-: What is identity?
Well, identity is a collection of user information,
rights, credentials, group memberships, and roles.
When you put all of these together, they create
a set of claims about an individual or an
account holder.
And these claims are made by one party
to another party.
So for example, if I come to your front door
and knock on your door at your house
you might say who are you?
And I'll say well I'm Jason.
That a claim about my identity.
Now do you have a way to prove that I am Jason?
Or do I have a way to prove that I'm Jason?
Well that's what we're going to talk about in
this lesson, because when you talk about identity
it is a key part of authentication, authorization
and trust.
So there are many different attributes to identity.
There's your name, your address, the title you
hold at work, your contact information,
like your phone number or email address,
even identification numbers like your
social security number or passport numbers.
All of these things can make up your identity.
And what information makes up your identity
is gonna be determined by your information system
and your identity management system.
Now when we start talking about these attributes,
they all can be populated into a centralized
database, and this directory, this database
is called a directory.
It can be used for authentication purposes.
For example, if I show up to your door and
say I'm Jason, you might say prove it.
And I can pull out my divers' license
and show you that as a method to prove
that I am Jason, right?
Or if I go up to the boarder agent in the
London airport at Heathrow.
They might say hey prove that you are who
you say your are.
I'll pull out my passport, show them that
my name is Jason Dion, here's my passport,
here's where I was born, here's what
country I'm from and they can then know
I am who I say I am.
Now when we talk about identity, it really
comes down to the three As.
And identity is really the basis of this.
There's authentication, authorization
and accounting.
And these three As are used to control access
to computers, networks and different services
that you might want to use as a user.
These triple As systems as they're known,
can use user names, passwords or any other
attribute of an identity to authorize access.
For instance, one of my attributes is
my thumbprint, right?
One of my attributes is the color of my eyes.
One of these might be my place of birth.
All of these things could be used but the most
common one that we see is username and password.
Now we'll talk about the three As,
you have to understand what the definitions are.
Authentication, authentication is an individual
proving who they are.
So my example before, I use my passport to
show that I am Jason Dion.
Authorization, this is giving the individual
as being provided access to a given resource.
So in the case of my airport example, I show
that I'm Jason with my passport,
and the city of London will let me exit the
airport and enter their city, because I've
crossed the boarder, right?
They've authorized me.
And then the third thing is accounting.
Now when I go through security and when I go
through customs, they're gonna keep a log of
everybody who enters and exits the UK,
or London airport, right?
This is a log, and these logs and monitors are
used for any user that comes through,
in my case a traveler, right.
And when these people come through and they've
been authenticated or they've been authorized
that can be logged as a successful entry.
But if I try to get in and I show them
somebody else's passport, they may
deny me entrance and they would log
that as well, right?
Because you can log all the attempts that were made,
all the successful ones and all the unsuccessful ones.
So that's the basis of triple A,
and the basis of identity systems.
Now these identity systems can be on
each individual machine.
For example, on your laptop that you're watching
this on, you have a username and password.
But it's probably not connected to a domain
unless you're at work.
So in your case, it's a central database on
your laptop only, that gives you authentication
to get onto your laptop using your name and password.
Now if you go to your work, there's probably
a domain controller that centralizes this IAM,
identity and access management.
And everybody has their own username and password
that can logon to any computer in the office
that ties into that domain.
These systems are built to create, store
and manage identity information.
This can include group membership, your roles,
your permissions and all of those identity
attributes that we talked about before.
Remember, each individual has multiple identity
attributes and each entity like an
organization can have multiple identity
underneath it.
Now what doe IAM do for us?
Well this identity access management system
can do a lot of things.
It can provision accounts after you've created them
and give them certain rights and accesses.
It can do the authentication for us
so we can logon to the systems.
It can do single-sign-on, and use that same
credential and identification across multiple systems.
It can feed into the directory like in our email
directory, it would give us our emails
our phone numbers, our titles, our names.
All that comes from that LDAP directory.
It can do account maintenance, it can do
reporting and monitoring and logging
and auditing.
All of these things can be handled by the
identity and access management system
so it's important for us to secure these properly
because they are a big target for attackers.