Cloud Computing

Identity management across multiple SaaS (software-as-a-Service) applications as well as on-premise systems is a challenge to most enterprises. Challenges in Identity Management in the cloud, simply goes beyond how we do authentication, authorization and auditing right. Cross domain authentication, provisioning, interoperability, multi-tenancy, delegation and security are few challenges to name. The best way to preserve interoperability is to adhere to open standards. Lots of proprietary standards came a long way, but at the time they felt a larger audience is needed and interactions with other systems, those became open standards. SAML2 Web SSO, OpenID, OAuth are some popular open standards, widely used across many cloud providers for authenticating users while facilitating identity portability. WS-Trust, WS-Federation used to cater the same aspect while dealing with systems. XACML is another open standard, which is considered to be the de-facto standard for authorization. It facilitates fine-grained authorization in a policy driven manner. Provisioning is also an important aspect in a cloud identity management system. SPML failed to be the de-facto standard for provisioning due to its heavyweight nature and being bias to SOAP. The latest emerging standard for provisioning is SCIM, which is still in progress at the specification level, but looks promising.

Cloud computing provides an opportunity for organizations to optimize the procurement of IT services from both internal and external suppliers However - many organizations are sleepwalking into the Cloud. Moving to the cloud may outsource the provision of the IT service, but it does not outsource responsibility. This session will look at the issues that may be forgotten or ignored when adopting the cloud computing.

These include:

• Ensuring legal and regulatory compliance
• Assuring data security
• Ensuring business continuity
• Avoiding lock in

• Trust Assumptions and Trustworthiness Assurance
• Secure management of cloud components
• Identity management requirements for both, critical infrastructure and privacy protection
• Integrated Identitity management for administration personnel, maintenance personnel, hardware and autonomous systems, and software components.

Multi-tenancy - large numbers of customers using the same infrastructure, sharing the same application - this is how Cloud Computing has become so attractive and where its value proposition comes from. Looking behind the scenes we find out that there are different degrees of multi-tenancy with each of these degrees having their own advantages, disadvantages and - risks. This session will lead you through these different degrees and will evaluate the risks related to them.