Abstract:Digital transformation with the adoption of cloud technologies, outsourcing, and working-from-home possibilities permits flexibility for organizations and persons. At the same time, it makes it more difficult to secure the IT infrastructure as the IT team needs to keep track of who is accessing what data from where and when on which device. With these changes, identity management as a key element of security becomes more important. Identity management relates to the technologies and policies for the identification, authentication, and authorization of users (humans, devices) in computer networks. Due to the diversity of identity management (i.e., models, protocols, and implementations), different requirements, problems, and attack vectors need to be taken into account. In order to secure identity management systems with their identities, a systematic approach is required. In this article, we propose the improved framework Taxonomy for Identity Management related to Attacks (TaxIdMA). The purpose of TaxIdMA is to classify existing attacks, attack vectors, and vulnerabilities associated with system identities, identity management systems, and end-user identities. In addition, the background of these attacks can be described in a structured and systematic way. The taxonomy is applied to the Internet of Things and self-sovereign identities. It is enhanced by a description language for threat intelligence sharing. Last but not least, TaxIdMA is evaluated and improved based on expert interviews, statistics, and discussions. This step enables broader applicability and level of detail at the same time. The combination of TaxIdMA, which allows a structured way to outline attacks and is applicable to different scenarios, and a description language for threat intelligence help to improve the security identity management systems and processes.

Identity Threat: A Literature Review and Future Research Agenda Using Theories Context Methodology & Antecedents Decisions Outcomes (TCM & ADO) Framework

Fiends and Fools: A Narrative Review and Neo-socioanalytic Perspective on Personality and Insider Threats

What Do We Know About the Psychology of Insider Threats?

How Do I Know Who You Think You Are? A Review of Research Methods on Organizational Identity

Systematic Literature Review and Metadata Analysis of Insider Threat Detection Mechanism

A systematic literature review on insider threats

Data-driven Artificial Intelligence at the Crossroads: Investigating the Role of Affective Job Insecurity in the relationship between Artificial Intelligence Identity Threat and Employee Well-Being

Job Insecurity: An Integrative Review and Agenda for Future Research

Human Aspect of Threat Analysis: A Replication

Delineating the Boundary of "context" in Information Behavior: Towards a Contextual Identity Framework.

Insight into Insiders and IT: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

Towards an Improved Taxonomy of Attacks related to Digital Identities and Identity Management Systems

Defending Against Identity Threats Using Risk-Based Authentication

Tacit knowledge in organizations: bibliometrics and a framework-based systematic review of antecedents, outcomes, theories, methods and future directions

Identity expressiveness in marketing: review and future research agenda

Insight into Insiders: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

Toxic work climates: An integrative review and development of a new construct and theoretical framework.

A review of social identity theory with implications for training and development

The Challenge-Hindrance-Threat Appraisal Framework and the Differential Effects on Employees' Work Well-Being and Behaviors

Contemporary Threats Countermeasuresi

Exploring workplace Fear of Missing Out (FoMO): A systematic literature review