CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls

•

0 j'aime•597 vues

Controlling access to systems, information and data is the quintessential art of of access management. Making sure the right people have the right access to right stuff is what IAM is all about. In this session, SailPoint's CTO Darran Rolls will discuss how to strike the right balance between the automated assignment of entitlement based on predefined models and rules, and the use of more discretionary access based on comprehensive request and approval flows. This session will discuss the pros and cons of both approaches and will offer a clear perspective on how to design and deploy both models as part of a comprehensive IAM program.

Technologie

Today’s Agenda
•  Discretionary Access
-  Definition
-  Application
•  The Spectrum of Authorization
-  Static Models
-  Dynamic Models
-  Blended Models
•  Striking the Right Balance
-  What Fits Best Where?
-  Some General Best Practices…

“Passing or Embedding Control for
an access control decision”

Discretionary Access Scale
Approval Based - StaticModel Based - Dynamic
Access Control Decisions
Discretionary Access Scale

Discretionary Access Scale
Approval Based - StaticModel Based - Dynamic
Access Control Decisions
Fully Resolvable Policy Based

Discretionary Access Scale
Approval Based - StaticModel Based - Dynamic
Access Control Decisions
Partial of Full Human Interaction

Discretionary Access Scale
Approval Based - StaticModel Based - Dynamic
Access Control Decisions
Balance of Both

“Pertaining to
or characterized by
a fixed or stationary
condition”
www.dictionary.com

“An application access security
mechanism, controlled by local
configuration”
www.darranrolls.com

Identity Governance
& Administration
Approvals

“Pertaining to
or characterized by
energy or effective
action”
www.dictionary.com

“An application access security
mechanism, controlled by an
external late binding decision
making process”
www.darranrolls.com

Dynamic Models
ABAC - Entitlements & Context
PIP Attribute
Provider
VDS
PDP
System
System
Target
Target
PEP
PEP
Environment Attributes
+
Rules…

Dynamic Models
ABAC - Entitlements & Context
PIP Attribute
Provider
VDS
PDP
System
System
Target
Target
PEP
PEP
Entitlement
Giving
Attributes…
Environment Attributes
+
Rules…

Entitlement Giving Attributes
Creating High Fidelity Attributes…
High Fidelity Attributes provide assurance that controls and
governance are in place to appropriately manage Entitlement Giving
Attributes…

Dynamic Models
ABAC - Entitlements & Context
PIP Attribute
Provider
VDS
PDP
System
System
Target
Target
PEP
PEP
Environment Attributes
+
Policies…
Policy
Review &
Attestation…

Policy Review & Attestation
Maintaining Integrity…
Policy Controls provide assurance that once developed and deployed,
access policy rules can be considered articles of access attestation
with lifecycle controls & audit

Dynamic Models
ABAC - Entitlements & Context
PIP Attribute
Provider
VDS
PDP
System
System
Target
Target
PEP
PEP
Attributes…
Policies…
Governance
Visibility…
Review…
Change Control…
Audit…

Governance for the Process…
Managing Attributes & Policies
Visibility
• Collection
• Categorization
• Analytics
Review
• Approvals
• Certification
• Policy checks…
Change
• Delegated Admin
• Change
Detection
• Change Approval
Audit
• Reporting
• Activity
• Review
Attribute Integrity Reliability Index

“To have mixed smoothly and
inseparably together.”
www.dictionary.com

“An application access
security mechanism that
mixes static & dynamic
methods in the
end-to-end process.”
www.darranrolls.com

Just-in-Time
Token Authorization with Governance-based Provisioning
Attribute Integrity Reliability Index

Real-time Approval
Dynamic Manual
Attribute Integrity Reliability Index

IdentityNOWIdentityIQ
Thank You!
darran@sailpoint.com
@djrolls

Contenu connexe

Tendances

Overview of Oracle Identity Management - Customer Presentation

Delivery Centric

WSO2 Charon

HasiniG

CIS14: SCIM: Why It’s More Important, and More Simple, Than You Think

CloudIDSummit

Round table guide

OracleIDM

Iam suite introduction

wardell henley

Oracle Access Management - Customer presentation

Delivery Centric

Scim overview

Morteza Ansari

Oracle_Cisco identity platform approach_webcast

OracleIDM

Comparing forefront identity manager vs. other identity managers

InfraMatix Inc.

Today enterprise solutions adopt products and services from multiple cloud providers in order to accomplish various business requirements. This means that it is no longer sufficient to maintain user identities only in corporate LDAP. In most cases, SaaS providers also need dedicated user accounts created for the cloud service users, which raises the need of identity provisioning mechanisms to be in place.

Standardizing Identity Provisioning with SCIM

WSO2

Identiverse 2021 enterprise identity: What foundations

Bertrand Carlier

Ioug webcast entitlements in check

OracleIDM

Evolveum: All you need to know about identity & access management

Evolveum

Sailpoint Online Training on IAM overview

ITJobZone.biz

Platform approach-series-the oracleplatform-final

OracleIDM

Identity and Access Management - Data modeling concepts

Alain Huet

Gartner iam 2011-analytics-aj-orig-recordednp-final

OracleIDM

Abac and the evolution of access control

Akbar Azwir, MM, PMP, PMI-SP, PSM I, CISSP

Open iam technicalarchitecture-v3-a

Bibhuti Kr Jha +91-9810016292

Declarative security-oes

OracleIDM

Tendances (20)

Overview of Oracle Identity Management - Customer Presentation

WSO2 Charon

CIS14: SCIM: Why It’s More Important, and More Simple, Than You Think

Round table guide

Iam suite introduction

Oracle Access Management - Customer presentation

Scim overview

Oracle_Cisco identity platform approach_webcast

Comparing forefront identity manager vs. other identity managers

Standardizing Identity Provisioning with SCIM

Identiverse 2021 enterprise identity: What foundations

Ioug webcast entitlements in check

Evolveum: All you need to know about identity & access management

Sailpoint Online Training on IAM overview

Platform approach-series-the oracleplatform-final

Identity and Access Management - Data modeling concepts

Gartner iam 2011-analytics-aj-orig-recordednp-final

Abac and the evolution of access control

Open iam technicalarchitecture-v3-a

Declarative security-oes

En vedette

Access Control: Principles and Practice

Nabeel Yoosuf

Use this presentation to learn about FIDO's certification process. The FIDO Alliance invites you to learn how simplify strong authentication for web services. FIDO specifications can help all organizations, especially service providers who want to scale these features for consumer services over the web. Essentially, FIDO offers a simple, low-cost way to improve security and the online experience.

Fido Certification Program Process

FIDO Alliance

In just over one year, the FIDO Certified Program has tested and certified more than 200 implementations of the FIDO specifications. There is strong interest and momentum in the market for FIDO Certified products — including FIDO’s new BLE certification, which for the first time brings FIDO technology to wearables and other emerging form factors. These slides include information about: - An overview of the program, including updates on newly available certification methodologies, - Some of the latest and greatest FIDO Certified solutions on the marketplace, and gain an understanding of how products get started through the FIDO Certification process, and also will understand the benefits of deploying FIDO Certified authentication solutions.

FIDO Certification

FIDO Alliance

Chapter23

gourab87

Distributed database security with discretionary access control

Jyotishkar Dey

Introduction to FIDO Authentication

FIDO Alliance

Mandatory access control for information security

Ajit Dadresa

1 system security

Arjun Trivedi

security and privacy in dbms and in sql database

gourav kottawar

Rbac

أحلام انصارى

Introduction to Selinux

Atul Jha

Bootkit threats have always been a powerful weapon in the hands of cybercriminals, allowing them to establish persistent and stealthy presence in their victims' systems. The most recent notable spike in bootkit infections was associated with attacks on 64-bit versions of the Microsoft Windows platform, which restrict the loading of unsigned kernel-mode drivers. However, these bootkits aren't effective against UEFI-based platforms. So, are UEFI-based machines immune against bootkit threats (or would they be)? The aim of this presentation is to show how bootkit threats have evolved over time and what we should expect in the near future. Firstly, we will summarize what we've learned about the bootkits seen in the wild targeting the Microsoft Windows platform: from TDL4 and Rovnix (which was used by the Carberp banking trojan) up to Gapz (which employs one of the stealthiest bootkit infection techniques seen so far). We will review their infection approaches and the methods they have employed to evade detection and removal from the system. Secondly, we will look at the security of the increasingly popular UEFI platform from the point of view of the bootkit author, as UEFI is becoming a target of choice for researchers in offensive security, and proof-of-concept bootkits targeting Windows 8 OS using UEFI have already been released. We will focus on various attack vectors against UEFI and discuss available tools and what measures should be taken to mitigate against them.

Bootkits: past, present & future

Alex Matrosov

Security models

LJ PROJECTS

Resilient IoT Security: The end of flat security models

Milosch Meriac

www.lucky-bet.site => Bet on Sports - 50% Deposit Bonus www.lucky-bet.site/casino => Online Casino - 5000$ Welcome Bonus www.lucky-bet.site/lotto247 => Lotto247 - Win Big, Live Free Malware is getting more and more sophisticated and capable to circumvent traditional security technologies, redefining the information security landscape. Firewalls, Next Generation Firewalls and Intrusion Prevention Systems are converging to a new breed of security devices capable of moving the security enforcement paradigm to context, taking over the old model based on “IP Address, Protocol and Access Control” to a new model focused on “user, application and anomaly”.

Moving Security Model From Content to Context

Paolo Passeri

Security models of modern mobile systems

Divya Raval

Cia security model

Imran Ahmed

Android sandbox

Anusha Chavan

3. security architecture and models

7wounders

Android Security

Lars Jacobs

En vedette (20)

Access Control: Principles and Practice

Fido Certification Program Process

FIDO Certification

Chapter23

Distributed database security with discretionary access control

Introduction to FIDO Authentication

Mandatory access control for information security

1 system security

security and privacy in dbms and in sql database

Rbac

Introduction to Selinux

Bootkits: past, present & future

Security models

Resilient IoT Security: The end of flat security models

Moving Security Model From Content to Context

Security models of modern mobile systems

Cia security model

Android sandbox

3. security architecture and models

Android Security

Similaire à CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls

Non-functional Issues in Cloud Based Systems by Kees Blokland and Martin Pol

Kees Blokland

S5-Authorization

zakieh alizadeh

IDSA at Denver IAM Meetup

Identity Defined Security Alliance

Cm3 secure code_training_1day_access_control

dcervigni

Security Architecture Best Practices for SaaS Applications

Techcello

IT Control Objectives for SOX

Mahesh Patwardhan

CloudBrew 2018 - Azure Governance

Tom Janetscheck

Security architecture best practices for saas applications

kanimozhin

As organizations grow, they face more risks associated with the security and protection of sensitive data. Organizations struggling to navigate the different stages of business need to be sensitive to the increasing maturity necessary to support increasing demands for data governance and information risk management. Learn about: ▪ Four different stages of the maturity curve ▪ Assessing data sensitivity and classifying data assets ▪ Access controls and data protection ▪ Interpreting policies and determining their impact on information management ▪ Determining the impact of data protection policies on information management practices ▪ Automating policy compliance auditing ▪ Maintaining governance consistency across the hybrid data enterprise Watch the on-demand webinar here: https://tdwi.org/webcasts/2021/03/arch-all-maturing-your-organizations-information-risk-management-strategy.aspx with TDWI Speaker: David Loshin, President of Knowledge Integrity and guest speaker Bill Brooks, Director of Solutions Engineering, Privacera (www.privacera.com)

Maturing Your Organization's Information Risk Management Strategy

Privacera

Continuous compliance using data and code

Erkang Zheng

GDPR Part 3: Practical Quest

Adrian Dumitrescu

Multi-Tenancy in Data Lakes are on the rise. When looking at multi-tenancy from the lens of data governance, a lot is changing the landscape, and the way we have been operating with respect to the governance model probably needs a rethink. It is time to think of Governance and its various entities as a first-class citizen in data architecture and bake it as part of the platform. We will look at the various aspects of governance, extending to accommodate the growing compliance and regulatory requirements and suggestive architectural approaches to realize the same.

Data governance datalakes_multitenancy

Sathish K S

Silicon Valley IDSA Meetup October 2018

Identity Defined Security Alliance

Access Control Fundamentals

Setiya Nugroho

The Information Office

Mahesh Patwardhan

Kolegov tkachenko-Non-Invasive Elimination of Logical Access Control Vulnerab...

Positive Hack Days

Leveraging agility in Governing Health IT compliance

Bhavesh Bhagat, CGEIT, CISM (LION)

TrustedAgent GRC streamlines the complexity of obtaining security authorization from FedRAMP for cloud IaaS, PaaS, and SaaS services and applications. From tracking evidence and key control implementation to create key deliverables like security plans and managing continuous monitoring for ongoing compliance. TrustedAgent significantly reduces the amount of work to be done manually including managing vulnerabilities from ongoing compliance. Download and contact us to learn more how TrustedAgent GRC can create opportunities for your cloud offerings in the Federal Government.

TrustedAgent FedRAMP Security Authorization

Tuan Phan

Information Security Framework

ssuser65fa31

Bringing the Cloud Back to Earth

Sri Chalasani

Similaire à CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls (20)

Non-functional Issues in Cloud Based Systems by Kees Blokland and Martin Pol

S5-Authorization

IDSA at Denver IAM Meetup

Cm3 secure code_training_1day_access_control

Security Architecture Best Practices for SaaS Applications

IT Control Objectives for SOX

CloudBrew 2018 - Azure Governance

Security architecture best practices for saas applications

Maturing Your Organization's Information Risk Management Strategy

Continuous compliance using data and code

GDPR Part 3: Practical Quest

Data governance datalakes_multitenancy

Silicon Valley IDSA Meetup October 2018

Access Control Fundamentals

The Information Office

Kolegov tkachenko-Non-Invasive Elimination of Logical Access Control Vulnerab...

Leveraging agility in Governing Health IT compliance

TrustedAgent FedRAMP Security Authorization

Information Security Framework

Bringing the Cloud Back to Earth

Plus de CloudIDSummit

CIS 2016 Content Highlights

CloudIDSummit

The Cloud Identity Summit was founded by Ping Identity with support from industry leaders in 2010 to bring together the brightest minds across the identity and security industry. Today the event is recognized as the world’s premier identity industry conference and includes tracks from industry thought leaders, CIOs and practitioners. Cloud Identity Summit serves as a multi-year roadmap to deploy solutions that are here today but built for the future. For more info, go to www.cloudidentitysummit.com. Be apart of the convo on Twitter: @CloudIDSummit + #CISNOLA

Top 6 Reasons You Should Attend Cloud Identity Summit 2016

CloudIDSummit

CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - And...

CloudIDSummit

Mobile security, identity & authentication reasons for optimism 20150607 v2

CloudIDSummit

In an ever interconnected and inter-reliant world, the state of security has been a cause for deep pessimism. In the midst of all the gloom, there is good cause for optimism. With some fits and starts, the building blocks for transforming mobile security are taking shape at every level from the processor, to the chipset to special purpose hardware to operating systems and protocols that address use cases from device integrity to user authentication to payments. How do we think about security, privacy, identity and authentication in this world? This talk will provide a rapid overview of some selected building blocks and some practical examples that are now deployed at scale to illustrate the coming wave and how you as a practitioner or customer can participate and position yourself for maximum benefit.

CIS 2015 Mobile Security, Identity & Authentication: Reasons for Optimism - R...

CloudIDSummit

CIS 2015 Virtual Identity: The Vision, Challenges and Experiences in Driving ...

CloudIDSummit

Does anybody remember seeing a big red button with the word “PANICK!” written on it? I know it was around here somewhere. Also, there’s all these cats running pell-mell around the place, can someone give me a hand in herding them? In this real-world case study, come and learn how a Fortune 100 with a diverse and extremely mobile work-force was able to turn up strong authentication protections for our critical cloud resources, and how the IT department lived to tell the tale. You’ll hear about the technical implementation of strong authentication enforcement, and how we made key design decisions in the ongoing balancing act between security and user experience, and how we managed up-and-down the chain from executive stakeholders to the boots-on-the-ground who were being asked to join us on this new security adventure.

CIS 2015 Deploying Strong Authentication to a Global Enterprise: A Comedy in ...

CloudIDSummit

CIS 2015 Without Great Security, Digital Identity is Not Worth the Electrons ...

CloudIDSummit

You'll laugh, you'll cry, and you might even pick up a useful nugget or two listening to a real-world enterprise IT architect share the experiences of the past year trying to support his business migrating to cloud services, and sharing the lessons learned from trying to integrate 2 hybrid enterprises into a single, streamlined company. You'll hear where the cloud came through for us, and how we often had to fall back to on-prem services such as FIM, Ping Federate, and ADFS to make the glue which binds it all together.

CIS 2015 Mergers & Acquisitions in a Cloud Enabled World - Brian Puhl

CloudIDSummit

CIS 2015 IoT and IDM in your Mobile Enterprise - Brian Katz

CloudIDSummit

CIS 2015 Practical Deployments Enterprise Cloud Access Management Platform - ...

CloudIDSummit

The IAM program needs to align behind the shift towards ITaaS, building the platform for execution and supporting transformation and migration activities. CIOs should keep informed through a relevant IAM capability roadmap in order to make calculated decisions on where investments should be made. Ongoing investments in the IAM program are crucial in order to fill capability gaps, keep up-to-date with support and license agreements and make opportunistic progress on the strategic roadmap. In this talk, Steve discusses recent experiences and lessons learned in preparing for and pitching VMware’s CIO on enterprise IAM program initiatives.

CIS 2015 What I Learned From Pitching IAM To My CIO - Steve Tout

CloudIDSummit

Companies and researchers are exploring ways to make software and hardware development easier for the masses. Soon you will be able to build your own autonomous drone, create a sensor that assess the watering needs of your plants, and develop a cat tracking device with minimal coding and hardware skills. What is the place of security and privacy in this exciting development? Are we building the next generation of Internet security vulnerabilities right now? In his talk Hannes Tschofenig will highlight challenges with Internet of Things, what role standardization plays, and what contributions ARM, a provider of microprocessor IP, is making to improve IoT security.

CIS 2015 How to secure the Internet of Things? Hannes Tschofenig

CloudIDSummit

The IDaaS (identity as a service) market segment continues to grow in popularity, and the scope of its vendor's capabilities continue to grow as well. It's still not a match for everyone, however. Join identity architect Sean Deuby for an overview of the most popular IDaaS deployment scenarios, scenarios where IDaaS has a tougher time meeting customer requirements, and whether your company is likely to find its perfect IDaaS mate.

CIS 2015 The IDaaS Dating Game - Sean Deuby

CloudIDSummit

CIS 2015 SSO for Mobile and Web Apps Ashish Jain

CloudIDSummit

The Industrial Internet, the Identity of Everything and the Industrial Enterp...

CloudIDSummit

CIS 2015 SAML-IN / SAML-OUT - Scott Tomilson & John Dasilva

CloudIDSummit

Centralized session management has long been a goal of Web Access Management systems: the idea that one session can give end users access to dozens of protected applications with a seamless SSO experience, and terminating it (either by the end user themselves, or by an administrator) cuts off access instantly. It’s a nice dream isn’t it? Turns out that while most WAM products claim they can do this, when deployment time comes around (especially in globally distributed organizations) serious security and scalability challenges emerge that make it unfeasible. In this “session”, come and learn our vision for deploying session management at scale and see how Ping Identity has implemented it in our Federated Access Management solution.

CIS 2015 Session Management at Scale - Scott Tomilson & Jamshid Khosravian

CloudIDSummit

Are you asking yourself how do I take my inhouse application and make it available to internal users, partners or customers using SSO and access management technologies? Oh, and you don't want it to be a 6 month project? No problem. Come and find out how to leverage your existing investments and move to modern standards like OpenID Connect, without having to rip and replace infrastructure. Learn the capabilities and tradeoffs you can make to deploy the right level of identity and access management infrastructure to match your security needs.

CIS 2015 So you want to SSO … Scott Tomilson & John Dasilva

CloudIDSummit

Devices need owners, people need confidence in device authenticity, data needs to persist in systems long after devices change hands, and access needs to be authorized selectively. That's a lot to ask; even if emerging web identity and security technologies are simpler than the models of yesteryear, IoT devices have complicating limitations when it comes to processing power, memory, user interface, and connectivity. But many use cases span web and IoT environments, so we must try! What are the specific requirements? What elements of web technologies can we borrow outright? What elements may need tweaking?

CIS 2015 Identity Relationship Management in the Internet of Things

CloudIDSummit

Plus de CloudIDSummit (20)

CIS 2016 Content Highlights

Top 6 Reasons You Should Attend Cloud Identity Summit 2016

CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - And...

Mobile security, identity & authentication reasons for optimism 20150607 v2

CIS 2015 Mobile Security, Identity & Authentication: Reasons for Optimism - R...

CIS 2015 Virtual Identity: The Vision, Challenges and Experiences in Driving ...

CIS 2015 Deploying Strong Authentication to a Global Enterprise: A Comedy in ...

CIS 2015 Without Great Security, Digital Identity is Not Worth the Electrons ...

CIS 2015 Mergers & Acquisitions in a Cloud Enabled World - Brian Puhl

CIS 2015 IoT and IDM in your Mobile Enterprise - Brian Katz

CIS 2015 Practical Deployments Enterprise Cloud Access Management Platform - ...

CIS 2015 What I Learned From Pitching IAM To My CIO - Steve Tout

CIS 2015 How to secure the Internet of Things? Hannes Tschofenig

CIS 2015 The IDaaS Dating Game - Sean Deuby

CIS 2015 SSO for Mobile and Web Apps Ashish Jain

The Industrial Internet, the Identity of Everything and the Industrial Enterp...

CIS 2015 SAML-IN / SAML-OUT - Scott Tomilson & John Dasilva

CIS 2015 Session Management at Scale - Scott Tomilson & Jamshid Khosravian

CIS 2015 So you want to SSO … Scott Tomilson & John Dasilva

CIS 2015 Identity Relationship Management in the Internet of Things

Dernier

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

Histor y of HAM Radio presentation slide

vu2urc

Discord is a free app offering voice, video, and text chat functionalities, primarily catering to the gaming community. It serves as a hub for users to create and join servers tailored to their interests. Discord’s ecosystem comprises servers, each functioning as a distinct online community with its own channels dedicated to specific topics or activities. Users can engage in text-based discussions, voice calls, or video chats within these channels. Understanding Discord Servers Discord servers are virtual spaces where users congregate to interact, share content, and build communities. Servers may revolve around gaming, hobbies, interests, or fandoms, providing a platform for like-minded individuals to connect. Communication Features Discord offers a range of communication tools, including text channels for messaging, voice channels for real-time audio conversations, and video channels for face-to-face interactions. These features facilitate seamless communication and collaboration. What Does NSFW Mean? The acronym NSFW stands for “Not Safe For Work,” indicating content that may be inappropriate for professional or public settings. NSFW Content NSFW content encompasses material that is sexually explicit, violent, or otherwise graphic in nature. It often includes nudity, profanity, or depictions of sensitive topics.

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

UK Journal

A Call to Action for Generative AI in 2024

Results

BooK Now Call us at +918448380779 to hire a gorgeous and seductive call girl for sex. Take a Delhi Escort Service. The help of our escort agency is mostly meant for men who want sexual Indian Escorts In Delhi NCR. It should be noted that any impersonator will get 100 attention from our Young Girls Escorts in Delhi. They will assume the position of reliable allies. VIP Call Girl With Original Photos Book Tonight +918448380779 Our Cheap Price 1 Hour not available 2 Hours 5000 Full Night 8000 TAG: Call Girls in Delhi, Noida, Gurgaon, Ghaziabad, Connaught Place, Greater Kailash Delhi, Lajpat Nagar Delhi, Mayur Vihar Delhi, Chanakyapuri Delhi, New Friends Colony Delhi, Majnu Ka Tilla, Karol Bagh, Malviya Nagar, Saket, Khan Market, Noida Sector 18, Noida Sector 76, Noida Sector 51, Gurgaon Mg Road, Iffco Chowk Gurgaon, Rajiv Chowk Gurgaon All Delhi Ncr Free Home Deliver

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

Delhi Call girls

Microsoft's Threat Matrix for Kubernetes helps organizations understand the attack surface a Kubernetes deployment introduces to their environments. This ensures that adequate detections and mitigations are in place. By covering over 40 different attacker techniques, defenders can learn about Kubernetes-specific mitigations and controls to deploy to their environments. In this session, we will explore the MS-TA9013 Host Path Mount technique, which is commonly used by attackers to perform privilege escalation in a Kubernetes cluster. Attendees will learn how attackers and defenders can: * Escape the container's host volume mount to gain persistence on an underlying node * Move laterally from the underlying node into the customer's cloud environment * Analyze Kubernetes audit logs to detect pods deployed with a hostPath mount * Deploy an admission controller that prevents new pods from using a hostPath mount

Breaking the Kubernetes Kill Chain: Host Path Mount

Puma Security, LLC

A Domino Admins Adventures (Engage 2024)

Gabriella Davis

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Neo4j

With more memory available, system performance of three Dell devices increased, which can translate to a better user experience Conclusion When your system has plenty of RAM to meet your needs, you can efficiently access the applications and data you need to finish projects and to-do lists without sacrificing time and focus. Our test results show that with more memory available, three Dell PCs delivered better performance and took less time to complete the Procyon Office Productivity benchmark. These advantages translate to users being able to complete workflows more quickly and multitask more easily. Whether you need the mobility of the Latitude 5440, the creative capabilities of the Precision 3470, or the high performance of the OptiPlex Tower Plus 7010, configuring your system with more RAM can help keep processes running smoothly, enabling you to do more without compromising performance.

Boost PC performance: How more available memory can improve productivity

Principled Technologies

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

The Raspberry Pi 5 was announced on October 2023. This new version of the popular embedded device comes with a new iteration of Broadcom’s VideoCore GPU platform, and was released with a fully open source driver stack, developed by Igalia. The presentation will discuss some of the major changes required to support this new Video Core iteration, the challenges we faced in the process and the solutions we provided in order to deliver conformant OpenGL ES and Vulkan drivers. The talk will also cover the next steps for the open source Raspberry Pi 5 graphics stack. (c) Embedded Open Source Summit 2024 April 16-18, 2024 Seattle, Washington (US) https://events.linuxfoundation.org/embedded-open-source-summit/ https://eoss24.sched.com/event/1aBEx

Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...

Igalia

Advantages of Hiring UIUX Design Service Providers for Your Business

Pixlogix Infotech

What are drone anti-jamming systems? The drone anti-jamming systems and anti-spoof technology protect against interference, jamming, and spoofing of the UAVs. To protect their security, countries are beginning to research drone anti-jamming systems, also known as drone strike weapons. The anti-jam and anti-spoof technology protects against interference, jamming and spoofing. A drone strike weapon is a drone attack weapon that can attack and destroy enemy drones. So what is so unique about this amazing system?

What Are The Drone Anti-jamming Systems Technology?

Antenna Manufacturer Coco

Presentation on how to chat with PDF using ChatGPT code interpreter

naman860154

08448380779 Call Girls In Civil Lines Women Seeking Men

Delhi Call girls

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

Imagine a world where information flows as swiftly as thought itself, making decision-making as fluid as the data driving it. Every moment is critical, and the right tools can significantly boost your organization’s performance. The power of real-time data automation through FME can turn this vision into reality. Aimed at professionals eager to leverage real-time data for enhanced decision-making and efficiency, this webinar will cover the essentials of real-time data and its significance. We’ll explore: FME’s role in real-time event processing, from data intake and analysis to transformation and reporting An overview of leveraging streams vs. automations FME’s impact across various industries highlighted by real-life case studies Live demonstrations on setting up FME workflows for real-time data Practical advice on getting started, best practices, and tips for effective implementation Join us to enhance your skills in real-time data automation with FME, and take your operational capabilities to the next level.

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Safe Software

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

Dernier (20)

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

Histor y of HAM Radio presentation slide

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

A Call to Action for Generative AI in 2024

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

Breaking the Kubernetes Kill Chain: Host Path Mount

A Domino Admins Adventures (Engage 2024)

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Boost PC performance: How more available memory can improve productivity

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...

Advantages of Hiring UIUX Design Service Providers for Your Business

What Are The Drone Anti-jamming Systems Technology?

Presentation on how to chat with PDF using ChatGPT code interpreter

08448380779 Call Girls In Civil Lines Women Seeking Men

Powerful Google developer tools for immediate impact! (2023-24 C)

Data Cloud, More than a CDP by Matt Robison

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

How to Troubleshoot Apps for the Modern Connected Worker

CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls

1. Understanding & Managing Discretionary Access The TAO of Entitlement Management Darran Rolls CTO, SailPoint Technologies

8. Chief Technology Officer

9. Chief Information Security Officer

10. Today’s Agenda •  Discretionary Access -  Definition -  Application •  The Spectrum of Authorization -  Static Models -  Dynamic Models -  Blended Models •  Striking the Right Balance -  What Fits Best Where? -  Some General Best Practices…

11. Discretionary Access ?

12. “Passing or Embedding Control for an access control decision”

13.

14.

15. The Spectrum of Discretionary Access

16. Discretionary Access Scale Approval Based - StaticModel Based - Dynamic Access Control Decisions Discretionary Access Scale

17. Discretionary Access Scale Approval Based - StaticModel Based - Dynamic Access Control Decisions Fully Resolvable Policy Based

18. Discretionary Access Scale Approval Based - StaticModel Based - Dynamic Access Control Decisions Partial of Full Human Interaction

19. Discretionary Access Scale Approval Based - StaticModel Based - Dynamic Access Control Decisions Balance of Both

20. Static

21. “Pertaining to or characterized by a fixed or stationary condition” www.dictionary.com

22. “An application access security mechanism, controlled by local configuration” www.darranrolls.com

23.

24.

25.

26.

27. Distributed…

28. Heterogeneous…

29. Static & Isolated…

30. Who has access to what ?

31. Centralized Control !

32. Identity Governance & Administration

33. Identity Governance & Administration Approvals

34. Dynamic

35. “Pertaining to or characterized by energy or effective action” www.dictionary.com

36. “An application access security mechanism, controlled by an external late binding decision making process” www.darranrolls.com

37. Dynamic Models ABAC - Entitlements & Context PIP Attribute Provider VDS PDP System System Target Target PEP PEP Environment Attributes + Rules…

38. Dynamic Models ABAC - Entitlements & Context PIP Attribute Provider VDS PDP System System Target Target PEP PEP Entitlement Giving Attributes… Environment Attributes + Rules…

39. Entitlement Giving Attributes Creating High Fidelity Attributes… High Fidelity Attributes provide assurance that controls and governance are in place to appropriately manage Entitlement Giving Attributes…

40. Dynamic Models ABAC - Entitlements & Context PIP Attribute Provider VDS PDP System System Target Target PEP PEP Environment Attributes + Policies… Policy Review & Attestation…

41. Policy Review & Attestation Maintaining Integrity… Policy Controls provide assurance that once developed and deployed, access policy rules can be considered articles of access attestation with lifecycle controls & audit

42. Dynamic Models ABAC - Entitlements & Context PIP Attribute Provider VDS PDP System System Target Target PEP PEP Attributes… Policies… Governance Visibility… Review… Change Control… Audit…

43. Governance for the Process… Managing Attributes & Policies Visibility • Collection • Categorization • Analytics Review • Approvals • Certification • Policy checks… Change • Delegated Admin • Change Detection • Change Approval Audit • Reporting • Activity • Review Attribute Integrity Reliability Index

44. Blended

45. “To have mixed smoothly and inseparably together.” www.dictionary.com

46. “An application access security mechanism that mixes static & dynamic methods in the end-to-end process.” www.darranrolls.com

47. Just-in-Time Token Authorization with Governance-based Provisioning Attribute Integrity Reliability Index

48. Real-time Approval Dynamic Manual Attribute Integrity Reliability Index

49. Striking a Balance

50. Blended Access Control Models Example

51. IdentityNOWIdentityIQ Thank You! darran@sailpoint.com @djrolls

CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (20)

Similaire à CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls

Similaire à CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls (20)

Plus de CloudIDSummit

Plus de CloudIDSummit (20)

Dernier

Dernier (20)

CIS 2015- Understanding & Managing Discretionary Access: The TAO of Entitlement Management- Darran Rolls