Resource Risk Based Authentication Token Mobile Device Possession Certificate Behavior Patterns Angle Finger Pattern FIGURE 9.15 Authentication approach. Network Security Employee Customer Vendor FIGURE 9.16 End user identity classes. Multifactor authentication with focus on biometric and possession-based factors Risk-based analysis to override static authentication policies as needed Attribute-based access control (ABAC) and risk-based access control (RBAC) to simplify management of entitlements and limit access creep. Figure 9.16 highlights the usual user identity classes: Employees and contractor. This category is structurally very hierarchical and includes a broad range of entitlements including ABAC/RBAC policies. Customer: Consumer (Business to consumer [B2C]) identities have limited hierarchies but are more complex from peering (friend concept) perspective Business customer (Business to business [B2B]) identities range from small and sim- ple for a small business to hierarchical and complex for a large signature customer Vendor. These identities allow a vendor to access and often support implementations of their solutions. 9.5.2.3 Client Application Identity Each of the business applications needs to be approved for specific access (least privilege) into the control layer. For client credential access patterns, each application instance must have unique creden- tials, issued at installation and ideally via automated orchestration. The preferred access pattern for client applications that needs to access resource APIs, is the use of resource credentials that are issued by an authorization server as in OAuth 2.0 implementations. Ideally, this solution Has authenticated the client application If possible, authenticated the end user Verified basic authorization and issued unique resource credentials for the specific requesting client application instance 9.5.2.4 Resource Identity This identity is used to target a specific resource. Associated attributes such as IP address as the net- work identity, can be dyna