Certain codes of conduct must be observed legally, and if not legally at the moment, then certainly on a moral basis.
Cloud computing services that don’t observe these codes do so at their peril.
In working with IDaaS software, evaluate IDaaS applications on the following basis:
- User control for consent: Users control their identity and must consent to the use of their information.
- Minimal Disclosure: The minimal amount of information should be disclosed for an intended use.
- Justifiable access: Only parties who have a justified use of the information contained in a digital identity and have a trusted identity relationship with the owner of the information may be given access to that information.
- Directional Exposure: An ID system must support bidirectional identification for a public entity so that it is discoverable and a unidirectional identifier for private entities, thus protecting the private ID.
- Interoperability: A cloud computing ID system must interoperate with other identity services from other identity providers.
- Unambiguous human identification: An IDaaS application must provide an unambiguous mechanism for allowing a human to interact with a system while protecting that user against an identity attack.
- Consistency of Service: An IDaaS service must be simple to use, consistent across all its uses, and able to operate in different contexts using different technologies.
Comments