Basics

The ABCs of Identity Management

Providing IT managers with tools and technologies for controlling user access to critical information within an organization.

By John K. Waters

• What is identity management?
• Why should I care about identity management?
• How can an identity management system benefit my business?
• How do identity management systems work?
• What is Federated Identity Management?
• What challenges or risks does implementing an identity management system present?
• What terminology should I know?

What is identity management?

Identity management is a term that refers broadly to the administration of individual identities within a system, such as a company, a network or even a country. In enterprise IT, identity management is about establishing and managing the roles and access privileges of individual network users. ID management systems provide IT managers with tools and technologies for controlling user access to critical information within an organization.

The core objective of an ID management system in a corporate setting is this: one identity per individual. But once that digital ID has been established, it has to be maintained, modified and monitored throughout what has been called the "access lifecycle." So ID management systems provide administrators with the tools and technologies to change a user's role, to track user activities and to enforce policies on an ongoing basis. These systems are designed to provide a means of administering user access across an entire enterprise and to ensure compliance with corporate policies and government regulations.

The list of technologies that fall under this category includes password-management tools, provisioning software, security-policy enforcement applications, reporting and monitoring apps, and identity repositories. Nowadays, these technologies tend to be grouped into software suites with assortments of additional capabilities, from enterprise-wide credential administration to automated smart-card and digital-certificates management.

The ID management buzz phrase of the moment is "identity lifecycle management." The concept encompasses the processes and technologies required for provisioning, de-provisioning, managing and synchronizing digital IDs, as well as features that support compliance with government regulations. Technologies that fall under the ID lifecycle-management rubric include tools for security principal creation, attribute management, identity synchronization, aggregation and deletion.

Why should I care about identity management?

ID management is inextricably linked to the security and productivity of any organization involved in electronic commerce. Companies are using ID management systems not only to protect their digital assets, but also to enhance business productivity. The systems' central management capabilities can reduce the complexity and cost of an essential process. The centralized access control also supports consistent security policy enforcement.

ID management systems also give organizations a way to control the swarm of untethered endpoints—laptops, PDAs and cell phones—buzzing around the enterprise. Many of these devices are neither owned nor provisioned by the companies whose networks they need to access. The ability to enforce a set of policies on the devices that connect with the network through the management of the identities of the users of those devices is fast becoming a must-have security capability.

And besides, the government says you have to care about identity management. In 2005, ID heists at ChoicePoint, Bank of America and LexusNexis lit a veritable bonfire under U.S. congressional behinds, and lawmakers began making moves to put the onus for safeguarding customer info squarely on the shoulders of the enterprise. Sarbanes-Oxley, Gramm-Leach-Bliley, HIPAA—each holds the company, in various ways, responsible for controlling access to customer and employee information.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Tips for Tackling Identity Management
• Identity Management: Implementation Dos and Dont's
• The Truth About Federated Identity Management