Implementing identity management security - an ethical hacker's view

As companies open up their networks to allow access by business partners, customers and suppliers, they are also moving from fortress-style security to airport-style security. “We have to let everyone in, then rely on their digital identity to determine which resources they should be able to access,” as ethical hacker Peter Wood puts it. So the question is: how do you set about implementing effective identity management security? No matter how much you spend on firewalls, VPNs, anti-virus software and intrusion prevention, anyone who steals the identity of one of your users becomes that user and has access to your most sensitive systems and data. If just one user's identity is compromised, your systems are vulnerable. And companies seem to go to extraordinary lengths to make them so. This article investigates the methods of stealing an individual's digital identity - and the common flaws, so often avoidable, which make it easy. Identity management has two principal components – management of identity and management by identity. Management of identity is the process of issuing and using digital identities and credentials (such as usernames and passwords). Management by identity combines the proven identity of the user with their authorisation, in order to grant access to resources. This article explores the methods of stealing an individual's digital identity and thus gaining the ability to impersonate them and access the resources they have the right to access.