Adding Identity to the Authorization Layer

 In the journey through information security, you will frequently encounter OAuth 2.0. While OAuth is excellent at authorization, it was never actually designed for authentication. To solve this, OIDC, or OpenID Connect, was created.  Think of it this way: OAuth 2.0 is the key to a hotel room, while OIDC is the ID card that proves you are the person who booked it.

oidc-openid-connect

identity rambles....

So if 

the y-axis is access to a system, and the x-axis is access across a network.

The Y access then becomes also access to data on the system, and the x-axis becomes access across the network to data.

If you can quantify the data, then you can assign numbers to number of systems, and then a separate set of numbers to levels of access to each system, Maybe?

How is the user able to prove that their authorized to access the system and the data it contains. 

Okay, zero trust, but how do you do a new user?

How do you establish trust?