Incident Handling and Response and Identity Management

Incident-response processes and tools are, by-and-large, designed to guide reaction to situations within an organization and are geared toward incidents involving local users and systems. With federated identity, we're now expanding this and entering into agreements and relationships that enable an extended community to access our services and our campus constituents to use off-site services in an authenticated and authorized fashion. In this new context, how do you respond when someone from a collaborating organization is hacking your systems? This session will discuss the challenges in the policy, practice, and technology of addressing incident response and mitigation in a federated world.

This is the final report for the 2007 NSF Cybersecurity Summit, held February 22 & 23rd, 2007, in Arlington, VA.

This July 2007 survey is part of a study of identity management and information technology (IT) security in higher education sponsored by CAUDIT in Australasia, by EUNIS in Europe, and by the EDUCAUSE Center for Applied Research (ECAR) in North America. Data from this study will form the basis of a report designed to help institutions position themselves in these evolving areas. Identity management refers to the business processes and infrastructure required to support the use of digital identities. Identity management is not the same as, but is related to, IT security, another top concern of IT leaders in higher education. The survey focuses on the key functions of establishing identity, user authentication, and authorization, as well as supporting infrastructures such as enterprise directory, reduced/single sign-on, and federated identity.