IDEF Common Security Profile, v1.0
Profile of Identity Ecosystem Framework (IDEF) security requirements that apply to all organizational entities participating in the Identity Ecosystem.
| Identifier | https://artifacts.trustmarkinitiative.org/lib/tips/idef-common-security-profile/1.0/ | ||||
| Publication Date | 2018-10-01 | ||||
| Issuing Organization |
Trustmark Initiative (https://trustmarkinitiative.org/)
View Contact
|
||||
| Keywords | IDEF, Identity Ecosystem Framework, Security | ||||
| Legal Notice | This artifact is published by the Georgia Tech Research Institute (GTRI) as part of the Trustmark Initiative. This artifact and the information contained herein is provided on an "AS IS" basis, and GTRI disclaims all warranties, express or implied, including but not limited to any warranty that the use of the information herein will not infringe any rights or any implied warranties or merchantability or fitness for a particular purpose. In addition, GTRI disclaims legal liability for any loss incurred as a result of the use or reliance on the document or the information contained herein. |
Loading...
Trust Expression:
TD_IDEFSecurityPractices and TD_IDEFDataIntegrity and TD_IDEFAuthenticationRiskAssessment and TD_IDEFUptime and TD_IDEFKeyManagement and TD_IDEFSecurityLogs and TD_IDEFSecurityAudits
References (7)
| TD IDEF Security Practices, v1.0 | |
|---|---|
| Description | Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement SECURE-1: SECURITY PRACTICES. |
| ID | TD_IDEFSecurityPractices |
| Provider Reference | |
| TD IDEF Data Integrity, v1.0 | |
|---|---|
| Description | Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement SECURE-2: DATA INTEGRITY. |
| ID | TD_IDEFDataIntegrity |
| Provider Reference | |
| TD IDEF Authentication Risk Assessment, v1.0 | |
|---|---|
| Description | Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement SECURE-9: AUTHENTICATION RISK ASSESSMENT. |
| ID | TD_IDEFAuthenticationRiskAssessment |
| Provider Reference | |
| TD IDEF Uptime, v1.0 | |
|---|---|
| Description | Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement SECURE-10: UPTIME. |
| ID | TD_IDEFUptime |
| Provider Reference | |
| TD IDEF Key Management, v1.0 | |
|---|---|
| Description | Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement SECURE-11: KEY MANAGEMENT. |
| ID | TD_IDEFKeyManagement |
| Provider Reference | |
| TD IDEF Security Logs, v1.0 | |
|---|---|
| Description | Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement SECURE-14: SECURITY LOGS. |
| ID | TD_IDEFSecurityLogs |
| Provider Reference | |
| TD IDEF Security Audits, v1.0 | |
|---|---|
| Description | Specifies requirements in accordance with Identity Ecosystem Framework (IDEF) requirement SECURE-15: SECURITY AUDITS. |
| ID | TD_IDEFSecurityAudits |
| Provider Reference | |
Sources (1)
| IDEF | Identity Ecosystem Steering Group. Identity Ecosystem Framework (IDEF) Baseline Functional Requirements v1.0 with Supplemental Guidance. Approved on 15 Oct 2015. https://www.idesg.org/portals/0/documents/core/IDEF-Baseline-Requirement-v1.0-with-Supplemental-Guidance_MOD.pdf. |
Terms (12)
| Term Name | Abbreviations | Definition |
|---|---|---|
| Anonymous | An interaction designed such that the data collected is not sufficient to infer the identity of the user involved nor is such data sufficient to permit an entity to associate multiple interactions with a user or to determine patterns of behavior with a user. | |
| Digital Identity Management Function | Any of the functions described in the IDESG Functional Model (registration, credentialing, authentication, authorization, and intermediation), which also encompass enrollment, identity proofing, identity vetting, access control, attribute management, transaction processing, and identity data maintenance. | |
| Entity | Any organization providing identity services. | |
| Identifier | A number or other non-attribute designation designed to specify an individual or set of individuals in a system. | |
| Identity Ecosystem Framework | IDEF | The overarching set of policies, best practices and standards that serve as the policy foundation for the Identity Ecosystem. |
| Identity Ecosystem Steering Group | IDESG | A voluntary, public-private partnership dedicated to developing an Identity Ecosystem Framework (IDEF) and services to better online digital identity. The IDESG looks to advance the Identity Ecosystem called for in the National Strategy for Trusted Identities in Cyberspace (NSTIC). |
| Nonproprietary Published Format/Specification | A known and consistent format that is published and transparent to all relying parties and identity providers in the relevant network, and is not controlled by a commercial interest. | |
| Personal Information | Broadly means any information about or linked to a user that is collected, used, transmitted, or stored in or by digital identity management functions. | |
| Pseudonymous | An interaction designed such that the data collected is not sufficient to allow the entity to infer the user involved but which does permit an entity to associate multiple interactions with the user's claimed identity. | |
| Redress | When (a) an entity offers an opportunity for a party who is transacting with it to complain or ask for adjustment, if the transaction is unsatisfactory to that other party; and (b) the entity responds clearly to each request of that kind; and (c) if the request relates to the entity's failure to comply with the IDESG Baseline Requirements, the entity cures the failure to comply, or provides a remedy for the failure. | |
| User | In usability statements, refers to an individual human being. This does not include machines, algorithms, or other non-human agents or actors. Equivalents and related terms may include: user- centric, user-centered, human-centered, end user, individual user, user-friendly. In security statements, may refer either to an individual natural person, or to an entity such as a company or agency: Various security requirements may confer opportunities, rights or remedies on a party or account which is served by a cybersecurity function, whether that account relates to a single human or to an organization. |
|
| User-Centric | Systems, design and/or program processes that put the individual human being at the center of the activity. Equivalents and related terms may include: user, user-centered, human- centered, end user, individual user, user-friendly. |