March 2017 - DG-IDPro - mailman.kantarainitiative.org

Body of Knowledge working group
by Andrew Hughes 09 Mar '17

09 Mar '17

As the recent list threads highlight, there is a need for a consolidated body of knowledge. We have developed a simple taxonomy and are working on itemizing "things ID Pros should know or know about for the profession" within that basic structure. We are not writing the book of knowledge - just the table of contents. Our approach right now is pretty sporadic - contributing to the google doc - our pace is limited by the number of people showing up regularly. If you can contribute time to organize in-person sessions or other construction methods, please step up. Meeting times are Mondays 11am Eastern. thanks andrew. *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

4 5

Re: [DG-IDPro] IdM Poster.
by Andrew Hughes 08 Mar '17

08 Mar '17

Hey Charles - that's a good characterization of identity attributes, but perhaps not the only useful one. I think it applies mostly to the case where identity attributes are being used to recognize or otherwise identify a returning entity. However, when attempting to identify an entity that may not have been previously encountered, and without a previously-stored authoritative data source for comparison, all that is left is characteristics of an entity that can be used to describe that entity. Which is useful in many other scenarios. Other techniques such as enrollment, correlation, step-up authentication, delayed authentication etc. could then be applied if there is a need to determine uniqueness or use a broader context/population. The context within which the analyst is considering the semantics of the 'attribute' is likely to constrain the required characteristics of those attributes. (or something like that) andrew. *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security * On Wed, Mar 8, 2017 at 5:31 AM, Charles Eckert <mr.eckert(a)gmail.com> wrote: > Have been following this discussion closely and had a few thoughts on this > statement. > > > > While I agree that each of the attributes you’ve cited are attributes > about an entity, I’m not convinced they are good Identity Attributes. Every > entity, whether a person or NPE, has a bunch of attributes associated with > them. A subset of those attributes are useful to identify that entity > within a specific context and I would consider those Identity Attributes. > > > > The context piece is important. Email address is unique using unique > name/domain pairs for the entire population, a plain username is only > workable within an application or site. Even unique identifiers like SIN > may collide across national boundaries. This is where the example of the > password as an identity attribute falls down and can’t be guaranteed to > maintain uniqueness within a population of accounts. > > > > I suspect identity attributes have a few key characteristics: > > 1) Sufficient to identify a specific entity within a context > (application, national, global, etc) > > 2) Tend to be stable over the long term (which is why weight and > height, facial hair, etc wouldn’t be great identity attributes) > > 3) Strong identity attributes are associated with events that define > an identity (e.g. birth cert (or change of name) for name, Serial Number at > manufacturing, account creation, etc) as they provide a documented > start/stop to a specific attribute > > > > Behavioural Biometrics > > “Something you do” is discussed frequently within the authentication > context. I see its value in continuous authentication scheme; after the > primary authentication event, behaviour can demonstrate whether the entity > still has active control over the account. For primary authentication, I’d > still look at the first 3 factors only for their point-in-time nature. > Unless behavioral biometrics were baked into primary authentication (e.g. > cadence of password/pin) then the measurement over time can only > demonstrate that the entity had possession previously and/or after the auth > event. > > > > The full set of entities that need identity includes persons and NPEs > (IoT, IoE, etc). These are easy, but longer term identity will also have to > apply to other constructs as well: from current generation “chat bots” to > future AI entities. > > > > Thanks for starting this interesting thread Kaliya. Hopefully this will > create a healthy conversation within that program. > > > > Charles > > > > *From:* dg-idpro-bounces(a)kantarainitiative.org [mailto:dg-idpro-bounces@ > kantarainitiative.org] *On Behalf Of *Natale, Bob > *Sent:* Wednesday, March 8, 2017 3:30 AM > *To:* Kaliya Identity Woman > *Cc:* dg-idpro(a)kantarainitiative.org > > *Subject:* Re: [DG-IDPro] IdM Poster. (thats wrong) > > > > Hi Kaliya, > > > > Don’t mistake the value of an attribute for the attribute as a construct. > > > > My weight, height, marital status, address(es), phone number(s), even SSN, > might change over time too … that does not negate there status as useful > identity attributes. > > > > Avanti, > > BobN > > > > >

2 1

ID Pro Body of Knowledge - please contribute
by Andrew Hughes 08 Mar '17

08 Mar '17

Hi everyone - the people attending BoK calls have drafted the linked document. It's the highest-levels of a taxonomy and starting items for the body of knowledge. This link gives you 'Comment' permissions on the google document. Please add suggestions add comments to help us make progress. https://docs.google.com/document/d/1HNLZginMaRtFdraQTpVkdJ6z8Aj86cM_87TE6T5… This is one of the essential artifacts of the ID Pro organization - it defines the scope of the endeavor and anchors all the other activities. Please help by contributing to define what it means to be an ID Pro - or someone else will do it for you :) andrew. *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

3 4

Attributes and Context [WAS: IdM Poster.]
by Andrew Hughes 07 Mar '17

07 Mar '17

Disclaimer to start: my contribution to this thread is intended to not judge correctness or incorrectness of anyone's views. The poster and dialogue sparked an interesting line of thinking. "Under what circumstances would identity data and authentication factor data be considered to be identity attributes" An answer took a while because I deal with IDP, CSP, AA, RP terms all day. I think one answer is: when you are an external observer or data analyst looking at a data stream and have no direct knowledge of any attribute databases or individual entities. or: Data analytics on data streams where the observer is not one of IDP, CSP, AA or RP. The mode that I typically work in is where the individual entity is asserting some claim. Or as a Verifier evaluating an authentication assertion. Or as an attribute authority with a database of well-organized data. When you take those parties out of the observation, then everything on the wire could be: infrastructure management data, transactional data, other metadata, and possibly attributes that could be ascribed to an individual entity. I also see that Nat's observation of the ISO definitions is compatible with my musings. andrew. *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security * On Tue, Mar 7, 2017 at 6:15 AM, Natale, Bob <RNATALE(a)mitre.org> wrote: > That’s true … but not necessarily the total dichotomy implied by the > assertion that “Identity is NOT Authentication” … authenticator attributes > can also be identifier attributes and vice versa … the closer an > authenticator attribute (like a human fingerprint) is to a unique > identifier (like a human fingerprint paired with some threshold set of > appropriate biographic, biometric, behavioral, and social attributes), the > murkier the line between identity and authentication might become. > > > > Or so it seems to me…. Things might vary a bit, with respect to what is a > valid identity attribute, between human person identities and virtual > entity identifiers as well … but that’s probably a topic for a different > thread! > > > > Ultimately, however, I strongly favor keeping the concepts of identity, > authentication, authorization, and access control distinctly defined, as > that is what holds in the general case. > > > > Avanti, > > BobN > > > > *From:* dg-idpro-bounces(a)kantarainitiative.org [mailto:dg-idpro-bounces@ > kantarainitiative.org] *On Behalf Of *Jim Willeke > *Sent:* Tuesday, March 07, 2017 6:26 AM > > *To:* dg-idpro(a)kantarainitiative.org > *Subject:* Re: [DG-IDPro] IdM Poster. (thats wrong) > > > > As always, statements without context are philosophical discussions. > > > > Identity is NOT Authentication. > > Authentication is "things that RPs need to know about Subjects in order > to [help] decide whether or not to accept a message, document etc." > > > > Authentication is the process of establishing confidence in the > Identification of an Entity. That is confidence that the Identification is > authentic. > > > > Levels of Assurance or Vectors of Assurance address the degree of > confidence in an assertion of Authentication. > > > > > -- > > -jim > Jim Willeke > > > > On Tue, Mar 7, 2017 at 5:02 AM, <swilson(a)lockstep.com.au> wrote: > > > > In essence, I think most IDAM professionals would agree that attributes > are things that RPs need to know about Subjects in order to [help] decide > whether or not to accept a message, document etc. Some of the nice > questions we're all dealing with currently are: > > > > - are attributes (ie what someone is) more important than "identity" (ie > who someone is)? > > - how do you know that a given attribute about a Subject is true of the > Subject? > > - that is, what authority vouches for the attribute? > > - and how do you know that a presented attribute is bound to the Subject > and isn't being replayed? > > > > If an attribute is something that we need to know about someone, then > clearly passwords are something else. Likewise for PINs (the cool thing > about PINs when at matched on-card is that nobody other the Subject ever > knows the PIN). And CVVs. > > > > And then there is biometrics. There are broadly two modes of biometric > presentation: One-to-One, where it is generally preferred that the > biometric is matched locally in order to unlock a device (ala FIDO, or > Apple iTouch), and One-to-Many (often tellingly called "identification") > where I suppose the attribute could be regarded as an attribute. But the > general aversion to One-to-Many matching of biometrics points to an ideal > where biometrics are NOT identity attributes! > > > > Cheers, > > > > Steve. > > > > Stephen Wilson > > *Lockstep Group * > > W: http://lockstep.com.au > > T: @steve_lockstep > > > > *Lockstep Consulting provides independent specialist advice and analysis * > > *on digital identity and privacy. Lockstep Technologies develops unique * > > *new smart ID solutions that enhance privacy and prevent identity theft. * > > > > -----Original Message----- > From: "David Chadwick" <D.W.Chadwick(a)kent.ac.uk> > Sent: Tuesday, 7 March, 2017 6:07pm > To: dg-idpro(a)kantarainitiative.org > Subject: Re: [DG-IDPro] IdM Poster. (thats wrong) > > Hi Kaliya > > Glad you are not in my class! > > Seriously though, passwords are identity attributes if one regards every > piece of information that is associated with a user as an identity > attribute. But they are clearly not identifiers in the general case, as > they do not uniquely identify anyone, given that 'password' and > '123456789' are two of the most common passwords on the Internet. > However, if you have a very strong password then it is possible that it > could be an identifier, if you are the only person in the world using > that password. > > regards > > David > > On 07/03/2017 04:24, Kaliya Identity Woman wrote: > > HI ID Pro's > > > > As those of you know who attended the ID-Pro breakfast at RSA.. I'm in > > the new Masters of Science in Identity Management and Security at UT > > Austin. > > > > There have been some challenges in what has been taught... including > > that the factors of authentication are not that...but "identifying > > Information" or as in the poster below says "Identity Attributes" > > > > They also have taught that password are identifiers (yes this was > > actually taught)... in this poster on the other side they are identity > > attributes..yes identity attributes. Sigh. I have raised issues about > > these two things that have been taught...and well not gotten very far. > > (besides being told i'm a "bad student" and "unwilling to learn". > > > > But now they have this fabulous poster. I'm hoping some of you with > > blogs or twitter handles can point at the poster - references it and > > explain why both things are wrong. (cause they, specifically Dr. Barber > > and Dr. Doty don't believe me. > > > > Or maybe this group could write a joint letter explaining its > > 'wrongness" it snot great that this center is putting out this > > information...it doesn't help us in the long run get explaining this > > stuff right. > > > > Here is the post on their site with the poster. > > https://identity.utexas.edu/infographics/identity- > attributes-and-the-identity-ecosystem > > > > > > Here is Dr Barbers faculty page > > - http://www.ece.utexas.edu//people/faculty/suzanne-barber > <http://www.ece.utexas.edu/people/faculty/suzanne-barber> > > > > > > Dr. Doty's > > > > https://www.ischool.utexas.edu/people/person_details?PersonID=22 > > > > > > > > _______________________________________________ > > DG-IDPro mailing list > > DG-IDPro(a)kantarainitiative.org > > http://kantarainitiative.org/mailman/listinfo/dg-idpro > > > _______________________________________________ > DG-IDPro mailing list > DG-IDPro(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/dg-idpro > > > _______________________________________________ > DG-IDPro mailing list > DG-IDPro(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/dg-idpro > > > > _______________________________________________ > DG-IDPro mailing list > DG-IDPro(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/dg-idpro > >

1 0

Re: [DG-IDPro] IdM Poster. (thats wrong)
by swilson＠lockstep.com.au 07 Mar '17

07 Mar '17

Wow, that poster is indeed very problematic. It's not just wrong with respect to IDAM common practice, but from first principles. It says "attributes" include 'what you are' and 'what you have' but then fails to list any biometrics or physical factors. A driver license number is not something you "have"; a date of birth is not something you "are". And what confusion leads to the "physics of the identity ecosystem" notion? It's a useless metaphor (check out the shudder quotes around "physics" in the poster). If there is any real science in identity ecosystems, then it has to be ecology! Cheers, Steve. Stephen Wilson Managing Director Lockstep Group E: swilson(a)lockstep.com.au M: +61 (0)414 488 851 W: http://lockstep.com.au T: @steve_lockstep Lockstep Consulting provides independent specialist advice and analysis on digital identity and privacy. Lockstep Technologies develops unique new smart ID solutions that enhance privacy and prevent identity theft. -----Original Message----- From: "Kaliya Identity Woman" <kaliya(a)identitywoman.net> Sent: Tuesday, 7 March, 2017 3:24pm To: "dg-idpro(a)kantarainitiative.org" <dg-idpro(a)kantarainitiative.org> Subject: [DG-IDPro] IdM Poster. (thats wrong) HI ID Pro's As those of you know who attended the ID-Pro breakfast at RSA.. I'm in the new Masters of Science in Identity Management and Security at UT Austin. There have been some challenges in what has been taught... including that the factors of authentication are not that...but "identifying Information" or as in the poster below says "Identity Attributes" They also have taught that password are identifiers (yes this was actually taught)... in this poster on the other side they are identity attributes..yes identity attributes. Sigh. I have raised issues about these two things that have been taught...and well not gotten very far. (besides being told i'm a "bad student" and "unwilling to learn". But now they have this fabulous poster. I'm hoping some of you with blogs or twitter handles can point at the poster - references it and explain why both things are wrong. (cause they, specifically Dr. Barber and Dr. Doty don't believe me. Or maybe this group could write a joint letter explaining its 'wrongness" it snot great that this center is putting out this information...it doesn't help us in the long run get explaining this stuff right. Here is the post on their site with the poster. [ https://identity.utexas.edu/infographics/identity-attributes-and-the-identi… ]( https://identity.utexas.edu/infographics/identity-attributes-and-the-identi… ) Here is Dr Barbers faculty page - [ http://www.ece.utexas.edu//people/faculty/suzanne-barber ]( http://www.ece.utexas.edu//people/faculty/suzanne-barber ) Dr. Doty's [ https://www.ischool.utexas.edu/people/person_details?PersonID=22 ]( https://www.ischool.utexas.edu/people/person_details?PersonID=22 )

1 0

ID Pro Book of Knowledge/ Taxonomy meeting today at 11am ET
by Megan Cannon 06 Mar '17

06 Mar '17

Greetings, Please be reminded of the weekly BoK/Taxonomy meeting today at 11am ET. Dial-in below for your convenience. All the best, Megan https://panel.turbobridge.com/webcall/ (use your computer to connect directly to the call) North America Toll: +1 (805) 309-2350 Alternate Toll: +1 (714) 551-9842 International Toll: http://www.turbobridge.com/international.html Conference ID: 402-2737

1 0

FW: Re: FW: Re: EDIT MODE link to ID Pro Taxonomy/BoK Doc
by Dobbs, George 06 Mar '17

06 Mar '17

All, Made some comments and edits to the document – of course for further review etc. …. George Dobbs, George<mailto:gdobbs@massmutual.com> February 22, 2017 at 12:18 PM From: Dobbs, George Sent: Wednesday, February 22, 2017 12:17 PM To: Dobbs, George <gdobbs(a)massmutual.com><mailto:gdobbs@massmutual.com> Subject: FW: [EXTERNAL]Re: EDIT MODE link to ID Pro Taxonomy/BoK Doc From: Andrew Hughes [mailto:andrewhughes3000@gmail.com] Sent: Sunday, February 12, 2017 11:58 AM To: Stu Lincoln <stu(a)stulincoln.com<mailto:stu@stulincoln.com>> Cc: Thorsten H. Niebuhr [WedaCon GmbH] <tniebuhr(a)wedacon.net<mailto:tniebuhr@wedacon.net>>; catherine.schulten(a)lifemedid.com<mailto:catherine.schulten@lifemedid.com>; Dobbs, George <gdobbs(a)massmutual.com<mailto:gdobbs@massmutual.com>>; Janelle Allen <janelle(a)sharpshootn.com<mailto:janelle@sharpshootn.com>>; Megan Cannon <mcannon(a)virtualmgmt.com<mailto:mcannon@virtualmgmt.com>>; Colin Wallis <colin(a)kantarainitiative.org<mailto:colin@kantarainitiative.org>>; IDProSC(a)kantarainitiative.org<mailto:IDProSC@kantarainitiative.org> Subject: [EXTERNAL]Re: EDIT MODE link to ID Pro Taxonomy/BoK Doc OK - I have commented back on the comments and additions to date. Looking good so far andrew. Andrew Hughes CISM CISSP Independent Consultant In Turn Information Management Consulting o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com<mailto:AndrewHughes3000@gmail.com> ca.linkedin.com/pub/andrew-hughes/a/58/682/<http://ca.linkedin.com/pub/andrew-hughes/a/58/682/> Identity Management | IT Governance | Information Security On Sat, Feb 11, 2017 at 4:33 PM, Stu Lincoln <stu(a)stulincoln.com<mailto:stu@stulincoln.com>> wrote: **** This message was sent securely via TLS encryption. **** This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies. Sent from Postbox<https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campai…> This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 1