Chapter 9. Getting Credentials

I l @ ve RuBoard

Identity information is the piece of information which is used to uniquely identify an entity anywhere within the enterprise. An identifier is what a user, which wants to utilize resources, uses to differentiate itself from all other entities. Without identification, there is no basis for granting authorizations or maintaining accountability. An identifier must uniquely represent only a single individual, so that any of the activities performed by the identity are the responsibility of the individual. In most computer systems, this is the user 's login name .

Most organizations are primarily concerned with the identification of individuals. However, people are only one type of user. In today's networked client/server environment systems, software, hardware, and networks also need positive identification to assure information security.

• Unique ” Identifiers must be unique so that the user can be positively identified. Identifiers should be global, that is, an identifier should belong to one user throughout the enterprise. Any specific user should have only one identifier, even if the user performs multiple roles in the organization. This simplifies the association of individual identity for both the user and for the information system. It simplifies management and issuance of identifiers and reduces confusion in tracking the user and controlling which resources he or she uses. This allows for individual accountability and ensures that the individual is the person represented by the identifier. Identifiers must not be shared; otherwise it is not possible to promote personal accountability. This is especially important for effectively controlling access to information with high integrity or confidentiality requirements.

• Universal ” The same type of identifier should be available from all users ” individuals, systems, or programs ” anything that requires access to the information. One identifier should be ample to identify one user anywhere for any reason. Identifiers must not be context-dependent, meaning the use of one identifier in one circumstance and another identifier in a different circumstance. (This does not mean that there will not be different methods to verify the identifier based on the specific situation.) This simplifies the process of validating the identifier. It also simplifies electronic storage and allows all users to be controlled in the same manner by having identifiers that are all of the same type and format.

• Verifiable ” There should be an easy and standardized process to validate the identifier so that simple standard interfaces can be constructed . The verification process should be highly available, since without verification no privileges can be granted. There should be multiple verification methods that can be used at different times to give different levels of identity assurance or in case a specific method of verification is suspected of being compromised.

Stealing a user's identity requires acquiring both the identifier and the authenticator. The protection of this information is critical. In most cases, a hacker's first access to a system will be through a user account with limited privileges. Generally he will gain the identity of another account by getting the login name and password for that account by coercing the trusted computer system to gain access to the account or by taking advantage of a vulnerability in the software or hardware.

I l @ ve RuBoard