Identity Management: Cradle to Grave

In the early days of computing, most of us used a single system or application; it was provided and managed by our employers.  We had one user ID, vouched for by our managers, and one password.  We used these in a relatively benign environment.

As the number of applications and services that we use grows, so does the number of user IDs and passwords.  (I have more than 200).  A few of these are used daily but some are used only once or twice a year. For some applications one may have to go through multiple gateways. Most of these applications are operated by other enterprises including vendors, fiduciaries, and government agencies. Rarely are we as well known to these enterprises as we are to our employers. 

The environment has become increasingly hostile; others may wish to pretend to be us.  They may wish to do so for a brief period; we speak of transaction fraud.  They may wish to do so semi-permanently; we speak of identity theft. 

Managing all these relationships safely is called Identity Management.  It may be a necessity, an accommodation, or a fee for service.

This presentation will define identity, identifiers, and identity management.   It will discuss what it means to say who one is and that one “knows” someone. It will consider the kinds of evidence that one uses when making that decision.  We will compare and contrast some of the competing ideas and schemes intended to make this problem more tractable and make recommendations for their use. 

Speaker Bio: Bill Murray is senior network security consultant for Verizon Business and Research Associate Professor at the Naval Postgraduate School.  He is  Certified Information Security Professional (CISSP) and chairman of the Governance and Professional Practices committees of (ISC)2, the certifying body,  Bill is an advisor on the Board of Directors of the New York Metropolitan Chapter of ISSA.

He has more than fifty years experience in information technology and more than forty years in security. During more than twenty-five years with IBM his management responsibilities included development of access control programs, advising IBM customers on security, and the articulation of the IBM security product plan. He is the author of the IBM publication Information System Security Controls and Procedures.

View the flyer here.