조직에서 자체 소프트웨어를 사용할 때 IDaaS (Identity as a Service) 사용자와 관련된 가장 큰 보안 위험은 다음 중 어느 것입니까?
정답: B
The greatest security risk associated with the use of identity as a service (IDaaS) when an organization develops its own software is the increased likelihood of confidentiality breach. IDaaS is a model of cloud-based identity and access management (IAM) that provides identity and access services to the users of an organization, such as authentication, authorization, single sign- on, multifactor authentication, and identity governance. IDaaS can offer many benefits to an organization, such as cost reduction, scalability, flexibility, and compliance. However, IDaaS also poses some security risks, such as the increased likelihood of confidentiality breach, which is the unauthorized disclosure or exposure of sensitive or confidential data. When an organization develops its own software and uses IDaaS, it has to entrust the IDaaS provider with the user identity data, such as usernames, passwords, roles, permissions, and personal information. The IDaaS provider may not have adequate security controls or policies to protect the user identity data from unauthorized access, modification, or leakage, either by malicious insiders, external attackers, or third parties. The IDaaS provider may also be subject to different legal or regulatory jurisdictions or obligations, which may compromise the privacy or sovereignty of the user identity data. Therefore, the organization should carefully evaluate the security and trustworthiness of the IDaaS provider, and implement additional security measures, such as encryption, auditing, and contractual agreements, to mitigate the risk of confidentiality breach. Incompatibility with Federated Identity Management (FIM), denial of access due to reduced availability, and Security Assertion Markup Language (SAML) integration are not the greatest security risks associated with the use of IDaaS when an organization develops its own software, as they are either less likely or less severe than the risk of confidentiality breach, or they can be resolved or prevented by using appropriate standards or technologies.
