heterogeneity and distance

Mark Diodati

modern identity:

CIS Survival Guide

99 sessions

48 possible workshops

12 hours of workshops

60 remaining sessions

24 sessions

12 hours of sessions

2 social events

caffeinate

hydrate

take your vitamins

get some rest

take good notes

get outside

make a friend

modern identity

applications services

user constituencies devices

heterogeneity

distance

distance: span of control

on-premises

in the cloud

applications

self-managed

partner-managed

SaaS-managed

applications

IaaS

SaaS

PaaS

applications

traditional IAM

IDaaS

identity bridge

services

self-managed

partner-managed

services

employees

partners

contractors

users

customers

AD-joined PC/Mac COPE devices

devices

BYOD devices PC/Mac

mobile devices

authentication: what matters

application support

4 things that matter

identity assurance

4 things that matter

identity assurance

cost

4 things that matter

$10,000 barn

$5,000 horse

4 things that matter

usability

eternal truths

first eternal truth

identity assurance

cost and decreased usability

your app’s assurance requirement

“sweet” spot

costs too much

identity assurance

session duration

second eternal truth

not good enough

reset expectations?

my career in heavy metal music

wristwatch

modern authentication

requires

adaptive and local biometrics

die darwin

adaptive origins

conventional

primary authentication

password

smart card one-time

password (OTP)

SMS

adaptive device ID

• ____ • ____ • ____

IP blacklist

• Bill pay $349 • Bill pay $610 • EFT $2,000,000

behavioral

geolocation

primary authentication

assurance over time

identity assurance

session duration

higher assurance

modern adaptive

53

degree of difficulty

distance

modern adaptive

prim

ary

adap

tive

adaptive server

resources resources

browser

adaptive: traditional

adaptive: WAM

(3) yes/no or risk score

adaptive server

(1) prim

ary

WAM policy enforcement point

WAM policy decision point

browser

adaptive: WAM

(3) yes/no

service provider identity provider adaptive server

(1) prim

ary

browser

adaptive: federation

resource server OpenID Provider authorization server user info endpoint

client/relying party/app

API

58

client/relying party/ app

client registration (admintime)

OpenID Provider/ authorization server

token refresh (runtime)

resource server token presentation (runtime)

frequency adaptive: API

mobile biometric

biometric reader in every pocket

adaptive enhanced device ID

A

privacy

playlists

eternal truths redux

first new eternal truth

identity assurance

cost and decreased usability

app requirement

first new eternal truth

identity assurance

cost and decreased usability

app requirement

identity assurance

session duration

second new eternal truth

app requirement

identity assurance

session duration

second new eternal truth

app requirement

identity assurance

session duration

continuous: our best aspiration

continuous

app requirement

heterogeneous, distant, continuous

authentication?

monitor adaptive

developments

layer authentication techniques to raise

assurance

plan for multiple authentication

types

get your proofing right

iden

tity ass

uran

ce

password mobile smart card

proofing matters proofing

tune your engine