This event is history, please check out the List of Upcoming Seminars, or send us an email

Check out our related in-house workshops:

 Learning Objectives

Why do we organize this seminar ?

"Identity and Privilege Management" can be a true business enabler as well as an effective way to cut costs if it is correctly introduced in an organization. It can also help an organization to get control of whom has access to what (and as such provide critical assurance). Regrettably the market is full of noise with regard to Identity and Access Management and also the major topic / the key success factor being identity & privilege management is not well understood, so please come and join us for this seminar to demystify the subject and give management a clear understanding of the subject.

Many things drive organisations to set up an Identity, Access and Privilege Management (IAM/PRM) environment (and should be reasons to attend):

• (e)Business and the requirement to open up internal resources and applications to business partners, clients, etc, drive organisations to set up environments that allow them to do so securely. IAM/PRM helps organisations to securely enable (e)business.
• Regulations like HIPAA, SOX, Basel II and others drive organisations to be able to prove that they have things under control and have taken the required measures. IAM/PRM is one of the cornerstones to achieve this.
• Many organisations have a huge amount of systems and applications, and in each of them users have an account. The management of all those identities and authorisations (and coinciding costs) is tremendous. A solid IAM/PRM-environment helps to drastically limit costs.
• Security and especially control (e.g. separation of duties) is becoming increasingly important. The ways in which organisations now manage identities and access rights make it very difficult if not impossible to audit access rights. Modern IAM/PRM-architectures allow you to get a controllable and auditable environment.

Who should attend this seminar ?

The goal of this seminar is to demystify the subject, to help management to understand what is involved, to give insight into the critical success factors to obtain business-enabling, cost-control, assurance, etc.

Therefore this seminar should be attended by:

• Business managers needing to understand and ask the correct questions
• B2B/B2C-project-leaders wanting a global picture and understand the issues
• Auditors / Governance wanting/needing to obtain assurance
• IT managers and Architects in search of a reality check

 Full Programme

Identity and Privilege Management is definitely a "hot topic". But what is Identity and Privilege Management exactly ? Do I need this ? What can it do for me ? During this introductory presentation, we will make an abstraction of the technical details and bring you a management overview. We'll sum up the most important business drivers and explain how these can be applied in your environment.

We will also show that Identity and Privilege Management is not only a technology, but a fundamental aspect of your daily business processes.

• Business Drivers
• Business Facilitation
• Cost Containment
• Operational Efficiency
• IT Risk Management
• Regulatory Compliance
• Complexity
• Authentication (eID, Infocard, ...)
• Multiple digital identities
• Processes
• Management models (delegation, federation, ...)

Controlling and managing identities in your organization is not as easy as it may look. But doing the same for the access they have is like adding a completely new dimension to the equation. In the last few years many new concepts and tools have been developed to address this corner of the IDM solution. They mostly focus on solving the issue by introducing an intermediary layer between the users and the resources: roles. Tools and technologies are exactly that what they claim to be: they do what you tell them to do and nothing more. So, how do you tell them which roles you need? How do you make sure they can work with the most up-to-date information ?

This module will show different approaches to these questions, describing their positive and negative aspect. The audience will get a good feel of what is involved in "role mining" and "role modeling" and will know in what general direction to go in search for the right solution and will know how to avoid some common pitfalls.

• Privilege Management
• DAC (Discretionary Access Control)
• RBAC (Role-Based Access Control)
• RuBAC (Rule-Based Access Control)
• EDAC (Enterprise Dynamic Access Control)
• ...
• Role Mining and Modeling
• Conceptual model
• Pragmatic approach
• Adaptive processes
• Measuring is knowing and knowing is controlling!

An identity process is a process that performs a control task on identities. An IDM solution is set up to support these processes. Hence, the processes and the process architecture are an ideal starting point for an IDM project.

During this presentation, we show what identity processes exactly are and how you can identify them in your organisation. In the next step, we examine these processes with a maturity model that was specially created for Identity Management.

The results of this analysis provide a good - and more importantly an objective - image of the maturity of our current Identity Management. It also shows where the weaknesses are, and where we will have to invest to get all processes at the same level.

• The importance of a good overview of:
• Data
• Digital identities
• Entitlements
• Tasks
• Processes
• How to map:
• Applications
• Authorisations
• Identity Model of your Data Architecture
• How to map:
• Tasks
• Processes (TO-BE)

Recent security incidents at companies and government bodies have triggered more and more regulations. Identity, Access and Privilege Management is also subject to this increased regulation, and auditing plays an increasingly important role. During this presentation, we show you how to realize auditing in your environment, but also how this can bring added value. We will not limit ourselves to the goals of compliance, but we will extend this to process- and architecture improvement.

• Corporate Governance & Compliance
• Compliant IDM
• ISO 17799
• Auditing (+ managing expectations of auditors)
• Approaches
• Post mortem
• On Incident
• Preventive
• Some examples

The Internet has been a tremendous source for innovation. In the last 15 years we saw the birth of electronic messaging, the World Wide Web, video streaming, ... And without the collaborative nature of this Internet we wouldn't have many of the standards we can use today, including PKI, LDAP and Kerberos. But do you know the work that is being done in the area of Identity Management? One intermediate result is Federation, a conceptual architecture that already found its way into mainstream IDM suites thanks to SAML and Liberty. However, that merely scratches the surface. What about InfoCards, a meta identity system created by Microsoft and endorsed by most parties (including Novell, SUN and IBM). With IE7 and Vista having native support and other platforms and browsers not far behind, this will certainly be a big hit in the near future. This, Infocards, and other new concepts, trends and technologies will be presented in this module "Evolutions".

• Identity on the Internet
• Existing (Usable) Work
• Federation (SAML, Liberty)
• Identity Silos (best practices)
• Work in Progress
• Liberty WS-F
• Meta Identity System
• OpenID
• Applicability in the Enterprise

Identity processes and auditing are only 2 of the many building blocks: what is needed, is a full Identity Management architecture. To complete the picture, we present a reference architecture. We start with an example of a Governance model, add the policies and complete it with the data- and process architecture.

Federation architectures are a thing of the future for most companies, but they are becoming increasingly important, and a serious momentum is building around the opportunities of federation. An Identity Management Architecture is not a one-time nor a static project. It is a continuously evolving project with a typical lifecycle. There are many different ways to tackle such a project, e.g. bottom-up or top-down. We discuss a number of alternatives, as well as their advantages and disadvantages.

• Reference Architecture
• Burton Group
• Evolution
• Federation
• User Centric
• Standards (SAML 1.1, ID-FF, ID-WSF, ID-SIS, Shibboleth, SAML 2.0)
• Belgian Federal Token
• Critical Success Factors
• Process
• Compliance

 Speakers

Questions about this ? Interested but you can't attend ? Send us an email !