IAM: Identity and Access Management

For a company, maintaining the necessary flow of, and managing access to, its business data calls for full attention not only from its tech department, but from the top management as well.

The business environment is constantly evolving, with the most recent trends being: BYOD (Bring Your Own Device), cloud computing, mobile apps, an increasingly mobile workforce, the fact that users range from employees to customers and vendors. All this comes with new cyber security challenges.

As companies implement and use more software, data, and digital services, they need a more effective way to manage access to such systems. An average user may have dozens (sometimes even hundreds) of applications to access in order to get work done, all of which may contain confidential, sensitive, or restricted information.

An Identity and Access Management (or IAM) system is a framework of business processes facilitating the management of electronic identities and data access within an organization.

The IAM technology can be used to automatically create, capture, record, and manage user identities and their corresponding access permissions, ensuring that access privileges are granted in accordance with the security policy, so that every individual and service is properly authenticated, authorized, and controlled. 

In other words, an IAM system manages users and their access permissions within your organization’s network. This management helps you control which users log in and perform actions in the company’s systems, applications, databases, etc. 

IAM Capabilities

IAM systems have two main functions: first, they verify the identity of those trying to log in, and second, they determine which authorizations the user has. Both can be implemented in different ways:

Verifying the Identity

For identity and access management, the first thing you need is to find out who logs into the system or database. The easiest way to identify a user is by a username and password combination. A more advanced identity verification method is multi-factor authentication.

A strong multi-factor authentication scheme requires additional credentials to authenticate a user’s identity, such as: 

• A token. Here, a physical object owned by the user that confirms their identity (a token) is used along with a known personal identification number (PIN) or password. Your security depends as much on safeguarding the token as on knowing your password or PIN.
• Biometrics. It relies on the user’s unique physical characteristics, such as fingerprints, facial features, iris, retina scans, voice recognition, etc.

Checking the Permission Level

Once the user’s identity has been confirmed, the IAM system proceeds to access management. As a result, the user is granted personalized access based on a complex set of authorization rules stored in the system.

They may vary depending on the organization, but, in general, they take into account the employee’s function, position or authority, competence. Sometimes, the location, i.e., the place from where the request to access services is made, can be very important.

Access control begins with choosing which users will have limited privileges and which will have fuller access within the company’s business system workflow.

Single Sign-On 

In some cases, it can be useful for users to access multiple systems or applications with a single login. Using the single sign-on (SSO) scheme, a user can, for example, log into both a database and management systems with a single set of credentials.

However, this type of authentication does not mean that the user has full access to all applications or data within the organization. Instead, the IAM system enforces the established authorization rules and grants access rights based on the user’s identity.

Implementing an IAM System 

An IAM system has a central directory service that increases as the company grows. This central directory prevents credentials from ending up in random files or notes as users try to memorize multiple passwords for different systems. 

IAM systems should facilitate user provisioning and account configuration. With IAM, less time is required for authentication thanks to a controlled workflow that reduces errors and the potential for privilege abuse, while the administrators are given the ability to view and change access permissions instantly.

To handle access requests automatically, an IAM system checks the user’s position, location, and business unit ID, thereby classifying access requests according to the positions of the existing employees.

Some rights may be provided automatically as inherent to the employee’s position, while others may be granted upon request. In some cases, certain requests may be denied or even banned altogether, in others, some changes may be required. 

An IAM system must establish workflows to manage the process of granting access requests. This mechanism can facilitate setting up different review processes for higher-level access depending on the risk level, as well as reviewing the existing rights to prevent privilege creep. 

User privileges can also be created and modified for groups. As a module-structured solution, it offers quick implementation, cost-efficiency, and other benefits.

At the most basic level, identity management determines what users can do on the network, on specific devices, and under what circumstances, but in a more advanced configuration, it can increase the company’s security and productivity while reducing costs and unnecessary efforts.

For security reasons, identity management tools are implemented as an application or run on a dedicated server or network appliance which can be either on-premises or cloud-based. All this comes with the option to configure policies, reports, alerts, alarms, and other common management and operations requirements. 

Good Practice

Currently, IAM systems are essential to help businesses strengthen their cybersecurity. However, it is clear that a lot of initiatives are not implemented consistently as companies fail to properly prepare a project in both technical and business aspects.

The general recommendations for correctly implementing an IAM system are as follows:

• Create of a versatile project team. An IAM project is cross-disciplinary in nature, so it cannot be addressed solely from a technical point of view, it requires cooperation from the management and should capitalize on their knowledge of business processes and the structure of the organization.
• Assign project managers and objectives. You need to determine the roles and responsibilities of each participant, along with specific steps towards their implementation. Objectives and milestones must be documented and approved by the stakeholders before starting the project implementation to avoid changes later on as they would increase the time and cost of the project.
• Implement the project in steps. Implement the solution one step at a time with achievable milestones, starting with a small number of systems, users, and roles, to get results quickly, build up acceptance within the organization, and then expand the project scope.
• Interaction with HR systems. Staff movements (hiring, terminations, transfers, etc.) can be communicated to the tech department with some delay or not communicated at all. The situation can be even more complicated when human resources management tasks are performed manually, so the IAM system must be updated with data from HR automatically, offering immediate quantifiable advantages, such as simpler access, greater productivity, user satisfaction, etc.
• Define user roles. A role is an individual set of access permissions that are necessary for a certain function or department of the organization. They can reduce the administrative burden considerably and must be updated continuously to reflect changes in the organization or the systems and applications used.
• Include risk assessment. IAM systems provide a large amount of data that must be processed to identify the highest risk elements. Their identification and assessment is a powerful tool that can help sort access data, such as users, roles, and accounts, by their potential risk level.

Thus, the innovative IAM technology has made it possible to centrally control accesses, roles, permissions and combine different authentication methods. It is an excellent opportunity for all businesses and organizations that wish to operate drawing on a strong, simple, and effective identity management system.

In practice, a successful identity management scheme boils down to a few essential functions: understanding who has access to what resources and data, who should actually have such access, and controlling and monitoring how those access rights are being enforced.

With effective identity management, your company will not only strengthen its security and compliance postures, but can also become more agile and successful in its endeavors, eventually turning into a more flexible, efficient, secure, and compliant business.