SHIFT: Get your architects defining and / or divining the Access Rules that apply to YOUR resources. Hint: Keep them Simple!

  23. And finally • It's really all about the new perimeter….. • ….the Identity Perimeter • What are we Human’s or Ostriches? • We have been complacent for too long! • We need to bolster our defences at the same time as redesigning them. • How best can we do that?

  24. CCloud “I see no Clouds”

More Related