Just-in-Time Identity

For more than 15 years, identity and access management (IAM) services and systems have supported various methods to perform the full identity management life cycle. As the name suggests, just-in-time (JIT) identity (not to be confused with "JIT|") enables on-demand, realtime (or near real-time) creation and provisioning of human and nonhuman user identities. It also supports privilege escalation and de-escalation, followed by the deprovisioning, suspension, or termination of those identities across systems.

The following points warrant a closer examination.

• Human and nonhuman users. Aside from direct interaction through input devices (e.g., mouse, keyboard, touchscreen) and removable media (e.g., USB drives), humans do not directly access information assets or system resources. Instead, all interactions occur through software, such as agents, processes, mobile code, or functions built into the systems being used. Nonhuman users may include organizational or functional identities. The increasing use of robots using the internet to "learn" (e.g., via updates to models and their metadata) also expands the scope of nonhuman identity management.
• On-demand, in real time. The speed of modern web-enabled business operations, process control, internet routing, and endpoint use—as well as the expectations of users, organizations and stakeholders-requires that all steps in a jiT identity workflow be executed as quickly as possible. This usually calls for a triage-like model, where fully automated processing handles most identity service requests. Exceptions that do not meet predefined rules are blocked, and the requesting user is advised to seek assistance from an administrator.

• Escalation and de-escalation. Granting temporary privileges is one of the most common and demanding use cases for JIT identity services. Throughout the day, a typical user (human or nonhuman) may initiate processes that perform actions on their behalf, such as creating, modifying, or deleting files. These actions often require temporarily elevated privileges assigned to a specific process ID. (Consider the potential risks if thousands of high-privilege processes were sitting dormant in your system, waiting to execute.)
• Full identity life cycle service. Many use cases require, or are best served by, an on-demand full-service IAM process. For example, a website might require a visitor to register to view additional content. This action creates a new identity instance for the user on that system and grants specific privileges. The user may choose to de-register at any time, which the site may handle by first suspending the identity and then deleting it after an appropriate retention period. This entire process can be fully automated, requiring no individual human decision-making.

JIT identity is also known as just-in-time access, which in some cases emphasizes the act of granting access at a specific moment-often for a single transaction— with a defined set of entitlements (privileges) generated in real time and valid only for that event. JIT identity and access are often implemented using Security Assertion Markup Language (SAML) as part of the underlying framework. End users may or may not be aware that JIT identity and access processes are being triggered behind the scenes when they use single sign-on (SSO) to connect to resources.

JIT identity and access capabilities are found on many world-class platforms such as Azure, Amazon Web Services, Okta, and Salesforce. They provide smooth integration of enterprise applications with social identity providers such as Windows Live, Facebook, Google, Yahoo, Twitter, and Linkedln.

JIT identity strategies and methodologies can help organizations directly enforce least privilege, separation of duties (SoD), and vulnerability management policies:

• Privileged account management (PAM). • Endpoint privilege management. PAM provides the first and perhaps

Endpoint privilege management is most familiar use case. Consider a necessary to prevent malicious or human user identity that is granted accidental attempts to run processes various CRUD (Create, Read, Update, with inappropriate privileges on an Delete) privileges on a back-end endpoint or to use that endpoint to database system. Prior to JIT PAM, the invoke services on other nodes within privileges assigned by the database a network or cloud environment. Both management system (DBMS) and host the physical endpoint device and its logical or virtual instances must be systems were static, effectively active 24 hours a day, every day. Security relied subject to access control and privilege management to ensure effective heavily on the login process to prevent security. JIT PAM applied at the misuse of that identity. In contrast, JIT PAM activates privileges only in real endpoint level can locally enforce time, when the identity requests these policies across all applications access to a specific resource or service. and users on that device, including trusted installer applications.

• Privileged session management. Privileged session management is not just for system administrators! Routine end-user activities on systems involve the use of privileges, with even the lowliest of these-the humble read-being the first step in either a legitimate workflow task or a reconnaissance probe. JIT identity and access capabilities enable finegrained assignment of privileges tied to specific session activities (by means of the user IDs associated with them).
• Remote help desk. Remote help desk operations generally require a trusted agent application working in tandem with an endpoint's operating systemand possibly other applications on that endpoint—to allow support staff to perform actions directly on the device. This is usually done using a generic help desk user ID, so that each endpoint does not require a local superuser or administrator account tied to an individual support technician. However, this model depends on a high degree of mutual trust and assurance. Endpoint users must be confident that the device and its users cannot capture credentials or other sensitive information from the remote help desk session for later misuse. JIT identity and PAM play important toles in enabling this securely.