Ulrich Lang's Security Policy Automation & Model-Driven Security Blog: "Authorization as a Service"

Tuesday, 6 July 2010

"Authorization as a Service"

"Identity as a Service" is now a buzzword pushed by big vendors sell their identity management suites. Unfortunately, identity as a service does not solve the basic challenges that managing access control is the harder - and often ignored - problem. It is somewhat disappointing to me that the Cloud Security Alliance published a very narrowly scoped docucment "Domain 12 Guidance for Identity & Access Management" back in April 2010 that covers Identity-as-a-Service, but leaves out Authorization-as-a-Service (the document is sponsored by a big identity vendor, which explains a lot...).
This blog has advocated the use of model driven security to implement "Authorization as a service", or more precisely "Security & Compliance Automation as a Service" (SCaaS), for some time. Scientific papers are being presented at various conferences over the coming months, contact us if you would like to know more.
*UPDATE*: a discussion on the Cloud Security Allicance Trusted Cloud Initiative Linkedin forum discusses the issue.

No comments:

Post a Comment

Dr. Ulrich Lang, CEO & Co-Founder ObjectSecurity

Dr. Ulrich Lang (CEO, co-founder ObjectSecurity) received his Ph.D. from the University of Cambridge Computer Laboratory (Security Group) on conceptual aspects of middleware security in 2003 (sponsored by the UK Defence and Evaluation Research Agency (DERA), after having completed a Master's Degree (M. Sc.) in Information Security with distinction from Royal Holloway College (University of London) in 1997. On the management side, he has recently completed a Business Marketing Strategy course at the Kellogg School of Management (Northwestern University). Prior to his M. Sc. he studied computer science & management at the University of Munich and at Royal Holloway College (University of London). He has served in the German federal civil defence (technical and logistical relief) for several years. He has also previously worked as a proposal evaluator for public-funded R&D projects and as an independent information security consultant on various CORBA based banking projects. Ulrich Lang is the lead author on a book written with Rudolf Schreiner on “Developing Secure Distributed Systems with CORBA”, and published various articles in journals and many publications at international conferences and workshops. In addition to his strategic managerial activities, Ulrich Lang's current interests are organisational information security, security policy development, and security visualisation for complexity reduction. He is currently involved in several security and software projects, including ObjectSecurity's collaboration with the U.S. Naval Research Laboratory.

Rudolf Schreiner, CTO & Co-Founder, ObjectSecurity

Rudolf Schreiner (CTO, co-founder) received his Master's (Dipl-Phys.) in physics from University of Munich in 1993. After graduation he worked as an independent software engineer and consultant on various computer security projects in banking, manufacturing and telecommunications. Rudolf Schreiner is the principal architect behind MICOSec Secure CORBA and the ObjectWall IIOP firewall. He has served in the German federal civil defence (technical and logistical relief) for several years. His main interest is the modelling and development of mission critical and secure applications. Rudolf Schreiner is currently the chief architect and coordinator for our OpenPMF policy management framework. Amongst other topics, he is also involved in the development of secure distributed systems in the air traffic management domain.

Definition: Model driven security (MDS)

MDS is the tool supported process of modelling security requirements at a high level of abstraction, and using other information sources available about the system (produced by other stakeholders). These inputs, which are expressed in Domain Specific Languages (DSL), are then transformed into enforceable security rules with as little human intervention as possible. MDS explicitly also includes the run-time security management (e.g. entitlements/authorisations), i.e. run-time enforcement of the policy on the protected IT systems, dynamic policy updates and the monitoring of policy violations.

Ulrich Lang's Security Policy Automation & Model-Driven Security Blog

Model Driven Security Policy Automation

Tuesday, 6 July 2010

"Authorization as a Service"

No comments:

Blog Archive

PUBLICATIONS ON MODEL-DRIVEN SECURITY