How to build Identity and Access Management In Cloud

Ask a CIO what her top concerns are with cloud computing , and he's almost certainly going to list security as his #1 concern. Cloud Security is a very big issue. At least, it's a very big perceived issue. Though there are several aspects to Cloud security one key aspect is identity and access management. . In case of multiple clouds system administrators spend too much time to create cloud accounts for new users and may forget to terminate accounts for ex-users. User activity without oversight or authorization leads to risk of sensitive data loss and compliance violations. Systems with sensitive or regulated data may be vulnerable without additional layers of protection. 

Federated Identity management is therefore becoming increasingly important as it allows companies to enforce access control policies across multiple applications in a consistent manner, which provides an overall reduced cost of implementation.

As enterprises shifted toward cloud-based services at the turn of the century and software-as-a-service (SaaS) applications became more prevalent, the domain-based identity and access management mechanisms began breaking. This shift created a new need for a secure connection to multiple applications outside of the enterprise perimeter and transformed the perception on identity management.
As enterprises continue to adopt cloud-based technologies outside of their network perimeter, the need for reliable identity management solutions becomes more vital. To address these new use cases, organisations planning to adopt cloud architecture must also create a roadmap to move to  new ways handling identity and access  with cloud.

A good starting point for building a cloud security architecture is the security architecture reference in TOGAF. 

A TOGAF iteration should then be “Cloud Identity and Access”. The Enterprise Architecture team drives the programme and works collaboratively with both the business and the IT department.
For purpose of this blog we limit the scope to identity and access management issues of cloud security.

In the Preliminary Phase a cloud security policy should be in place. A carefully crafted cloud security policy document should answer these questions

• How well does the cloud provider’s security policies and procedures align with the organisation?
• For applications in the cloud, who within the organisation is allowed to modify settings on the cloud that affect performance? 
• How should administrative privileges to the cloud provider be managed? 
• How user consent must be taken care of for storing his data in cloud
• How interoperability of multiple identity providers can be managed?
• How to provide consistent experience across context?
• How user data should and access should be removed once the user is no longer a part of the organisation?

In Architecture Vision Phase define necessary security-related management sign-off milestones of this architecture development cycle. This must also include sign offs with cloud service providers and identity and access providers and determining trust boundaries

Determine and document applicable disaster recovery or business continuity plans/requirements

Any existing disaster recovery and business continuity plans must be understood and their relationship with the planned system defined and documented.Disaster recovery would involve replicating an entire site, including the identity repositories, in addition to replacing hardware or subcomponents.

Identify and document the anticipated physical/business/regulatory environment(s) in which the system(s) will be deployed. All regulations regarding storage of user information in cloud must be clearly understood

In Phase B:Business Architecture set up the businesses process for identity and access management

Identify roles and actors related to user and authorization management.

Determine access levels of users.

In Phase C: Data Architecture, Identity repositories, in particular may be an issue for cloud computing as it pushes information back into siloes, that IT may not have direct access to. It is also recommended to determine user data and privacy classification and to prioritise the risk criteria of what goes in the cloud and what stays on-premise.

During Phase E and F there is a need to focus on these key aspects of Identity and access management

Directory:  Identify a central directory for linking user groups to SaaS.

Access: Integrate externalized access technology with your centralized directory.

User provisioning & de provisioning: The provisioning of new accounts and user profiles

Federation: A common set of policies, practices and protocols in place to manage the identity and trust into IT users and devices across organizations

Audit:  Track user access and actions

A sound architecture will enable re usability of identity and access services for all use cases in public, private and hybrid cloud models. Federation architecture is the first step to identity management to evolve for the cloud to become a trusted computing platform. Organizations thus must have clear roadmap for it before embarking into cloud computing.

Modeling Cloud Architecture with TOGAF

Cloud computing has emerged as one of the most significant game changers to hit the technology landscape in the recent years.However, the explosion of cloud computing has been a bit of a catch 22 for many enterprises.They  are often struggling to understand the benefits of cloud computing as it appears totally disruptive to their current approach to IT operations.
Enterprise Architects will have a crucial role in cloud adoption strategies for enterprises. Enterprise Architecture deals with the whole enterprise and not only on the IT part, but also it involves the business side. Subsequently EA is for business and IT alignment. Now as Cloud is being presented as the most versatile technology in the IT field, there is greater need among enterprise architects to quickly understand transformations being brought in by the Cloud principles and to do the required twist and tweak on the EA. Increasingly enterprise architects are tasked to tune their EA to be Cloud-ready. 

As most enterprise architects are familiar with TOGAF it is a good starting point to model your cloud architecture roadmap. The TOGAF ADM can help immeasurably in arriving at a viable Cloud strategy that leads to closer business – IT alignment. 

As next-generation services and applications have to be analyzed, architected, and constructed for the cloud landscape from the ground up, the top down approach would be most logical approach.We discuss here the specific steps which need to be adapted in TOGAF for building cloud architectures

Preliminary Phase: -

Identify and Establish Architecture Principles
The architecture principles are an important anchor when establishing the architecture governance. Some Cloud specific architecture principles could be 

• Small stateless services
• Use Scalable Ingredients
• Use Resource Pooling
• Support Multi-Tenancy

Tailoring Of TOGAF Architecture  Views for Cloud Applications
While  TOGAF ADM is one of  the very good approach to architect and design Cloud Applications from top down perspective,but the architectural views defined in this framework need to be twisted and tweaked in order to simplify and streamline cloud enablement. Cloud specific terminologies like 'Virtualization' 'SAAS' 'PAAS' 'IAAS' needs to   incorporated as a part of terminology tailoring.

Architecture Vision: -

The high-level description produced in Phase A will reflect the cloud based nature of the architecture that is envisaged. 

Stakeholders, Concerns, and Business Requirements

There are some concerns that are specific to Cloud in terms of data security , privacy , and transparency which needs to be identified.

Assess Readiness for Business Transformation

Quantify the enterprise’s readiness to undergo changes due to cloud model.
Extend Business Transformation Readiness Assessment of TOGAF to include cloud specific assessments.

• Is the business prepared to account for IT or applications to be metered out as a service? 
• How will processes for change and release fare when allowing certain user groups to self-provision resources? 
• How will compliance controls perform in a highly automated virtual world of shared resources?   
• What business use cases might benefit most from implementing an internal cloud?
• Is your IT Operations ready to adopt IT Service Management?

Business Architecture

While the overall business goals of a cloud enabled application will not change, the Business users themselves will be variable in a multi tenant scenario and hence this view may needs to be adjusted for different groups that the Cloud service will cater .  Especially the questions like  Who Does It, What Do They Do will change for Cloud Applications when compared to traditional enterprise applications.

Business applications are typically delivered from enterprise server machines. Now with the emergence of powerful and affordable cloud servers, business services and applications are to be deployed and delivered from the new environment. The business architecture has to take care of security, privacy, and other quality attributes of cloud-based applications. Governance, visibility, and controllability are other important factors to be given a serious thought. There has to be a kind of synchronization between enterprise resources and cloud-based applications.

Data Architecture

The core Entity Relationship modeling of a cloud application may match that of its  traditional enterprise application counterpart , however  multi tenancy aspect will introduce new variations to the Logical Data Model. Data Security View  will be totally different from a traditional enterprise application.

Application Architecture

Applications to be cloud ready have to undergo some critical changes. The PaaS Platform will abstract several traditional components that are part of the Application Architecture View and hence this view will be different from a traditional enterprise application. This includes custom-built shelf software to be converted into SaaS.  

Technology Architecture

Due to the tenants of cloud application like virtualized server environment ,PaaS platform ,On-demand instances and other virtual storage considerations, this view will be the one that will go through maximum changes for a cloud application when compared to a normal application. 



We see that bringing cloud capabilities to an enterprise is about more than just the latest technology; it is about changing the traditional business and collaboration model with partners, customers, and providers of services to the enterprise.