 have can be incorpo- rated into the processing environment (Figure 9.13). 9.5.2 IDENTITY AND ACCESS MANAGEMENT IAM services are a critical component of any virtualization strategy. As cloud infrastructures dynamically expand and contract, each new node has to be provisioned with appropriate machine and user identities and credentials. In fact, the maturity of cloud-based offerings can often be mea- sured by the level of IAM capabilities and without them these offerings will struggle to be viable for serious business application. All major cloud providers have focused on evolving their IAM implementation. Virtualization adds several additional layers to the IAM ecosystem, which creates both opportu- nities and potential threats. Hypervisors are able to make physical resources available to the VMs and software-defined networking capabilities dynamically create network segments for specific VMs and their virtual interfaces. With all of these layers of abstraction and dynamic configurability the hypervisor and orchestration tools become a prime target for attack. Security modules such as the IAM platform provide critical security capabilities to the ONAP solution. Access management enhancements deliver preventive and detective access controls for the ONAP portal and related front ends. Options for fine-grained authorization capability also exist. For identity lifecycle management, IAM provides user provisioning, access request, approval, and review capabilities and have efficient role design to minimize administrative burden. 9.5.2.1 Identity Ecosystem The identity ecosystem needs to address the security of user, client application, and resource identi- ties (Figure 9.14). Building the Network of the Future Orchestration Layer Access Application Instance Access Token and/or certificate based Token and/or certificate based API authentication API authentication Authorized to manage Authorized to call network hypervisor services Hypervisor Orchestration Application Instance Hypervisor Application Web UI Network Hypervi