InCommon and REN-ISAC, alongside international partners, strongly urge federation participants to be ready to manage federation-related security incidents. Here’s how.
SIRTFI is an international framework for federated security incident response. It specifies a means to publish your readiness for incident response in federation metadata. This framework asks that each federation entity, ie, Identity and Service Providers, contain security contact information in its federation metadata; that normal security incident response procedures associated with it reasonably address the statements in the SIRTFI specification; and if so, that a SIRTFI tag is attached to the entity.
InCommon recently made self-management of the security contact and SIRTFI flag available in its Federation Manager portal. Participant Site Administrators can now manage SIRTFI status for all systems that are part of the Federation. Please ask them to ensure that your security contact information is correctly expressed in federation metadata and to set the SIRTFI flag if you believe that your security incident response procedures reasonably meet the statements in the SIRTFI specification. Step-by-step instructions are here.
Academic collaborations, cloud services, and other uses depend on sensitive resources, such as unique instruments, software, high performance data processing environments, and corpi of data, being accessible through global federation. Most InCommon participants are home to faculty, students, and staff that need to use these services to be successful in their endeavors. Please help them to succeed by being prepared to manage a federated security incident that could otherwise threaten valuable resources.
Kim Milford
Executive Director, REN-ISAC
Member, InCommon Technical Advisory Committee
Kevin Morooney
Vice President Trust & Identity Services, Internet2
IAM Online
Wednesday, December 13, 2017
2 pm ET | 1 pm CT | Noon MT | 11 am PT
Does your team spend time performing tasks that could/should be (or worse, are) self-service? Do you worry about disconnects between the intention and execution of your IAM policies?
Do your IAM tools require training?
Join us for the IAM Online webinar, “Identities are People, Too: IAM Tooling that Works.” The webinar will take place December 13, 2017, at 2pm ET, and will cover case studies of development efforts (and lessons learned) at Duke to progressively improve interfaces to IAM services, such as:
- Growing an alternate electronic credential service to 180,000 accounts that play nicely with NetID login (and aren't mutually exclusive)
- Delegating account admin and authorization functions to nontechnical staff via interfaces that don't leave room for misinterpretation
- Re-thinking self-service so end users can be partners in managing identity
- A guided registration system for service providers that takes the guesswork (and excuses!) out of Shibboleth integrations
We'll also discuss specific techniques for identifying where users are getting lost in a process, and developing metrics-informed solutions your community can get behind.
Presenter
Mary McKee, Senior IT Manager, Duke University
Connecting: At the time of the webinar, go to the Adobe Connect IAM Online page (slide sharing and audio). See the InCommon website for more details, including back-up phone bridge information.
About IAM Online
IAM Online is a monthly online education series brought to you by Internet2's Trust and Identity community and the EDUCAUSE Higher Education Information Security Council (HEISC).