IT Systems: Identity and Access Management

Objectives

By the end of the course, participants will be able to:

  • Illustrate the identity and access management architecture framework and discuss the security risks associated with its various deployment options
  • Discuss the different mechanisms for establishing strong authentication (e.g. OTP, certificate based authentication, device authentication, etc)
  • Explain the principles of key public infrastructure and certification authorities, and demonstrate their value in mitigating the security risks facing modern societies
  • Explain the most well-known access control mechanisms and the roles of oauth, OATH, SAML and OpenID standards in the IAM domain and apply the concepts of (federated) SSO
  • Demonstrate the building of IAM using selected industrial tools and practical case studies (e.g. e-passport and boarder gate, mobile-banking, EMV scheme, and e-movement services)

Who should attend

This course has been designed for IT professionals such as IT Strategic Planners, Project Managers, Security Managers, Security Architects and Risk Managers.Although the course is technical in nature, complex concepts are discussed at an abstract level to fit the needs of participants from various technical backgrounds.

Outline

  • Introduction and principles of information security:
    • Identity and access management (IAM) overview
    • Attributes of information security:
      • Confidentiality
      • Integrity
      • Availability
      • Non-repudiation
      • Accountability
      • Auditability
    • Symmetric and asymmetric cryptography
    • Hashing and digital signature
    • Key management
  • Public Key Infrastructure (PKI)
    • Architecture: certification and registration authority
    • Life cycle management
    • Types of certificates and usage patterns
      • Encryption
      • Digital signature
      • Client certificate
      • SSL server certificate
    • Attribute based certificate
    • Case studies (e.g. email protection, mobile banking, and document signing)
  • Identification and authentication
    • Identification, verification and authentication overview
    • Mechanisms of identification and authentication
      • One time password
      • Biometric
      • Digital signature
      • Smartcard
      • Soft/hard tokens
    • Mobile device
    • Risk based authentication
    • Step-up authentication
    • Single-sign on and federated single-sign-on
    • OATH, OpenID, BorwserID, and SAML
    • Architecture framework and industrial tools
    • Trusted computing role in identity assurance
    • Security risks associated with the discussed mechanisms
  • Access control
    • Principles of authorization
    • Access control schemes
    • OAuth protocol
    • Enterprise rights management and digital rights management
    • Privileged account management
    • Governance and compliance
  • IAM framework and use cases
    • IAM architecture framework
    • IAM echo system
    • IAM and cloud computing
    • Illustrative use cases
      • Border control
      • E-passport
      • National ID
      • E-banking
      • E-health system
      • EMV scheme

Training Methodology:
This interactive training course includes the following training methodologies as a percentage of the total
tuition hours:-
• 30% Lectures, Concepts, Role Play
• 30% Workshops & Work Presentations, Techniques
• 20% Based on Case Studies & Practical Exercises
• 20% Videos, Software & General Discussions

Certificates

A Certificate of Completion will be issued to those who attend & successfully complete the programme.

Schedule

  08:30 – 10:15 First Session

 10:15 – 10:30 Coffee Break

10:30 – 12:15 Second Session

 12:15 – 12:30 Coffee Break

12:30 – 14:00 Third Session

 14:00 – 15:00 Lunch

 Fees

 The Fee for the seminar, including instruction materials, documentation, lunch, coffee/tea breaks & snack is: