ISO/IEC 24760-3-2016 pdf free.Information technology一Security techniques一A framework for identity management-Part 3:Practice.
Clause 5 presents practices to address identity related risk when operating an identity management system conforming to ISO/IEC 24760-1, ISO/IEC 24760-2 and ISO/IEC 29115.
5.2 Risk assessment
One function of an identity management system is to manage the risk of identity errors, and the confidentiality, integrity and availability of identity information that it stores, processes and communicates. It is necessary to understand the level of risk, which will depend on the application. The owner of the application should conduct a risk assessment to determine the level of risk. The result will provide information, which can be used to determine the necessary risk management criteria and processes for the identity management system. The information an identity management system needs includes the level of assurance in identity information required and the requirements for confidentiality, integrity and availability of this information.
ISO/IEC 24760-2 specifies tools to manage risks as policies, regulation, design and architecture. In some contexts involving consumers, protecting personally identifiable information and giving principals control over the use of their personally identifiable information is paramount. ISO/IEC 29100, ISO/IEC 29101, ISO/IEC 29134 and ISO/IEC 29151 (to be published) specify requirements and provide guidance for the protection of privacy.
Identity information managed by an identity management system may also be managed by reference to identity information providers in another domain. For example, identity proofing may be undertaken by a service provider, which operates in a different domain to that of the identity management system.
When identity information is collected and stored, risk management measures shall be implemented by the identity management service to mitigate the risks identified by a risk assessment carried out in the application domain by the relying party. Levels of assurance in regard to identity information and access services shall be determined and specified by the relying party according to assessed levels of risk.
5.3 Assurance in identity information
5.3.1 General
Confidence in identity information provided by an identity management system comes from processes that assure the validity of the Information from Its collection through its subsequent storage and maintenance by the system. Assurance is typically quantified in terms of assurance levels with higher levels corresponding to greater assurance. The level of assurance achieved depends on the quality of the identity information and the rigour of the identity validation processes. Levels of assurance are described in ISO/IEC 29115.
5.3.2 Identity proofing
Identity proofing. i.e. validating identity information for enrolment of an entity in a domain, shall meet a defined level of assurance. The level of assurance of identity proofing achievable depends on the type and characteristics of information and, in some case, the scope of this information, e.g. the number of independent identity information providers used as sources of the information.
An increased level of assurance in identity verification may be achieved
— with verification of additional credentials issued from multiple sources, and
— using a trusted external party that knows the entity to validate claimed identity information.
NOTE 1 ISO/IEC 29003 provides requirements for identity proofing.
NOTE 2 ISO/IEC 29115 specifies how to achieve different levels of assurance.
5.3.3 Credentials
An identity management system may issue multiple types of credential differing in the level of assurance of the identity information represented by the credential.
An identity management system issuing credentials with a high level of assurance supported by a cryptographic mechanism should provide a service for relying parties to actively support the cryptographic validation process.
5.3.4 Identity profile
An identity management system may use one or more identity profiles for gathering, structuring, or presenting identity information.ISO/IEC 24760-3 pdf download.