Malware & Cybercrime: Detection, Prevention and Impact of Malware

A Survey of Risk:Federated ID Management in Cloud and Grid ComputingPresentationby Andy Wood (P11250192)IntroductionCloud (and Grid) computing are the new platforms today.

Working with business partners is more common place in todays connected world.

Managing user accounts across disparate systems is becoming more difficult and costly.

Federated ID ManagementFederated ID Management (FIdM) allows for simplified user management across security domains.Based on a user authenticating to own DS and their ID used to authenticate to remote services through trust relationships.FIdM is based on not just technology.Many ways to implementUser centricBusiness centric

Federated ID Management

Critical Review - ResourcesKeywords: (FIdM or Federated) and Cloud and Risk.Resource Databases:IEEE Xplore; ACM DL; SCOPUS; CiteSeerX and Google Scholar.Resources:673 initial resources.Reduced to final 18.5 Further papers added

Critical Review - CriteriaCriteria:Primary / Secondary sourceDifficulty to implementRisk type: Security; Liability; Trust; Assurance or InteroperabilityScalabilityProtocolsCitation

Critical Review - FindingsMost papers describe similar technologies:SAML being key protocol for ID transferXACML bring key protocol for access controlKey risks:Trust (with 3rd party); Interoperability; andMessage security.Scalability of solutions were goodDifficulty varied and subjectiveOlden (2011) describes a typical enterprise benefit with example saving of $4.5m per year.

Critical Review RisksLiability Ensuring lines of responsibilityAssuranceProcesses and procedures being followed:staff vetting; joiners/movers/leavers etc.TrustFundamental, but difficult to implementSecurityID theft Greater exposure than via separate authentication to systemsMessage security through exchange of ID informationInteroperabilitySome standard based mechanisms such as SAMLOthers describe extended or bespoke mechanismsPotential for large federations to include multiple mechanisms Higher risk profileHigher cost for implementation and support

8ConclusionResources were harmonious in design and riskImmature area of technologyStill room for improvementFIdM is more than just technologyLack of described foundation prior to techFIdM is a business enablerBalance of risk v business enablementRisk profile has to be aligned to each business