Database Reference
In-Depth Information
Identity Management in the Cloud
There is a larger requirement for integrating identities for multiple websites, cloud services, and internal systems
other than the PAC considerations previously discussed. What we really want to avoid is sending internal employees
to external websites and having them enter their low-complexity, single-value passwords into those websites for
company business. The web is a dangerous place. I have worked with ex-colleagues from Manchester University
Computer Science Department for ten years on
www.ukcert.org.uk
to help protect the UK's cyberspace and
have been privy to over 20,000 reported incidents. These consist mostly of hacked websites being used to phish
unsuspecting humans. Web browsers and HTML email are not secure mediums and unfortunately many companies
do not provide clear URLs and domain names, thus making their brand open to attack. An analysis of phishing attacks
An organization representing the white hat community for cloud security is the CSA (Cloud Security Alliance),
of which I have been a member since the onset. This a useful guide to cloud security in general from the CSA:
In short, humans are the weakest security link and they will simplify their passwords down to the same value
for many sites to save time. Our companies have to protect our humans from being exploited due to bad password
management. There is an obvious niche here for cloud-based identity management as a service, with private
companies taking the lead (see
http://www.okta.com/resources/tour.html
)
as well as non-profit making
So managing the business process of consolidation and or cloud migration in a compliant way are the
challenges which will be placed on the shoulders of infrastructure managers in our last chapter as well as conclusions
to this topic.
