...

For an introduction to classification, please refer to An introduction to classifications, taxonomies and typologies.

Classification Objectives

...

Existing Classifications

•  Include literature review on privileged and technical access definitions.

...

What is it that we are trying to classify?

•  Provide here a clear definition of privileged access in the context of this particular note.
•  Include def of pseudo-identities, partial identities and secrets

Dimensions

By definition, a classification must be based on observable properties of population being studied.

•  List candidate dimensions
•  Mention the extent to which dimension categories are mutually exclusive

• Entities using the access (e.g.: Gartner taxonomy)

  • by people

  • by software

    • by dedicated person or shared among multiple persons

• Entities using the access (2)

  • by technical people

  • by business people

• Genesis

  • by system (e.g. “native” accounts)

  • by people (“users” created by admins)

• Scope of privilege

  • Single system

  • Limited set of systems (e.g. cluster admins)

  • Pervasive in the IS (e.g. domain admins)

• Operational constraints

  • Can be deactivated or not

  • Can be renamed or not

  • Can be…

• Level of operational risks

  • This is organization specific

• Software stack level

  • OS

  • Middleware

  • Application

  • Others (e.g. hypervisor)

• IAM superpowers including impersonation

  • None

  • May impersonate some other identities

  • May create other identities

  • May modify other identities, including granting and revoking accesses

  • …

...

User Access Management versus Secret Management

•  Propose candidate classifications

Bibliography

• KPMG, 2018

...

...