IAM definition
Identity and access management (IAM) is referred to in the I.T industry as a framework of business processes, policies and technologies that facilitates the management of users’ identities. It focuses on the processes we use to provision and de-provision user identities, the ongoing management of the roles and access privileges of individual network users and the circumstances in which users are granted (or denied) those privileges. Once that digital identity has been established, it must be maintained, modified and monitored throughout each user’s “access lifecycle.”
Information systems are becoming muti-cloud based and moved off-premise which is increasing the complexity of Identity and Access Management. Typically IAM would comprise of managing a single account where a user would use either a VPN or remote access tool to gain access to all the business tools required to perform their work. In the last 10 years businesses are now shifting from on-premise systems to cloud-hosted systems to avoid the need for these VPNs and remote access tools catering for the increasingly demanding requirements for users to be able to access their information whenever, and from wherever they want with ease. Users now access several different cloud apps, which all require different login methods. As a result of the complexity coupled with these multi-cloud environments, more focus and attention are needed to manage Identity and access management systems to ensure that data and logins remain safe and secure.
In this blog, I will cover the basics of IAM, including key components and strategies, tools and solutions, best practices and the operational and security benefits of identity access management.
Basic components of Identity and Access Management
Identity and access management should include the following components:
- How users are identified and the roles they are then assigned
- The systems, information, and other areas protected by IAM
- The correct levels of protection and access for sensitive data, systems, information, and locations
- Adding, removing, and amending individuals in the IAM system
- Adding, removing, and amending a role’s access rights in the IAM system
IAM tools
Identity access management systems should consist of all the necessary controls and tools to capture and record user login information, manage the enterprise database of user identities and orchestrate the assignment and removal of access privileges. These systems are designed to provide a means of administering user access across an entire enterprise and to ensure compliance with corporate policies and government regulations. Identity and access management technologies include (but aren’t limited to) password-management tools, provisioning software, security-policy enforcement applications, reporting and monitoring apps and identity repositories. Identity management systems are available for on-premises systems, such as Microsoft SharePoint, as well as for cloud-based systems, such as Microsoft Office 365.
An identity management system typically involves the following areas:
- Employee data—such as through an HR system, directories (i.e. Active Directory), and more—used to define and identify individual users
- Tools to add, modify, and delete users
- Password management tools and workflows
- Integration with or replacement of the existing login system(s)
- Enforcement of user access rights to certain systems and information
- Auditing and reporting for visibility into how systems and information are being used
Three Typical Systems Used for Identity and Access Management
There are many technologies to simplify password management and other aspects of IAM. A few common types of solutions that are used as part of an IAM program include:
Single Sign On (SSO): An access and login system that allows users to authenticate themselves once and then grants them access to all the software, systems, and data they need without having to log into each of those areas individually.
Multi-Factor Authentication: This system uses a combination of something the user knows (e.g. a password), something the user has (e.g. a security token), and something the user is (e.g. a fingerprint) to authenticate individuals and grant them access.
Privileged Access Management: This system typically integrates with the employee database and pre-defined job roles to establish and provide the access employees need to perform their roles.
IAM technology can be provided on-premises, through a cloud-based model (i.e. identity-as-a-service, or IDaaS), or via a hybrid cloud setup. Practical applications of IAM, and how it is implemented, differ from organisation to organisation, and will also be shaped by applicable regulatory and compliance initiatives.
Benefits of identity and access management
Here’s a look at a few of the primary benefits and why using identity and access management technologies and best practices is important.
- Access privileges are granted according to one interpretation of policy and all individuals and services are properly authenticated, authorised and audited.
- Companies that properly manage identities have greater control of user access, reducing the risk of internal and external data breaches.
- Automating IAM systems allows businesses to operate more efficiently by decreasing the effort, time and money that would be required to manage access to their networks manually.
- In terms of security, the use of an IAM framework can make it easier to enforce policies around user authentication, validation and privileges and address issues regarding privilege creep.
- IAM systems help companies better comply with government regulations by allowing them to show that corporate information is not being misused. Companies can also demonstrate that any data needed for auditing can be made available on-demand.
- IAM technologies allow the business to give users outside the organisation, like customers, partners, contractors and suppliers, access to its network across mobile applications, on-premises apps and software-as-a-service apps without compromising security. This enables better collaboration, enhanced productivity, increased efficiency and reduced operating costs.
- Identity management can be used to improve employee productivity, which is especially important when onboarding new employees, or changing authorisations for accessing different systems when an employee’s function changes. Automated provisioning can enable companies to accelerate the process of allowing new employees to access the required parts of their systems.
- Identity management can be an important tool for enhancing employees’ user experience, especially for reducing the numerous usernames and passwords that are required. SSO and unified identities can be used to enable customers and other stakeholders to access different areas of the enterprise system with one account, ensuring a seamless user experience.
Why do I need IAM?
Identity and access management is a critical part of any enterprise security plan. The goal of any IAM practice or tool is to promote better cyber-security within an organisation and protect your identity’s security and information assets. If you neglect the importance of the IAM discipline entirely, it will only be a matter of time before something goes wrong within your digital systems. Hackers and other cyber-criminals are automatons who never stop hunting for common vulnerabilities in access controls.
Compromised user credentials often serve as an entry point into an organisation’s network and its information assets. Enterprises use identity management to safeguard their information assets against the rising threats of ransomware, criminal hacking, phishing and other malware attacks.
Identity and access management systems can enhance business productivity. The systems’ central management capabilities can reduce the complexity and cost of safeguarding user credentials and access. At the same time, identity management systems enable workers to be more productive (while staying secure) in a variety of environments, whether they’re working from home, the office, or on the road.
IAM is critical to protecting sensitive enterprise systems, assets, and information from unauthorised access or use. An end-to-end IAM implementation will reduce the likelihood and impact of data breaches, and ensure that only legitimate, authenticated users have access.
