- [Instructor] In every identity
and access management solution,
users must be given initial credentials
when they are created in the system as entities.
The registration process
includes gathering information about a user
and creating a corresponding entity in the system.
The identity proofing process
ensures that the user presenting himself
or herself for registration is who they claim to be.
Let's take a look inside these processes.
Registration consists of four steps.
First, someone must make a request
for the creation of a new entity in the system.
For example, a hiring manager might initiate a request
to create an entity for a new employee
once that new employee accepts the job offer.
Second, someone must approve the request.
This person should be someone different from the requester.
An approval authority should be clearly defined
in the organization's security policy.
In the example of hiring a new employee,
the request may require approval by a department manager
or if the requester is the department manager,
a higher level leader.
Third, the registration authority performs identity proofing
and other checks as required by policy.
The registration authority is typically a centralized role
and it's often found in human resources departments.
I'll return to explore identity proofing
in greater detail in a moment.
Finally, someone actually issues the credentials
to the individual.
In many organizations,
this may be done by the registration authority,
but best practice dictates that it is a fourth individual
involved in the process.
Separation of duties is extremely important
during the registration process.
Involving four different people
reduces the likelihood of error
and the likelihood of fraudulent activity.
For example, separating the requester and approver roles
ensures that two different individuals in the organization
agree that a new entity should be created.
If the requester creates a request
for someone who is not being hired,
the approver should catch that and block the action.
It's unlikely that this type of fraud
will be detected later in the chain
because registration and issuing steps
are often performed by central organizations
that may not know the individuals involved.
Similarly, separating those two roles
from the identity proofing role
ensures that an independent party is performing the checks.
The identity proofer can verify
that the requester and approver
were authorized to perform those actions
and independently verify the identify of the entity.
Finally, separating the identity proofer and issuer roles
provides a final check on the process.
The issuer can verify that all of the steps were followed
before providing credentials to the individual.
Identity proofing is an important step in this process.
Once an individual has credentials,
he or she may use them as proof of identity.
Therefore, during the issuing process,
the organization must take extra care
to ensure that they accurately verify
the individual's identity
before granting him or her those credentials.
The level of identity proofing performed
will vary from organization to organization
and may include both identity verification
and background check processes.
For example, NIST suggests including the presentation
of two forms of photo identification.
These forms of identification
should be approved identity documents
from the list of acceptable sources
maintained by the US Customs and Immigration Service.
They include driver's licenses, state IDs,
passports, military IDs, school IDs, and similar documents.
Identity proofing may also include fingerprinting.
This may be overkill
for most non-governmental organizations,
but government agencies often use fingerprinting
to check against criminal and military records
to see if those fingerprints match an undisclosed identity.
And finally, identity proofing
sometimes includes background checks.
While government agencies may perform
highly intrusive background checks for sensitive positions,
most companies perform at least a criminal background check.
Upon completion of the identity proofing process,
the organization has a high degree of confidence
in the individual's identity and can issue credentials.