Web Access Management

Web Access Management is a subcategory of the broader Identity management space. Web Access Management controls access to Web resources, providing:
* Authentication Management
* Policy-based Authorization
* Audit & Reporting Services (optional)
* Single sign-on Convenience

Authentication Management is the process of determining a user’s (or application’s) identity. This is normally done by prompting for a user name and a password. Additional methods of authentication can also include Access tokens (which generate one-time passwords) and digital certificates.

Once a user’s (or process’) identity is confirmed, Policy-based Authorization comes into play. A Web resource (such as http://www.foo.com/admin) can have one or more policies attached to it that say “only allow internal employees to access this resource” and/or “only allow members of the Admin Group to access this resource." The requested resource is used to lookup the policy, and then the policy is evaluated against the user’s identity. If the user passes the policy evaluation, she/he is granted access to the resource. If the user fails the evaluation, access is denied.

After an authentication or authorization policy decision is made, the outcome can be recorded for auditing purposes, such as:
* determining the last login time of a user
* identifying attempts to gain access to protected resources
* logging any administrative actions

As a benefit to the end user, a Web Access Management product can then tie this security together (which is more of a benefit to IT and administrative staff), and offer Single Sign On. Single Sign On is the process by which a user logs in only once to a Web resource, and then is automatically logged in to all additional related and protected resources. Users can be inconvenienced when attempting to get authenticated to multiple websites throughout the course of a day (potentially each with different user names and passwords). A Web Access Management product can record the initial authentication, and provide the user with a cookie that acts as a temporary token for authentication to all other protected resources, thereby only allowing the user to log in once.

History

Web Access Management products originated in the late 1990s, and were then known as Single Sign On. Two of the original products were Computer Associates Siteminder and Oblix Access Manager. These products were simple in their functional capabilities, but solved an important issue of the time – how to share user credentials across multiple domains without forcing them to log in more than once. The challenge stemmed from the fact that cookies are domain-specific, so there was no simple way to seamlessly transfer a user from one website to another. Since then, Single Sign On has come to mean technology that lets users store all of their passwords in a browser plugin which auto-fills login screens for them (such as RoboForm). The new term became known as Web Access Management, because products in this space added the functionality of controlling which resources (Web pages) a user could access, in addition to authenticating them.

Architectures

There are two different types of architectures when it comes to Web Access Management architectures: plug-in (or Web agent) and proxy.

Plugins are programs that are installed on every Web/application server, register with those servers, and are called at every request for a Web page. They intercept the Web request in order to make a policy decision and communicate with an external policy server in order to make these decisions. One of the benefits of a plugin(or agent) based architecture is that they can be highly customized for unique needs of a particular Web server. One of the drawbacks is that a different plugin is required for every Web server on every platform (and potentially for every version of every server). Further, as technology evolves, upgrades to agents must be distributed and compatible with evolving host software.

Proxy-based architectures differ in that all Web requests are routed through the Proxy server to the back-end Web/application servers. One of the benefits of a proxy-based architecture is a more universal integration with Web servers since the common standard protocol, HTTP, is used instead of vendor-specific Application programming interfaces (APIs). One of the drawbacks is that additional hardware is usually required to run the proxy servers.

Solutions like CA Siteminder typify the agent-based approach; maXecurity from P2 Security employs a proxy approach.

Costs

It is often underestimated how much a Web Access Management system truly costs. In most cases, the annual maintenance costs dwarf the purchase price. For example, when policy servers are used (in both the plugin and proxy-based architectures), high-end hardware is needed in order to efficiently run the WAM infrastructure. Users will give up on accessing a Web page if it takes more than several seconds to respond [http://en.wikipedia.org/wiki/World_Wide_Web#Speed_issues] .

Centralized administration is an additional hidden cost, because customers will need to hire and train staff to exclusively manage policy entitlements for the underlying Web applications. A final hidden cost relates to regulatory compliance. Since WAM is similar in concept to a Firewall (more closely aligned to an application-layer firewall), it must be able to handle major audit requirements, especially for public companies subject to the Sarbanes-Oxley Act (not to mention those that are bound by the Health Insurance Portability and Accountability Act, PCI, or CPNI). Larger companies spend tremendous amounts of time and money auditing these WAM infrastructures since they are the enforcement points for so many of internal and external applications.

Proxy-based architectures have been shown to significantly reduce the initial and recurring costs of WAM.

External References

* [http://mediaproducts.gartner.com/reprints/ca/152046.html Gartner Magic Quadrant for Web Access Management, 2H07]
* [http://whitepapers.pcmag.com/option,com_categoryreport/task,viewabstract/title,1236/id,17/cat,153/pathway,no/ The Importance of Web Access Management Systems - PC Magazine]
* [http://www.rsa.com/glossary/default.asp?id=1059 web access management | RSA Information Security Glossary]