-: Identity as a service.
So just like everything else,
people are starting to outsource,
and they're starting to outsource identity services.
So these identity services can provide authentication
services usually through a Cloud-based resource.
This can give you identity lifecycle management,
directory services like LDAP, Active Directory and others,
access management, single sign on,
privilege account monitoring and management
as well as reporting, auditing, oversight, visibility
and other things into the identity lifecycle.
So the question is, should you do it?
Well, you have to consider a couple
of challenges with ID as a service.
First, are you going to centralize your directory services
or are you going to maintain two different services?
One internally for organization
and one externally in this Cloud-based
identity as a service.
The second question, how about authentication?
Are you going to centralize that
or are you going to use a federated model?
The third thing is are you going to use local
or Cloud-based authoritative data credential stores?
Because if they're local they could be secured
maybe a little bit more based on your security theme,
but if they're in the Cloud,
they may be vulnerable to attack
or they could be more secure.
It really does depend on your ID service provider
if you decide to outsource.
So these are some of the questions
and challenges you need to consider,
and they can only really be answered
based on a risk-based decision
and a cost benefit-based decision for your business case.
Now there are some benefits of using ID as a service,
and it's one of the reasons why it's a growing area.
If your organization doesn't already
currently have a strong identity management system,
then ID as a service can bring big improvements in security.
It can be better managed; it can be more secure;
it can be more capable.
And centralized monitoring and reporting
can help you detect issues earlier
than what you're currently using
in your local system if you have weak ID already.
So if you can invest the time and energy
in building a good identity management system
for your internal stuff
or you can outsource that to an ID as a service provider.
Again, this is a cost benefit analysis
and a risk management decision
that you're gonna have input into
as a cyber security analyst,
but it's gonna be made by the business leaders.
So try to influence it based on what you think is best,
noting the challenges and benefits that you may have seen.