On average, every person has 7.6 accounts – that’s a lot of user IDs and passwords for an individual! Remembering the user ID and password for all these accounts is obviously very cumbersome, and third party service providers have capitalized on this to provide password management services. A password manager is essentially a single repository for all your credentials. Two very popular password managers are LastPass and Dashlane. These are applications which will store your credentials in a “secure” database. However, they haven’t been spared by hackers, who breached their security to get access to thousands of user credentials.
Category: Identity and Access Management
Can you Trust the Agent on your Active Directory?
If a company works with very few applications, user repositories would have to be mapped individually for each application. Every new user needs to be validated with each individual user directories to be able to access the respective protected application. This means that the same user has to log in separately every time he/she wants to use each application on the network. The inefficiency of this model was reduced greatly with the advent of Active Directory and LDAP.
A significant number of identity and access management solutions have the need to work with Active Directory as the repository of user information against which access is verified. Active Directory generally controls user identity and access permissions to everything from files, networks, and servers, to on-premise and cloud applications. However, integrating an Active Directory or LDAP with on-premise and cloud applications require third-party agents to be installed on your network.
Continue reading Can you Trust the Agent on your Active Directory?
IAM using SSO and Federated Identity Management
Identity management encompasses several operational mechanisms for managing users across a large system or network of applications. Two of the most prominent of those are Single Sign-on (SSO) and Federated Identity Management. Due to its evolving nature, identity and access management has several terms thrown around ambiguously. Even among developers, major differences are often missed while talking about federated identity and SSO. In this article, we aim to break down the difference between the two.
Continue reading IAM using SSO and Federated Identity Management
Cloud Security 101: Identity and Access Management
An Identity and Access Management (IAM) solution allows organizations to manage user access to critical data. It is an intermediate layer between your users and your applications/data.
Deploying an IAM solution a proven way to improve network security in an organization. A good IAM solution should also reduce the time spent by your IT team to grant access for individual applications, thereby improving architectural simplicity and reducing the load on your servers. This also means that your users have to remember only one set of credentials to access several applications in your on-premise or cloud network.
What should you expect from a good IAM solution?
Streamlined User Access
An effective IAM solution should greatly reduce hassle by providing a slick and time efficient method to validate users. It should be able to do this without compromising on security, allowing only legitimate users to access your network from on-premise or remote systems.
Conventionally, at organizations that have numerous applications on their network, users need to remember multiple sets of credentials, which is inconvenient, but more secure. An effective IAM solution should be able to strike the right balance between the two extremes of convenience and security.
With a single set of user credentials to access all permitted applications and data, memorizing multiple credentials is avoided, improving productivity and ease of use.
Improved Security
Another important feature you should look out for is the ability to control user access to your network. This is typically delivered through device- and IP-based restrictions, which give you the ability to provide access only from specific devices or IP addresses to your network. In addition to simply whitelisting specific requests, an IAM solution should also be able to permanently block illegal access from blacklisted devices and IPs.
Seamless Admin Control
An identity and access management solution should give the administrators of your network a simple and intuitive dashboard with all the controls needed to secure your network and manage access across it. This can go a long way in reducing the cost and time for your IT team.
This includes managing creating and removing user accounts, as well as controlling the level of access provided to each individual user.
Identity and Access Management by Akku
Akku by CloudNow is a state-of-the-art Identity and Access Management solution for all your user management needs. Its powerful SSO function simplifies user identity and access management, IP- and device-based restrictions prevent unwarranted access, multi-factor authentication reinforces security, and a range of other versatile features put you in complete control of your network. Get in touch with us now to know more!
Meet GCP IAM: The Identity and Access Management Solution from Google
Google Cloud Platform (GCP) IAM comes as a free service that is available by default to all users of the Google Cloud Platform. GCP IAM is Google’s identity management console, enabling administrators of organizations to manage access and permissions provided to employees across the range of applications and resources that come as part of the Google Cloud Platform. The main function of the IAM is to grant specific users/roles with access to specific GCP resources and prevent unwanted access to other resources.
The fundamental building block of GCP IAM is an IAM Policy which answers the question of who (identity) has what access (role) to which data or applications (resource). This IAM Policy is made up of permissions, bundled into roles and matched by identities.
Let’s take a closer look at the concepts of identity, role, and resource as defined by GCP IAM, which make it a useful IAM solution.
Identity
A user’s identity can be accounted for through their Google account (assigned to an individual), Service account (assigned to a service related to the user’s role), a Google group (which can contain more than one Google/Service account), or a G Suite domain name (consisting of all G Suite accounts under a particular domain) or Cloud Identity domain (consisting of all G suite accounts under a particular organization) name.
Role
A role is a combination of permissions assigned to an identity. Traditionally, Google had what are now known as Primitive Roles – which were a standard set of 3 – namely, ‘Owner’, ‘Editor’ and or ‘Viewer’.
However, in GCP IAM, Google has gone not one but two steps further – with Predefined Roles and Custom Roles – in allowing administrators a wider range of options when it comes to assigning roles (and therefore, access to do less or more) to the organization’s resources.
With what are known as Predefined Roles, granular separation of duties, such as Instance Admin and Network Admin to name a few, is made possible. Custom Roles, as the name suggests, are roles which administrators can customize based on the organization’s needs.
Resource
As defined by Google, “resources are the fundamental components that make up all GCP services”, and include Cloud Pub/Sub topics, Compute Engine Virtual Machines, Cloud Storage Buckets, and App Engine Instances.
These resources can then be grouped into projects. Administrators can assign permissions based on different roles to identities in their organization in order to provide them with access to specific resources. On the other hand, they can also provide access to projects, which will then provide users with access to all resources under the project.
In the GCP hierarchy, a group of projects can also be placed under a team, teams can be placed under a department and departments can be placed under the organization. Administrators can decide the level of access they wish to give each user based on this hierarchy.
GCP IAM is great, but….
Despite the extensive control it provides to administrators, and the numerous possibilities in authorizing user access, GCP IAM has one downside.
Organizations today utilize a wide range of applications, not all of them being GCP resources. They may use a combination of resources from Amazon Web Services, IBM or Azure, to name a few, and GCP IAM does not support identity and access management on these resources. Its lack of capability to connect with on-prem identity providers such as Microsoft Active Directory and OpenLDAP is another major roadblock.
Looking for one IAM to manage them all? Try Akku, one of the best identity and access management solutions from CloudNow, that can help you manage identities across your on-premise and cloud-based applications seamlessly!
Secure and Efficient Certificate-Based Authentication
Security and privacy of user data are crucial for any organization and is also a major area of risk. So a Secure and Efficient Authentication (SEA) is very important.
How do you make authentication secure and efficient? Let me share some insights on how this can be achieved through certificate-based authentication…
In general, a certificate is a means of creating evidence. In the domain of identity and access management, a certificate creates evidence in the form of a digital signature to verify the identity of an individual, a company, or other entity, and associates that identity with a public key.
Like a driver’s license or passport, a certificate provides a generally recognized proof of a person’s identity. Certificates have one main purpose: to establish trust.
Authentication is the process that verifies that a user is who they say they are. So a certificate makes authentication more efficient because the identity cannot be changed.
By enabling the certificate-based authentication, it is possible to reliably evaluate the user’s right to access the requested resource.
How does it work?
- First, the user enters their private password.
- The client receives the private key, and creates an evidence – in this case, in the form of a certificate or digital signature.
- Now, the client sends the evidence through a secured connection across the network.
- The server uses the evidence to authenticate the user identity.
- Finally, the server authorizes the evidence and allows access.
This brings us to the question of how to implement a certificate-based authentication in your organization.
Akku by CloudNow is a powerful and secure identity and access management solution that uses certificate-based authentication to control user identity and secure access to your environment. Learn more at www.akku.work
Does your IAM solution really need an Agent?
Most IAM tools utilize browser extensions or applications installed on the end-user’s machine, or on an Active Directory, for access to identity. But why?! A user can be identified even without an agent – so having an so-called ‘lightweight agent’ sitting in your Active Directory itself is not the most secure way to manage user identity.
Whenever you create a dependency to achieve a particular solution, it is important to ensure the solution is 100% secure and that applies for the dependencies (Agents) too. This could make the architecture slightly complicated, depending on how it works.
Another important factor against the use of an Agent-based architecture is that you have to trust the Agent not to exceed its scope. This is very important because even many of the applications and services that we trust these days are not actually secure, and many act beyond their scope. For example, as per Digital Content Next, even the big boy of the tech industry, Google, still collects user location information even after turning off location settings.
So the big question is, when the things can be done without an agent, then why use an agent at all? People say it is for efficiency, and may be they are right. But is this worth the compromise on transparency and security?
Is Your Data Secure? No…
As per a survey by Forrester Research (Forrester Consulting Thought Leadership Paper, February 2017), in the last 4 years, out of every three organizations, two have had an average of at least 5 breaches. There are nearly 6 billion data records that were stolen and lost in the past 10 years. According to www.breachlevelindex.com, an average of 165,000 records are compromised every hour. According to this article published on www.csoonline.com, global cybercrime related damage is expected to exceed US$ 6 trillion annually by the year 2021.
How can IAM help protect data?
- Identification: Users make their claim on their identity by entering a username and verify through an authentication process
- Authentication: Authentication may be a password or may rely on advanced technologies, such as biometric and token-based authentication
- Authorization: The IAM system must then verify the user’s authorization to perform the requested activity and also ensure that users perform actions only within their scope of authority
Together, these three processes combine to ensure that specified users have the access they need to do their jobs, while unauthorized users are kept away from sensitive resources and information. Effective IAM solutions help enterprises facilitate secure, efficient access to technology resources across these diverse systems.
Identity and Access Management (IAM) is the information security discipline that allows users access to appropriate technology resources, at the right time. It incorporates three major concepts:
According to this article on BizTech magazine, improved data security is one of the three main reasons to deploy an IAM solution.
The article highlights the fact that consolidating authentication and authorization functionality on a single platform provides IT professionals with a consistent method for managing user access. And when a user leaves an organization, IT administrators may revoke their access in the centralized IAM solution with the confidence that this revocation will immediately take effect across all of the technology platforms integrated with that IAM platform.
So implement an identity and access management solution at your organization to take a major step towards improved data security.
Protecting Your Vault: Safeguard your Data Center with an IAM Solution
At most enterprises, data centers are a repository of information contained within a network of servers from where data is transmitted to other touch points for processing. While these data centers could be cloud-based or on-premise, the security of such business-critical data is of paramount importance.
There could be several vulnerabilities in your network in the form of entry points that seem like they can be ignored. While there are several measures you can implement to physically secure your data center, it takes a lot more to secure remote or even on-premise servers from virtual attacks. An effective data center security solution will allow you to intuitively monitor all the entry points for possible attacks and ensure that you are protected against any breach.
One major part of the solution is the implementation of an Identity and Access Management (IAM) solution as part of your security system.
Staying Protected Online using an Identity and Access Management Solution
The two biggest focus areas for any security solution are authentication and authorization. Although there are overlaps in the usage of the two terms, there are distinct in the way they allow access of data.
Authentication determines if the user trying to enter a system is in fact who he/she is claiming to be, while authorization determines whether the user has the permission to access the data or application that he/she is attempting to access.
A comprehensive IAM solution should be able to intelligently allow you to do both by acting as the Identity Provider (IdP) for your cloud, on-premise or hybrid network and interact with the servers in the data centers to check for authentication and authorization using advanced, yet easy to implement, system architectures.
The Akku Solution
CloudNow’s Akku is an enterprise-grade IAM solution that plays this role perfectly using its custom SAML to provide a robust Single Sign-on (SSO) solution, or to integrate with an SSO solution already in place for your other applications. As an IdP, Akku communicates with the server at the time of login to carry out authentication and validate authorization.
By using a high-end security solution, you can effectively control access to your network and data center and reduce the number of resources dedicated to data center security.
Akku also removes any need for any middleware which could otherwise complicate or even corrupt the security system.
The implementation of an efficient and cost-effective security solution like Akku can go a long way in allowing you to focus on improving the operational efficiency of your organization instead of being caught up with the security threats to your data.
Secure and Easy User Management: SCIM through the Fundamentals
What is SCIM?
The System for Cross-domain Identity Management (SCIM) is an open standard specification, designed to make user management easy. It essentially allows admins of cloud and on-premise networks to move users in and out of their systems quickly and easily. The system builds on inputs from existing user management schemas and allows the integration of powerful authentication models. It uses a common user schema in coordination with an extension model which allows for seamless migration of user data between different nodes of the system.
SCIM transmits user data between identity providers (like Akku by CloudNow) and service providers (SaaS applications) using a secure protocol. When this is used in conjunction with a robust authorization system, it gives rise to a powerful identity and access management solution. If not for SCIM, the IT departments of every organization would have to dedicate time and resource to managing access control, instead of simply automating the process.
How does SCIM help in Creating a Powerful Identity and Access Management Solution?
Like we mentioned earlier, SCIM enables the communication between the identity provider and an enterprise SaaS application which needs user information to process, create, modify or remove users from accessing a network. SCIM is built using REST and JSON to define and establish the roles of the client and server – in this case, the identity provider acts as the client and the SaaS application acts as the server.
Identity providers like Akku contain a directory of user identities which is normally extracted by the server. In most cases, the server can extract information from directories other than the identity providers as well. But migrating the data to an identity provider can significantly improve the security of the user management system. When the client or identity provider makes changes to any user information, it immediately reflects in the server or SaaS application by using the SCIM protocol. With SCIM, you can create, replace, delete, search and update user information.
The client or identity provider can also view the data present on the server and record any mismatches. If irregularities between the client and server are not immediately noticed and rectified, it could lead to a potential security breach.
How can Akku help you?
With organizations moving their operations to the cloud at breakneck speeds, the need to streamline and implement a Single Sign-on solution is constantly rising. Akku is one of the best Identity and Access Management Solutions available in the market, allowing you to integrate with third party applications as well as our own suite, to take your identity and user management efforts to the next level. This simplifies the work of your organization’s cloud or on-premise network administrators to grant access to several users and applications. For your users, this means remembering only one set of credentials for several applications.
Speak to us to see how Akku’s Single Sign-on can help you manage your users more efficiently.