Security Service Ideas: IAM

As we've seen in our research, organizations believe that preventing and detecting insider espionage is the top security threat they are inadequately equipped to address. Respondents also stated that they believe that technical staff with elevated privileges pose the greatest internal IT security risk to their organizations. This underscores a general feeling that organizations are doing a poor job of protecting user credentials and controlling access to data. However, organizations are beginning to discover that identity and access management (IAM) is a key component to controlling user access to critical information across the entire enterprise ecosystem while ensuring compliance with corporate policies and regulations.

The 451 Take

Modern enterprises want immediate, easy and secure access to information anytime from anywhere. This has led to a vanishing enterprise boundary as organizations embrace cloud services, workforce mobility, and a hybrid IT infrastructure. However, this posture has introduced new vulnerabilities and potential points of breach, renewing interest in identity and access management to protect identities and defend a borderless enterprise. Yet, according to 451 Research's Voice of the Enterprise: Information Security, Workloads and Key Projects survey, only 38% of enterprises have IAM technology deployed in their organizations.

At a high level, identity and access management is the process of creating, managing and using digital identities and enforcing access policies across disparate systems both in the cloud and on-premises. Simply stated, the goal of IAM is to give the right people the right level of access at the right time and in the right context. IAM is becoming a critical imperative for enterprises to maintain the trust of their customers and meet compliance requirements in industries such as banking and financial services, healthcare, education, manufacturing, media and entertainment, retail and vendors, telecommunications, and others.

Let's be clear up front: there are many challenges with IAM. Part of the problem is the difficulty with getting IAM to integrate with the entire array of systems, platforms and applications used in the enterprise. As a result, businesses end up with a handful of applications connected to the IAM system but then still have several manual processes and individual accounts to manage. Not only is this ineffective at protecting the enterprise, but it often fails to meet the regulatory and compliance requirements imposed on many industries.

Historically, identity and access management services were limited in scale and features and were often poorly implemented. For example, enterprises often want the IAM service integrated with their Active Directory but their AD structure is poorly structured, making integration difficult or impossible. Or the organizational politics of who owns data and who controls access to it has limited the effectiveness of IAM in the enterprise. In addition, traditional IAM services placed a heavy administrative burden on internal staff and a significant strain on IT budgets. Consequently, these past IAM failures have tainted the perceived value of identity and access management implementations among enterprises, creating a challenge for future endeavors with IAM. However, areas like IAM, where enterprises are struggling to implement and manage needed security controls, are prime opportunities for service providers.

We have seen IAM go through several iterations over the years but the latest wave of IAM is addressing past issues and making it easier to integrate and deliver throughout the enterprise's IT ecosystem. The key is that most enterprises – and many service providers, for that matter – miss that IAM must be treated as a program, a constantly evolving, adaptive and managed program, not a one-and-done project with disjointed point solutions that do not address identity management holistically. IAM is about protecting the organization's riskiest assets: its people. With the proliferation of multi-cloud and hybrid IT, identity management is a must – identities across disparate platforms cannot be successfully managed by traditional means or manual processes.

Service providers have opportunities to provide the IAM platform as a service, ongoing management, and the professional services to set it all up. But before IAM can even be implemented, most organizations will need help ensuring that proper access processes and procedures exist and that access levels are documented and understood.

Successful service providers are offering full identity and access management services by combining tools like single sign-on, complete application access lifecycle management, mobile access management, robust and dynamic access policies, multi-factor authentication, and identity federation – all of which can be applied holistically across disparate platforms and clouds.