Agenda

In many enterprises, modeling the permissions for a new employee on those of a member of staff whose job description involves similar tasks is still the established practice.

Our presentation not only points out the dangers of working in this way, but also describes the procedural method that is to be aimed for, especially with regard to compliance considerations.

This method combines the functions involved in the creation of roles (role mining), the use of roles in provisioning, and the authorization of changes by means of workflow components, thus providing a homogeneous whole that describes the entire life cycles of roles. The presentation demonstrates how this procedural model takes the functional view of an employee's role and translates it into concrete technical permissions that are immediately usable in the day-to-day work environment, and whose logic is clear to all concerned.

Based on our practical experience in role management projects, we will also present solutions for working with dynamic roles and handling the numerous dependencies that exist between roles.

Cloud computing adoption is adversely affected by security and privacy concerns. Enterprises are often perplexed by the many challenges of cloud security and how to maintain compliance and governance in this new IT paradigm. This session will outline how to leverage existing identity and access management infrastructure, and how to extend Service-Oriented Security and standards-based interactions to successfully secure assets in the cloud; and will include customer examples.

Cloud Computing has a variety of terrific characteristics. Some are really new. Some other are well known for years and just come in different form or flavour. Best situation to discover and learn from long-term trends, point at today’s critical issues or smoothly direct the discussion back on track. What processes do user organizations need to manage cloud security risks? Do our experts come across with issues which are considered fundamental five years from now? What impact have all-round cloud self-service for enterprise security management and consistency? The cloud scales. Will security and even identities scale, or do we get stuck in identity silos? Those are the type of questions which guide to new insides, point to discussions in other track sessions and maybe induce others.

Cloud computing has enabled new business models, and these business models, not cloud computing directly, are driving an upheaval in identity and security needs into the enterprise.

A handful of new and old technologies have combined to produce cloud computing, which has enabled a seismic shift in the business models of services and applications. This shift in turn is driving new security and identity needs back to the enterprise. It is imperative that enterprises understand how hosters, MSPs, Iaas/PaaS vendors, and SaaS providers make their money -- and how this works with or against enterprise security needs.

In this session we will identify types of cloud-based services, the monetary incentives for the service providers, and the resulting impacts on the enterprise security. We will detail steps enterprises can take to maximize effective identity and security policies in cloud services, as well as what to look for in service providers. We will also look at it from the perspective of the service provider -- how they can maximize their value and the loyalty of their enterprise customers.

With the proliferation of networked electronic communication came daunting capabilities to collect, process, combine and store data, resulting in hitherto unseen transformational pressures on trust, security and privacy as we know it. The burgeoning development of the Information Society, particularly during the past fifteen years, transcended the societal readiness to respond to the transformational change evoked by ICT. The Future Internet will bring about a world that combines physical and digital elements. Technologies for pattern analysis and superpositioning, data linking, mining and collection will unleash unseen capabilities of access to personal data in a wide sense, and provide mechanisms for undesired privacy intrusion. In this context, the creation and management of identity related data and means to control their long-term use have emerged as some of the central challenges of digital life. In order to preserve trust in digital life, the European Commission recognizes that appropriate measures need to combine technology development with legal means, with user awareness and tools that support data controllers to comply with law in an accountable and transparent manner and that empower users with a controlling stake in managing their identity data. Activities are underway at many levels. European RTD programmes play their role in supporting research in trustworthy ICT, electronic identity management technologies, privacy-by-design in service layers as well as in networks, enabling technologies such as cryptography, and in generalized frameworks for trust and privacy-protective identity management.