Page 145 - CISSO_Prep_ Guide

Many privacy laws today require an organization to maintain a
sound system of record (ASOR) for any person that accesses
private information. This is used to identify anyone looking at
data that they do not need to be looking at as a part of their job
responsibilities.

Identity Management
The world of identity management is much more complex and
challenging than it was a few years ago. Before the development
of websites and online services, the only people on the systems
of an organization, with a few exceptions, were its own
employees. Employees were people the organization could train,
monitor, and, in some cases, discipline. Nowadays, most of the
users on an organization's systems are customers, clients, or
business partners.

And in most cases, they are logging in from systems that cannot
be trusted. Sometimes even over an independent and vulnerable
network (the internet) and may be located anywhere in the world
and, therefore, not even subject to the same laws, ethics, or
cultural standards. These are people that cannot be controlled,
and it is impossible to enforce most security standards that
would be mandated for the employees of the organization.

The challenges related to identity management apply at all levels
of the security model - at the hardware, network, application,
database layers, and in all departments and across all lines of
business. This requires a unified approach to managing the
identities of the users that sets out consistent standards for all
users of all systems and from all locations. A poorly set up