Identity First - Revision history

Tom: /* References */

2025-09-08T23:31:46Z

‎References

2025-08-06T21:34:04Z

‎Focuses on Use Cases Instead of IAM Silos

2023-10-09T18:37:13Z

‎Full Title or Meme

2023-10-09T18:34:19Z

‎Context

2023-10-05T05:17:29Z

‎Overview of Gartner Report

2023-10-05T05:15:19Z

‎Other Material

2023-10-05T05:14:00Z

‎Other Material

2023-10-05T05:12:47Z

‎Other Material

2023-10-05T05:11:12Z

‎References

2023-10-05T05:10:29Z

‎Problems

← Older revision		Revision as of 23:31, 8 September 2025
Line 134:		Line 134:
	* [https://www.idsalliance.org/blog/sensible-2022-resolutions-for-behavioral-aware-identity-first-security/ Sensible 2022 Resolutions for Behavioral-Aware, Identity-First Security, Identity Defined Security Alliance (IDSA).]		* [https://www.idsalliance.org/blog/sensible-2022-resolutions-for-behavioral-aware-identity-first-security/ Sensible 2022 Resolutions for Behavioral-Aware, Identity-First Security, Identity Defined Security Alliance (IDSA).]
	* [https://www.idsalliance.org/white-paper/the-path-to-zero-trust-starts-with-identity/ The Path to Zero Trust Starts With Identity, IDSA.]		* [https://www.idsalliance.org/white-paper/the-path-to-zero-trust-starts-with-identity/ The Path to Zero Trust Starts With Identity, IDSA.]
		+
		+
		+	[[Category: Language]]
		+	[[Category: Identifier]]

@@ Line 61: / Line 61: @@
 How to Apply Consistent Principles to Identity-First Security
-Identity-first security requires centralized policies that need to be extended to decentralized assets. In order to control access to decentralized, distributed digital assets in a consistent manner, IAM leaders must combine centralized IAM controls, policies, data and programs with decentralized and context-sensitive enforcement.
+Identity-first security requires centralized policies that need to be extended to decentralized assets. In order to control access to decentralized, distributed digital assets in a consistent manner, IAM leaders must combine centralized IAM controls, policies, data and programs with decentralized and context-aware enforcement.
 Examples of centralized infrastructure across a distributed environment include:
 * Access to multiple SaaS applications

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-This seems to be a rebirth of Kerberos, which put [[Identity First]] but then allowed a ticket to be passed around inside of the [[Enterprise]] perimeter so long as the subject sign-in was active.
+This seems to be a rebirth of [[Kerberos]], which put [[Identity First]] but then allowed a ticket to be passed around inside of the [[Enterprise]] perimeter so long as the subject sign-in was active.
 ==Context==

@@ Line 3: / Line 3: @@
 ==Context==
-If we add zero trust principles we need to verify every request which basically means that the ticket is maintained inside a client computing device, like a [[Smartphone]] we are no longer dependent on the [[Enterprise]] perimeter for security. If subject context is maintained in the [[Smartphone]], then we have some confidence that the subject is the person making the request
+If we add zero trust principles we need to verify every request which basically means that the ticket is maintained (or regenerated) inside a client computing device, like a [[Smartphone]] we are no longer dependent on the [[Enterprise]] perimeter for security. If subject context is maintained in the [[Smartphone]], then we have some confidence that the subject is the person making the request
 ===Taxonomy===

@@ Line 25: / Line 25: @@
 * ZTNA = Zero trust network access
-==Overview of Gartner Report==
+==Summary of Gartner Report==
 The following is abstracted from ''Identity-First Security Maximizes Cybersecurity Effectiveness'' by Rebecca Archambault+3 as a Gartner Report (2022-12-02) https://www.gartner.com/doc/reprints?id=1-2CH5EQIC&ct=230203&st=sb
 ===Key Findings===

@@ Line 131: / Line 131: @@
 <references />
 ===Other Material===
-* Identity-first security was introduced by Gartner in early 2021 in [javascript:void(0);ZTop Security and Risk Management Trends 2021, and is often discussed in client inquiries and vendor briefings.
+* [https://www.securitymagazine.com/articles/98254-5-minutes-with-david-mahdi-establishing-digital-trust-with-identity-first-security 5 Minutes With David Mahdi — Establishing Digital Trust With Identity-First Security, Security magazine.]
 * [https://www.idsalliance.org/blog/sensible-2022-resolutions-for-behavioral-aware-identity-first-security/ Sensible 2022 Resolutions for Behavioral-Aware, Identity-First Security, Identity Defined Security Alliance (IDSA).]
 * [https://www.idsalliance.org/white-paper/the-path-to-zero-trust-starts-with-identity/ The Path to Zero Trust Starts With Identity, IDSA.]

@@ Line 134: / Line 134: @@
 * 5 Minutes With David Mahdi — Establishing Digital Trust With Identity-First Security, Security magazine.
 * Sensible 2022 Resolutions for Behavioral-Aware, Identity-First Security, Identity Defined Security Alliance (IDSA).
-* The Path to Zero Trust Starts With Identity, IDSA.
+* [https://www.idsalliance.org/white-paper/the-path-to-zero-trust-starts-with-identity/ The Path to Zero Trust Starts With Identity, IDSA.]

@@ Line 124: / Line 124: @@
 ===Problems===
 * Legacy IAM architecture continues to lack flexibility and full interoperability (which are necessary properties of an identity fabric).
-* IAM maturity continues to average an IT Score of 2.4 out of 5,1 which implies that most organizations continue to struggle to meet basic identity controls and still have automation challenges.
+* IAM maturity continues to average an IT Score of 2.4 out of 5,<ref>Gartner ''Infographic: Cross-Industry Benchmark Comparison of IT Score for Data and Analytics'' (2021-99-08) https://www.gartner.com/en/documents/4003368</ref> which implies that most organizations continue to struggle to meet basic identity controls and still have automation challenges.
 * Risk tolerance acceptance decisions need to be agreed on at an enterprise level. Often, policy decisions are made within security and IT, without involving the wider organization (see Predicts 2022: Identity-First Security Demands Decentralized Enforcement and Centralized Control).
 * As discussed in  Hype Cycle for Digital Identity, 2022, CAEP is a new standard, and is still not commonly known and understood by IAM experts.
 ==References==
 * Identity-first security was introduced by Gartner in early 2021 in [javascript:void(0);ZTop Security and Risk Management Trends 2021, and is often discussed in client inquiries and vendor briefings.