Understanding Cloud Security and IAM Components
Explore the world of cloud security and Identity and Access Management (IAM) components. Learn about the challenges specific to the cloud environment, IAM processes, standards, and specifications like SAML, SPML, XACML, and OAuth. Dive into Security Assertion Markup Language (SAML) and its role in authentication and authorization data exchange between parties. Enhance your knowledge of cloud security with insights from Keke Chen's book on cloud security and privacy.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Cloud Computing Cloud Security an overview and IAM Keke Chen
Introduction Many security problems in non-cloud environment are still applicable We focus on cloud-specific problems Reference book cloud security and privacy
Introduction Many security problems in non-cloud environment are still applicable We focus on cloud-specific problems Reference book cloud security and privacy
Identity and Access Management Traditional trust boundary reinforced by network control VPN, Intrusion detection, intrusion prevention Loss of network control in cloud computing Have to rely on higher-level software controls Application security User access controls - IAM
IAM components Authentication Authorization Auditing IAM processes User management Authentication management Authorization management Access management access control Propagation of identity to resources Monitoring and auditing
IAM standards and specifications avoid duplication of identity, attributes, and credentials and provide a single sign-on user experience SAML(Security Assertion Markup Lang) automatically provision user accounts with cloud services and automate the process of provisioning and deprovisioning SPML (service provisioning markup lang). provision user accounts with appropriate privileges and manage entitlements XACML (extensible access control markup lang). authorize cloud service X to access my data in cloud service Y without disclosing credentials Oauth (open authentication).
Security Assertion Markup Language (SAML, pronounced sam-el[1]) is an XML-based, open- standard data format for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. Google Account Example: ACS: Assertion Consumer Service. SSO : single sign-on
SPML example: What happens when an account is created?
XACM Examples: How does your access is verified? PEP: policy enforcement point (app interface) PDP: policy decision point
OAUTH Frequently used service A asks you to authorize the access provided by service B without leaking credentials If you use google services, you may have experienced this procedure Example: You want to share an image stored on google drive for an online printing service You don t want to provide your google password to the printing service Oauth keeps your data safe during data transfers between parties
Oauth procedure Access token: a secret representing the access right on a specific resource on behalf of the end-user Authorization server: keeps a mapping between tokens and access right/resource Resource server: verifies the token with the authorization server Client: need to keep the token securely
OAuth example: Authorize the third party to Access your data/credential
IAM practice- Identity federation Dealing with heterogeneous, dynamic, loosely coupled trust relationships Enabling Login once, access different systems within the trust boundary Single sign-on (SSO) Centralized access control services Yahoo! OpenID
