- DG-IDPro - mailman.kantarainitiative.org

ID Pro Body of Knowledge - please contribute
by Andrew Hughes 08 Mar '17

08 Mar '17

Hi everyone - the people attending BoK calls have drafted the linked document. It's the highest-levels of a taxonomy and starting items for the body of knowledge. This link gives you 'Comment' permissions on the google document. Please add suggestions add comments to help us make progress. https://docs.google.com/document/d/1HNLZginMaRtFdraQTpVkdJ6z8Aj86cM_87TE6T5… This is one of the essential artifacts of the ID Pro organization - it defines the scope of the endeavor and anchors all the other activities. Please help by contributing to define what it means to be an ID Pro - or someone else will do it for you :) andrew. *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

3 4

Attributes and Context [WAS: IdM Poster.]
by Andrew Hughes 07 Mar '17

07 Mar '17

Disclaimer to start: my contribution to this thread is intended to not judge correctness or incorrectness of anyone's views. The poster and dialogue sparked an interesting line of thinking. "Under what circumstances would identity data and authentication factor data be considered to be identity attributes" An answer took a while because I deal with IDP, CSP, AA, RP terms all day. I think one answer is: when you are an external observer or data analyst looking at a data stream and have no direct knowledge of any attribute databases or individual entities. or: Data analytics on data streams where the observer is not one of IDP, CSP, AA or RP. The mode that I typically work in is where the individual entity is asserting some claim. Or as a Verifier evaluating an authentication assertion. Or as an attribute authority with a database of well-organized data. When you take those parties out of the observation, then everything on the wire could be: infrastructure management data, transactional data, other metadata, and possibly attributes that could be ascribed to an individual entity. I also see that Nat's observation of the ISO definitions is compatible with my musings. andrew. *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security * On Tue, Mar 7, 2017 at 6:15 AM, Natale, Bob <RNATALE(a)mitre.org> wrote: > That’s true … but not necessarily the total dichotomy implied by the > assertion that “Identity is NOT Authentication” … authenticator attributes > can also be identifier attributes and vice versa … the closer an > authenticator attribute (like a human fingerprint) is to a unique > identifier (like a human fingerprint paired with some threshold set of > appropriate biographic, biometric, behavioral, and social attributes), the > murkier the line between identity and authentication might become. > > > > Or so it seems to me…. Things might vary a bit, with respect to what is a > valid identity attribute, between human person identities and virtual > entity identifiers as well … but that’s probably a topic for a different > thread! > > > > Ultimately, however, I strongly favor keeping the concepts of identity, > authentication, authorization, and access control distinctly defined, as > that is what holds in the general case. > > > > Avanti, > > BobN > > > > *From:* dg-idpro-bounces(a)kantarainitiative.org [mailto:dg-idpro-bounces@ > kantarainitiative.org] *On Behalf Of *Jim Willeke > *Sent:* Tuesday, March 07, 2017 6:26 AM > > *To:* dg-idpro(a)kantarainitiative.org > *Subject:* Re: [DG-IDPro] IdM Poster. (thats wrong) > > > > As always, statements without context are philosophical discussions. > > > > Identity is NOT Authentication. > > Authentication is "things that RPs need to know about Subjects in order > to [help] decide whether or not to accept a message, document etc." > > > > Authentication is the process of establishing confidence in the > Identification of an Entity. That is confidence that the Identification is > authentic. > > > > Levels of Assurance or Vectors of Assurance address the degree of > confidence in an assertion of Authentication. > > > > > -- > > -jim > Jim Willeke > > > > On Tue, Mar 7, 2017 at 5:02 AM, <swilson(a)lockstep.com.au> wrote: > > > > In essence, I think most IDAM professionals would agree that attributes > are things that RPs need to know about Subjects in order to [help] decide > whether or not to accept a message, document etc. Some of the nice > questions we're all dealing with currently are: > > > > - are attributes (ie what someone is) more important than "identity" (ie > who someone is)? > > - how do you know that a given attribute about a Subject is true of the > Subject? > > - that is, what authority vouches for the attribute? > > - and how do you know that a presented attribute is bound to the Subject > and isn't being replayed? > > > > If an attribute is something that we need to know about someone, then > clearly passwords are something else. Likewise for PINs (the cool thing > about PINs when at matched on-card is that nobody other the Subject ever > knows the PIN). And CVVs. > > > > And then there is biometrics. There are broadly two modes of biometric > presentation: One-to-One, where it is generally preferred that the > biometric is matched locally in order to unlock a device (ala FIDO, or > Apple iTouch), and One-to-Many (often tellingly called "identification") > where I suppose the attribute could be regarded as an attribute. But the > general aversion to One-to-Many matching of biometrics points to an ideal > where biometrics are NOT identity attributes! > > > > Cheers, > > > > Steve. > > > > Stephen Wilson > > *Lockstep Group * > > W: http://lockstep.com.au > > T: @steve_lockstep > > > > *Lockstep Consulting provides independent specialist advice and analysis * > > *on digital identity and privacy. Lockstep Technologies develops unique * > > *new smart ID solutions that enhance privacy and prevent identity theft. * > > > > -----Original Message----- > From: "David Chadwick" <D.W.Chadwick(a)kent.ac.uk> > Sent: Tuesday, 7 March, 2017 6:07pm > To: dg-idpro(a)kantarainitiative.org > Subject: Re: [DG-IDPro] IdM Poster. (thats wrong) > > Hi Kaliya > > Glad you are not in my class! > > Seriously though, passwords are identity attributes if one regards every > piece of information that is associated with a user as an identity > attribute. But they are clearly not identifiers in the general case, as > they do not uniquely identify anyone, given that 'password' and > '123456789' are two of the most common passwords on the Internet. > However, if you have a very strong password then it is possible that it > could be an identifier, if you are the only person in the world using > that password. > > regards > > David > > On 07/03/2017 04:24, Kaliya Identity Woman wrote: > > HI ID Pro's > > > > As those of you know who attended the ID-Pro breakfast at RSA.. I'm in > > the new Masters of Science in Identity Management and Security at UT > > Austin. > > > > There have been some challenges in what has been taught... including > > that the factors of authentication are not that...but "identifying > > Information" or as in the poster below says "Identity Attributes" > > > > They also have taught that password are identifiers (yes this was > > actually taught)... in this poster on the other side they are identity > > attributes..yes identity attributes. Sigh. I have raised issues about > > these two things that have been taught...and well not gotten very far. > > (besides being told i'm a "bad student" and "unwilling to learn". > > > > But now they have this fabulous poster. I'm hoping some of you with > > blogs or twitter handles can point at the poster - references it and > > explain why both things are wrong. (cause they, specifically Dr. Barber > > and Dr. Doty don't believe me. > > > > Or maybe this group could write a joint letter explaining its > > 'wrongness" it snot great that this center is putting out this > > information...it doesn't help us in the long run get explaining this > > stuff right. > > > > Here is the post on their site with the poster. > > https://identity.utexas.edu/infographics/identity- > attributes-and-the-identity-ecosystem > > > > > > Here is Dr Barbers faculty page > > - http://www.ece.utexas.edu//people/faculty/suzanne-barber > <http://www.ece.utexas.edu/people/faculty/suzanne-barber> > > > > > > Dr. Doty's > > > > https://www.ischool.utexas.edu/people/person_details?PersonID=22 > > > > > > > > _______________________________________________ > > DG-IDPro mailing list > > DG-IDPro(a)kantarainitiative.org > > http://kantarainitiative.org/mailman/listinfo/dg-idpro > > > _______________________________________________ > DG-IDPro mailing list > DG-IDPro(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/dg-idpro > > > _______________________________________________ > DG-IDPro mailing list > DG-IDPro(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/dg-idpro > > > > _______________________________________________ > DG-IDPro mailing list > DG-IDPro(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/dg-idpro > >

1 0

Re: [DG-IDPro] IdM Poster. (thats wrong)
by swilson＠lockstep.com.au 07 Mar '17

07 Mar '17

Wow, that poster is indeed very problematic. It's not just wrong with respect to IDAM common practice, but from first principles. It says "attributes" include 'what you are' and 'what you have' but then fails to list any biometrics or physical factors. A driver license number is not something you "have"; a date of birth is not something you "are". And what confusion leads to the "physics of the identity ecosystem" notion? It's a useless metaphor (check out the shudder quotes around "physics" in the poster). If there is any real science in identity ecosystems, then it has to be ecology! Cheers, Steve. Stephen Wilson Managing Director Lockstep Group E: swilson(a)lockstep.com.au M: +61 (0)414 488 851 W: http://lockstep.com.au T: @steve_lockstep Lockstep Consulting provides independent specialist advice and analysis on digital identity and privacy. Lockstep Technologies develops unique new smart ID solutions that enhance privacy and prevent identity theft. -----Original Message----- From: "Kaliya Identity Woman" <kaliya(a)identitywoman.net> Sent: Tuesday, 7 March, 2017 3:24pm To: "dg-idpro(a)kantarainitiative.org" <dg-idpro(a)kantarainitiative.org> Subject: [DG-IDPro] IdM Poster. (thats wrong) HI ID Pro's As those of you know who attended the ID-Pro breakfast at RSA.. I'm in the new Masters of Science in Identity Management and Security at UT Austin. There have been some challenges in what has been taught... including that the factors of authentication are not that...but "identifying Information" or as in the poster below says "Identity Attributes" They also have taught that password are identifiers (yes this was actually taught)... in this poster on the other side they are identity attributes..yes identity attributes. Sigh. I have raised issues about these two things that have been taught...and well not gotten very far. (besides being told i'm a "bad student" and "unwilling to learn". But now they have this fabulous poster. I'm hoping some of you with blogs or twitter handles can point at the poster - references it and explain why both things are wrong. (cause they, specifically Dr. Barber and Dr. Doty don't believe me. Or maybe this group could write a joint letter explaining its 'wrongness" it snot great that this center is putting out this information...it doesn't help us in the long run get explaining this stuff right. Here is the post on their site with the poster. [ https://identity.utexas.edu/infographics/identity-attributes-and-the-identi… ]( https://identity.utexas.edu/infographics/identity-attributes-and-the-identi… ) Here is Dr Barbers faculty page - [ http://www.ece.utexas.edu//people/faculty/suzanne-barber ]( http://www.ece.utexas.edu//people/faculty/suzanne-barber ) Dr. Doty's [ https://www.ischool.utexas.edu/people/person_details?PersonID=22 ]( https://www.ischool.utexas.edu/people/person_details?PersonID=22 )

1 0

ID Pro Book of Knowledge/ Taxonomy meeting today at 11am ET
by Megan Cannon 06 Mar '17

06 Mar '17

Greetings, Please be reminded of the weekly BoK/Taxonomy meeting today at 11am ET. Dial-in below for your convenience. All the best, Megan https://panel.turbobridge.com/webcall/ (use your computer to connect directly to the call) North America Toll: +1 (805) 309-2350 Alternate Toll: +1 (714) 551-9842 International Toll: http://www.turbobridge.com/international.html Conference ID: 402-2737

1 0

FW: Re: FW: Re: EDIT MODE link to ID Pro Taxonomy/BoK Doc
by Dobbs, George 06 Mar '17

06 Mar '17

All, Made some comments and edits to the document – of course for further review etc. …. George Dobbs, George<mailto:gdobbs@massmutual.com> February 22, 2017 at 12:18 PM From: Dobbs, George Sent: Wednesday, February 22, 2017 12:17 PM To: Dobbs, George <gdobbs(a)massmutual.com><mailto:gdobbs@massmutual.com> Subject: FW: [EXTERNAL]Re: EDIT MODE link to ID Pro Taxonomy/BoK Doc From: Andrew Hughes [mailto:andrewhughes3000@gmail.com] Sent: Sunday, February 12, 2017 11:58 AM To: Stu Lincoln <stu(a)stulincoln.com<mailto:stu@stulincoln.com>> Cc: Thorsten H. Niebuhr [WedaCon GmbH] <tniebuhr(a)wedacon.net<mailto:tniebuhr@wedacon.net>>; catherine.schulten(a)lifemedid.com<mailto:catherine.schulten@lifemedid.com>; Dobbs, George <gdobbs(a)massmutual.com<mailto:gdobbs@massmutual.com>>; Janelle Allen <janelle(a)sharpshootn.com<mailto:janelle@sharpshootn.com>>; Megan Cannon <mcannon(a)virtualmgmt.com<mailto:mcannon@virtualmgmt.com>>; Colin Wallis <colin(a)kantarainitiative.org<mailto:colin@kantarainitiative.org>>; IDProSC(a)kantarainitiative.org<mailto:IDProSC@kantarainitiative.org> Subject: [EXTERNAL]Re: EDIT MODE link to ID Pro Taxonomy/BoK Doc OK - I have commented back on the comments and additions to date. Looking good so far andrew. Andrew Hughes CISM CISSP Independent Consultant In Turn Information Management Consulting o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com<mailto:AndrewHughes3000@gmail.com> ca.linkedin.com/pub/andrew-hughes/a/58/682/<http://ca.linkedin.com/pub/andrew-hughes/a/58/682/> Identity Management | IT Governance | Information Security On Sat, Feb 11, 2017 at 4:33 PM, Stu Lincoln <stu(a)stulincoln.com<mailto:stu@stulincoln.com>> wrote: **** This message was sent securely via TLS encryption. **** This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies. Sent from Postbox<https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campai…> This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 1

Detroit IAM User Group Meeting
by Steve Giovannetti 28 Feb '17

28 Feb '17

Hello Everyone, I'm going to be speaking at the Detroit IAM User Group Meeting this Thursday. I may have some time to give an "elevator pitch" for IDPro. I'm new to this effort so I was wondering if there were some materials or information I could impart to help spread the word. My initial plan was to send everyone to https://kantarainitiative.org/digital_identity_professional/. Is that sufficient? Is there a better shortened URL? Regards, Steve Giovannetti CTO & Founder Hub City Media, Inc.

1 0

ID Pro BoK / Taxonomy meeting cancelled
by Megan Cannon 27 Feb '17

27 Feb '17

Hello all, Today's BoK/Taxonomy meeting is cancelled. Have a great week! Best, Megan

1 0

Fwd: Reminder: IDPro DG meeting, TODAY: Wednesday, Feb 22 12pm ET
by Megan Cannon 22 Feb '17

22 Feb '17

Reminder - please join us today! Hello all, Please join us for the ID Pro Discussion Group meeting on Wednesday, February 22 at 12pm ET. The dial in details are below for you convenience. I look forward to speaking with you then! All the best, Megan ___________________________________________________________ Please join my meeting from your computer, tablet or smartphone. https://global.gotomeeting.com/join/747903453 You can also dial in using your phone. United States +1 (646) 749-3117 <(646)%20749-3117> Access Code: 747-903-453 More phone numbers Australia +61 2 8355 1039 <+61%202%208355%201039> Austria +43 7 2088 1033 Belgium +32 (0) 28 93 7001 Canada +1 (647) 497-9379 <(647)%20497-9379> Denmark +45 69 91 89 33 <+45%2069%2091%2089%2033> Finland +358 (0) 923 17 0555 France +33 (0) 170 950 585 Germany +49 (0) 692 5736 7301 <+49%2069%20257367301> Ireland +353 (0) 19 030 050 Italy +39 0 693 38 75 50 Netherlands +31 (0) 208 080 208 New Zealand +64 9 925 0481 <+64%209-925%200481> Norway +47 21 54 82 21 <+47%2021%2054%2082%2021> Spain +34 911 82 9890 <+34%20911%2082%2098%2090> Sweden +46 (0) 853 527 817 Switzerland +41 (0) 435 0167 65 United Kingdom +44 (0) 330 221 0099 <+44%20330%20221%200099>

1 0

Reminder: IDPro DG meeting, Wednesday, Feb 22 12pm ET
by Megan Cannon 20 Feb '17

20 Feb '17

Hello all, Please join us for the ID Pro Discussion Group meeting on Wednesday, February 22 at 12pm ET. The dial in details are below for you convenience. I look forward to speaking with you then! All the best, Megan ___________________________________________________________ Please join my meeting from your computer, tablet or smartphone. https://global.gotomeeting.com/join/747903453 You can also dial in using your phone. United States +1 (646) 749-3117 Access Code: 747-903-453 More phone numbers Australia +61 2 8355 1039 Austria +43 7 2088 1033 Belgium +32 (0) 28 93 7001 Canada +1 (647) 497-9379 Denmark +45 69 91 89 33 Finland +358 (0) 923 17 0555 France +33 (0) 170 950 585 Germany +49 (0) 692 5736 7301 Ireland +353 (0) 19 030 050 Italy +39 0 693 38 75 50 Netherlands +31 (0) 208 080 208 New Zealand +64 9 925 0481 Norway +47 21 54 82 21 Spain +34 911 82 9890 Sweden +46 (0) 853 527 817 Switzerland +41 (0) 435 0167 65 United Kingdom +44 (0) 330 221 0099

1 0

BoK: Authorization taxonomy
by Andrew Hughes 09 Feb '17

09 Feb '17

Hi folks, here's my imperfect taxonomy for 'areas related to authorization and access control that an ID Pro should know about'. Please help to put the items in the right spots and correct errors! - Authorization - - Authorization policy evaluation - - Proofs of assertion (tokens, tickets, cookies, cryptographic methods) - - Bearer methods v proof of possession methods - Access control policy, authorization policy, - Static evaluation, dynamic evaluation - Is there an ‘authorization equation’ for policy evaluation? - - e.g. Given an identified entity and a requested resource, select the correctly-scoped authorization policy, evaluate the policy, grant || deny || require trust elevation for the resource access, log the events - Relationship to Identification, Authentication, Access Control - - The characteristics of each - The 'cross-over' aspects of each (e.g. OAuth-style authentication via proof of resource access - is this related to an ‘authorization equation’ approach?) - Authorization models, processes, protocols - - SAML, OAuth, UMA - Directories, decentralized models - Access control models - - RBAC - ABAC - Trust Elevation (e.g. re-authentication, step-up authentication, claims gathering) - Considerations for choosing specific models, protocols - - Risk - Authorization model matching to credential characteristics, identification method, available authenticators - Centralized v decentralized - Degree of independence of authorization policy decision v access control decision *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

9 15