Event Recording

Why Policy-Based Authorization is Critical for Identity First Security

Name: Why Policy-Based Authorization is Critical for Identity First Security
Uploaded: 2023-05-09T12:00:00+02:00
Duration: 20 min

Posted on May 09, 2023

The enterprise perimeter is now its data objects, APIs, applications, and its users are now the workforce, customers, partners and in many cases, machines. In this new, decentralized, and highly segmented world, CISOs and IAM leaders find themselves struggling with multiple systems and interfaces that control the most basic question: Who has access to what and when?

In this session, we will present a new architecture for Identity First Security based on Centralized Access and Authorization Policy Management Platform, and discuss pro and cons, specific real-world implementations.

Show description

Speaker

Co-Founder & CTO
PlainID

Gal Helemski

Gal is a recognized specialist in cyber security with specific focus on identity and access management. In the past 16 years she has defined solutions to customers, wrote the project specs, technical documentation, presentations and training. Gal holds a B.Sc in Physics & Computer Science...

View profile

Show Transcript

Hi everybody. Thank you for staying. I know you are anxious to join the Wolf Ride later on, so I hope you will find this interesting enough to stay for the duration. I am gal, I'm co-founder at Plain id. I'm the CTO of the company and I'm going to speak with you about why policy based access control policy based authorization is critical for identity first Security. Typically whenever I'm speaking I like first of all to explain the topic, so we will start by understanding what is identity first security and then how policy based fits into that and supports that. We also see a case study of policy based authorization for data access and we'll see how identity First Security fits into all of that. There is a bit of architecture slide, you know, just high level to wrap it all up. So that's what is planned for the next 20 minutes.
And we'll start by what is Identity First Security? So just by the name, it's very understandable. Identity first, security means identity is at the center of your security, right? Your security design, but what does it actually mean? Identity first, what makes your security identity first? So I have a quote here by some of the other analysts, sorry, that's a quote from them. Stating that enabling the right individuals access to the right resources at the right times for the right reasons. That is identity first. It's on not only having identity there, but it's also the understanding of the context of the identity. Why the identity is there, what the identity is trying to access, why now the identity is trying to access. Please note the focus is right, enabling the right individuals to the right resource at the right time. And the focus is right and like always, how do we know it's right?
We know it's right. If we can answer this question, who can do what, when and when, right? It's after all we are in authorization. So we need to answer this question. How do we answer this question in order to know it is right? So let's start with the who. The who is our identity. Our identity can be an employee, our identity can be an external user, a consumer or a partner, or it can even be a service account, whatever. What do we know about the identity? Well, quite a lot of things. We know about the identity. We know the identity besides the idea, we know the identity role. Maybe we know the identity location within the organization or which country the identity is operating from. We know a lot of things about the identity and that can assist in answering the question. The next thing is what the identity is trying to access.
The identity is trying to access financial records. The identity is trying to access medical information or whatever, some kind of stop secret files. Those would be our resources or assets. What do we know about them? Well, again, there is some information we know about our assets as well. Let's say the identity is trying to access accounts. We know the location of the account, we know the type of the account, we know a lot of things about the account. And again, that can be part of the decision. And the last part is the when. The question of the when. The when is the context of access. The user is now trying to access 8:00 AM or 8:00 PM from office or from home, from Europe or from the US or even from Israel. Any place he can try to access whatever is trying. And the combination of all of those pieces of information that leads to a decision to an access decision.
And that is policy. That is what we call a policy combination of attributes, relationship between attributes that leads to a decision that is a policy, but it's not enough just to have a policy in order to have authorization, right? To have an authorization solution in place, you need to look at four, four aspects. What are they? So first of all, they are, okay, first of all, they are enforcement. The decision needs to be enforced decision, there needs to be some kind of engine that makes the decision management. Obviously all those policies need to be managed. They need to be managed in a consistent way, in a way that speaks both to the business and to the IT to the developers as well. And governance. Let's not forget governance. A large portion of IM is around governance. Policies also are part of that. An authorization solution is all of those elements.
Policy-based authorization is an authorization solution that supports authorization policies enabling you to build those decisions in a consistent, flexible way and handles both enforcement decision management and governance. Now let's look at the sample case study, how that comes into play. And the case study I chose is when a user is trying to access data, same simple, right? But no, this is actually one of the more complicated use cases there is, and let's see why. So when we want, remember, what we want to do is to enforce identity first security based on policy based authorization, right? So we have an identity and there is the data. What do we know about the identity? Maybe the identity is an Analyst trying to access data. In that case, the Analyst would probably be using a BI tool, some sort of BI tool to access the data. Or maybe the user is a business user, he's not accessing the data directly, he's going through a business application and the application knows who the identity is.
The data would probably know, would probably wouldn't know who the identity is. So in those cases, just a user trying to access data, how can we define our security? We need to know the identity. Where do we know the identity? Do we know the identity at a browser level? Is that good enough? Do we know the identity at the data level or maybe at the application level? How can we establish trust if we don't know the identity? The identity must be known at the level the trust is established. This is crucial to understand, okay? Because there are a whole lot of solutions out there and there are a whole lot of marketing phrases. But eventually it comes down to what you understand you want to achieve with your security solution. And you need to understand that if you really want to achieve identity first can call it any way you want.
Zero trust is also out there. You need to enforce at the level the identity is known. That's the only way to establish trust. So in our case, for the Analyst, obviously we can't enforce on the browser level, not going into that now, but you know why? We know the identity on the data level, so that's good for us. But for that business user, typically the data wouldn't know them because we're using service accounts. So the only the the lowest level, which the where the identity is known is the business app. So you see why this is a bit of a complicated use case. We started with an identity trying to access data simple, but we have one data source and two types of identities. One a business Analyst, another one, a business user both trying to access the same data. I'm not even starting with let's replicate that data for other data sources.
That's another complication of the same aspect. So what do we do? How do we solve this use case? In order to solve this use case, we need what we call identity first security. We translate into identity aware controls. Again, a lot of language that speak always the same. We need to know the identity. We need to enforce access at the level where the identity is known for the business. Analyst, that would be on the data level for, sorry, for the, yeah, for the Analyst it would be on the data level for our business user. That would be on the business application level. But we want consistent controls, we want consistent visibility. How to achieve that. And now we are going to jump into the architectural slide. How to solve such a problem with an authorization solution. You know, that's what authorizations are built for. Authorizations are built to solve just that authorization solution.
A good authorization solution such as plane. Id have the support, the notion of central management with distributed enforcement because enforcement needs to be done at the level where the identity is known. And management needs to be centralized because you want your consistency, single visibility, one plane of control. So if you would look for example at this side, you would see that you have one place where you manage your policies. That would be your administration point for the policies that feeds the policies feed all the time from external information, information to support who can access what and when, right? We said we have all those pieces of information around our identity, around the assets and around the conditions that feeds into the policy in order to make the decision. And then the decision is enforced. Well, wherever it needs to be forced, it can be enforced on the application level, it can be on the API level, on the service microservice level or on the data level.
That's how technology works. I always like to say no magic in technology, you just need to understand where you need to fit the bits, right? And that's exactly that. You can't just put a solution out there which would solve everything you need to understand the problem. And the problem with authorization is enforcement is distributed, management should be centralized. That's the only way you can achieve consistency, central visibility and real control over your overall security. Okay, and that leads me to plain id. We build plain ID with that notion in place. Our authorization platform, it's a full SaaS authorization solution. Supports from one hand the management of authorization policies in a consistent visual way, supporting all the flows needed to manage authorizations efficiently. Approval workflows, policy as code, audit and governance, delegated authorization management. That's what you need in order to manage your authorizations, right? You need to be able to see the policies, you need to understand the policies.
You need to embed the process in development life cycle. That's why policy code is there as well. All of those are to be supported in the authorization solution. But eventually all those well-defined policies should be enforced all across the technology stack. And that is done with what we call the plain id authorizers. Those are technology ready components that support your application stack, support your APIs, microservices and data authorizations do not have just one language to them. Unfortunately that's not authentication. Authentication today have a well defined standard, not not as it was, I dunno, 10, 20 years back, but you are not asking any questions about authentication. If you need authentication open ID connect is there to the rescue or maybe Samuel if you're still there. But that's not the case With authorization. With authorization, you need to adapt to that technology where enforcement is done in a microservice environment that would typically be in the form of a cycle in an api.
In an API space that would typically in collaboration with your API gateway in an application, well need to support whatever developers like to have, right? So all of that should be there and that's why plane ID is offering the extensible solution, the authorization platform that handles both of those aspects. Again, just to summarize, the notion of identity first enables you to from one side see your identities. The other side, your assets in between. It's the management of the policy in a consistent consolidated way. And just one last slide. My takeaways from this session. First of all, I hope by this time you understand why policy-based authorization is so important for identity first Security. I really don't see any other way to support it. And second true authorization solution would provide and support the notion of central management with distributed enforcement capability. That is a key, a capability or key notion for real authorization solution based on policy based. Thank you.
Thank you very much gal for your interesting lesson. Okay, we have three questions on this for you. Okay, and we have five more minutes, so that's a good timing. The first question that came in was identity first equals zero trust, doesn't it?
Yes. What's
Your opinion?
So my opinion is yes. My opinion is there are multiple notions today in the market that speaks about zero trust, identity, first identity. Well, eventually they all speak about the same thing. They speak about the notion of enforcing access across the path to the data, whatever the user is trying to access based on the identity assuring the access over and over and over again. We can call it zero trust, we can call it identity, well identity first. It's all coming down to the same thing. Yep.
Okay. And then there's a second question. What is the difference between policy based access, attribute based access, conditional access, relational based access, or are we just doing a word salad?
Yeah, I think that's what we are doing.
We are, okay.
Well I think first of all, this is an evolution in the market, right? It started off, if someone remembers with acs, very, very old notion still, still still out there. Then wall based access control, which spoke about the notion of roles. Everyone thought that would solve all our problems today we know not so much. Still role is something which you are assigning to a user because we do not know everything about the user. Then came in attribute based access control, which is basically, let's take everything we know from the identity and from the asset and make a decision. What's the problem, what's the challenge with attribute based? It came as a very technical notion, very specific implementation policies. We have come to solve both of those areas. Policies speak also about this business aspect of authorizations, how you manage those decisions, how you control how you govern. They incorporate both attributes and roles together in order to provide the decisions. All those other, I know there is relationship based access, conditional based access, a lot of staff, they all speak more or less of the same. So okay, defining the access based on what we know, making the access dynamic and as much as as much as possible. Relying on the context of the access.
And then the last question, if I have a policy and I have another policy, they could potentially in theory undo each other. Are you managing that as well? Yes,
We are managing above policies. Yes, absolutely. And I think maybe old notions of managing policies would allow that thing to happen. I think today this area has evolved and if you are interested to know how we are happy to show you in our booth. Number 30, don't forget, please, you are invited to come.
Okay,
Thank you.
Thank you.

Playlist

European Identity and Cloud Conference 2023

Event Recording

Continuous Exposure Management - Keeping one step ahead of attackers through continuous exposure management

May 12, 2023

Companies are facing increasingly complex security threats. Many are struggling to assess their own security risks due to an inability to address potential issues as they arise, due to the breakneck pace at which issues are disclosed, and teams' ability to address said issues as they accumulate and because the huge number of security tools in use create diagnostic fatigue.

Vulnerability management programs rarely ever match the overall scale of the organization, boosting the number of potential points of exposure. What's more, besides vulnerabilities, attackers are increasingly leveraging exposures such as misconfigurations and stolen credentials to gain access to companies' core business. Because of this, attack paths to critical assets are often overlooked or identified too late.

Instead of looking at vast numbers of isolated issues, XM Cyber aggregates them into an attack graph to proactively identify hidden attack paths and weaknesses in both the cloud and on-premises. XM Cyber helps organizations efficiently address the issues that can have the greatest impact on organizational risk. Then teams can eliminate attack paths at critical junctures, i.e., choke points, in order to achieve ultra-efficient risk remediation.

Watch

Event Recording

Reduce Certification Fatigue with Effective Role Management

May 10, 2023

IAM and security leaders end up certifying far more access than necessary, owing to a failure to classify business resources. Furthermore, business users pay the price because they must spend an inordinate amount of time filling out these lengthy surveys. Benoit will show how to reduce certification fatigue through robust role management, which helps business users achieve better results while taking less time out of their day.

Watch

Event Recording

Zero Trust: Where do We Want to be in Five Years?

May 11, 2023

The digital-first customer experience and remote-first workforce pushed zero trust from buzzword to reality. And yet, much of the conversation is still heavy on theory and light on practice. Cyentia completed a global study of high-level practices which measurably contribute to a more successful cybersecurity program based on a rigorous survey of nearly 5,000 practitioners. Within that study, we analyzed commonalities of organizations implementing and operating Zero Trust. Let's look closely at where we are today.

Now imagine it is 2028. You’re five years into your Zero Trust transformation. People like it and usability has improved. Defensibility is better, too, with a number of attacks having been stopped over the past couple years. But then, in 2028, you get the call. There’s been a security breach. What happened!? This session will explore the future with a pre-mortem on how breaches will look under a Zero Trust architecture.

Watch

Event Recording

FIDO 2: Zero Trust in Action with Passwordless Phishing Resistant Authentication

May 10, 2023

By now, organizations are well aware of the need for better protecting data and application with modern access management and authentication.
Thales and Microsoft partner to help organizations going passwordless to fight against phishing attacks. Thales and Microsoft experts Sarah Lefavrais and Thomas Detzner will talk about the role of Fido and other phishing resistant authentication methods like CBA in achieving Zero Trust approach.

Watch

Event Recording

Privileged Access Management – Moving from Cost to Service Centre

May 11, 2023

A standardized approach to control privileged accounts can be valued as a profitable internal service.
While implementing Privileged Access Management (PAM) DKB concentrates on what kind of service delivery a PAM implementation can provide to its customers (our employees) to connect benefits for end-users and address identity security at the same time.
We call that Privileged Access Security Service.
From a technical and IAM point of view identity security can only be achieved by securing the respective digital identities and the assigned user accounts in the corresponding target systems.
In the area of IAM/PAM a comprehensive compliance level automatically results in a higher maturity of our information security management. Therefore, we reduce the non-financial risks not only by complying with regulatory requirements but also by adding effective security concepts – such as zero trust or least privilege – to our IAM/PAM ecosystem.
In this session the DKB approach to handle identities and accounts in the context of a Privileged Access Security Service will be presented.

Watch

Event Recording

Legacy Enterprise IAM/IAG Transformation

May 11, 2023

Enterprise IDM/IAG and gardening do have much in common. Usually, if the general architecture and setup of the garden is done and completed, only minor changes and adjustments will be done over the years. But still: The yard will look different after a few years, not only because the trees and plants have grown, but also because of replacements, adjustments and optimizations over the years.

Sometimes, calling a bulldozer for a more complete ‚redesign‘ and restart from scratch is considered, but still limited by the boundaries of the property (and the budget of the landlord).

Whether you plan to bulldoze your legacy IAM/IAG Program, or replace a few elements just as you would replace plants, trees and flowers because of their age or cost: In this panel we will discuss the options, do‘s and dont‘s, stories from failed ‚gardening projects‘ and many more related to modernizing your legacy IDM/IAG set of tools.

Watch

Event Recording

From Identity Theft to Identity Threat to Identity Security

May 10, 2023

Identity has been always an ambiguous term. Identities exist in a sociocultural and organizational context and in technical ones. We have Digital Identities and eIDs and not only do individuals have identities but so do organizations and non-humans, especially in technical contexts.

Identities had been always under threat, starting with theft of individuals’ identities and credentials in the physical world, such as credit cards and passports. However, these threats have not been on a large scale. We all know that this has changed dramatically with the digitization of everyone and everything. Social engineering, phishing emails, buying credentials in the dark web have become a serious threat to businesses and individuals. These threats have reached new heights with the numerous attacks on identity infrastructures, be it corporate directories or government eID infrastructure.

In this panel, we will explore the identity threats to individuals and organizations, how they are managed, and how identity security can be achieved from a prevention, detection, and management perspective.

Watch

Event Recording

Ahead of the Curve - the Customer Demands it, the Market Demands it, do You?

May 10, 2023

Companies today are being faced with business-critical yet seemingly conflicting topics; how to build trust, loyalty and personalized experiences that fuel growth in a world of fading cookies and GDPR. There has never been more urgency than now to focus on strategy and technology to meet the demands of the privacy-conscious consumer. The collection of data and its management is core to this challenge, but current identity methods are missing the opportunity to solve it with legacy approaches and risk-based thinking. At IndyKite, we believe that facing this mounting challenge requires us to make leaps in both our thinking and technology implementations. Join us as we challenge the current operating state and discuss what the world might look like when we have the tools to power a truly customer-centric ecosystem - one where consumer data ownership and personalized services that fuel growth are no longer at odds.

Watch

Event Recording

How to Manage Complex Clouds Based on Cyber Resistance

May 12, 2023

You have probably heard about Cyber Resilience, and how about Cyber Resistance? What should be the differences between the two terms in the context of Cybersecurity? Cyber Resistance is the same or not?

Prioritizing where to focus efforts first when attack scenarios are almost endless is a complex task. There are often millions of potential attack paths. Most organizations do not know what those paths are or how to prioritize which ones to close first if they can be closed at all.

During this presentation, we will be understanding the differences between Cyber Resistance and Cyber resilience, and how we can apply both concepts to our current technology landscape, besides understanding how we can identify the High-Value Target (HVT) in your organization.

Watch

Event Recording

Ethics in Security Design - For Digital Identity

May 11, 2023

Digital Identity and Security solutions impact our environment, typically in a positive and securing manner. However research shows that increasingly digitization of identity services, for digital identity, also exclude and harm individuals.
In this presentation Henk will detail his research into the impact of digital identity solutions on nation state level and how to start involving ethics in the design and implementation of these solutions.
The findings also apply to designing and implementing security solutions for other purposes than digital identity.
The approach to engage with ethical conversations during design will be explained theoretically, linking to the background of Value Sensistive Design (https://en.wikipedia.org/wiki/Value_sensitive_design) and made practical by case studies of Ethics in Security Design.
Henk has been researching the ethics of digital identity at Leiden University, NL, in 2022.

Watch

Event Recording

Decentralized Identity - Why is it all the Rage?

May 11, 2023

From digital identity to full scale digital trust, this session is perfect for anyone new to identity, as well as identity professionals who are trying to get a handle on what decentralization is all about and why it is so important for Internet-scale digital trust.

In this session, we will cover a brief history of how the identity landscape has gone through an evolution from the dreaded username and password, through centralized, federated and social logins, to now the need for decentralized solutions that support digital trust for both human and objects.

We will explain the various actors involved in a decentralized identity trust triangle, what role technology plays (e.g., digital wallets and digital credentials), and how governance of an ecosystem fits in to create the trust diamond. We will discuss various technical components that may be employed and what is required — and more importantly what is not? We will also present how decentralized trust solutions can support the trust of objects that have nothing to do with human identity, but are necessary to create a digital trust landscape that enables digital transactions to happen seamlessly, efficiently, and automatically.

We’ll also touch on how the traditional identity solutions and emerging decentralization can co-exist in context appropriate settings.

Watch

Event Recording

Digital Trust in the Metaverse & Decentralized Internet of Everything

May 11, 2023

Phishing, hacking, threats, fraud, and malicious behavior online of all types all share a common root: verification. In this session we’ll go beyond identity and explain how decentralized identity and verifiable credentials can provide a complete, secure system for exchanging different types of information between multiple parties. Learn how Trusted Data Ecosystems can connect people, machines, companies or any two entities to multiple businesses and jurisdictions without sharing private information. In this conversation, long-time community contributor at Hyperledger, working group leader at Decentralized Identity Foundation, and Indicio Senior Engineer Sam Curren will share more about digital trust and describe the critical importance of digital verification to decentralized healthcare, finance, the metaverse, and to the interaction of digital objects and non-digital objects in the spatial web—the “Internet of Everything.”

Watch