What is Identity and
Access Management (IAM)?

What is IAM

Gartner describes IAM as, “a security and business discipline that includes multiple technologies and business processes to help the right people or machines to access the right assets at the right time for the right reasons, while keeping unauthorized access and fraud at bay.”

In other words, IAM is a system utilized by key public cloud providers such as Microsoft Azure, Amazon Web Services (AWS) and Google cloud platform for the deployment of data and applications that boast a higher level of security than preceding systems. For anyone who uses cloud-based software, no matter if it’s for personal or business use, IAM tools are vitally important if they seek a 360-degree improvement in managing identities and access. IAM ensures that the right people with the right job roles can access the right tools and applications to carry out their jobs. Additionally, IAM tools are not limited to managing user identities, it also enables an organizational management of a wide spectrum of identities which include software and hardware like Internet of Things (IoT) and Operational Technology (OT) devices. Over time, IAM solutions have become an essential element of cybersecurity in the modern age as it allows businesses to exert control over who has access to their data and infrastructure, thereby, retaining the security of sensitive information.

History

Identities entail information that surpass just an email address or username. They entail a person’s designation, gender, age, profession, and a swarm of other details that would prove to be catastrophic if left exposed. And because of the digital transformation, privacy bills and laws stipulating greater security are flooding governments’ chambers. Data compliance and privacy laws are crucial in providing a standardized set of guidelines, policies, stipulations and obligations so that a secure way to access, process and share data is established. Long before becoming relevant to cybersecurity, the conceptualization of IAM was in security and started in the initial computing days, when dumb terminals were used by users to access mainframe computers. In those days, the process of access controls was relatively basic, and security was frequently disregarded as a major aspect.

Employee access was limited to physical offices and many organizations also limited access to specific rooms and locations. This represents a digital analog in the realm of cybersecurity where users have limited access and are limited to specific resources. However, an incremental increase in the complexity of computing and the global connectivity due to the internet, contributed to the multiplication of security threats which in turn demanded stronger cybersecurity measures.

The origin of the first IAM solutions can be traced back to the late 1990s, when the internet was still in the nascent stages. The driving force behind the creation of IAM solutions was the need to secure web-based applications and services. But back then, the adoption of these solutions was not considered a must-have element for cybersecurity, owing to the fact that their management was quite daunting as those solutions were built using custom codes. Having said that, the exponential expansion of the internet changed the perspective of the cybersecurity industry as a whole, which resulted in the pressing need for the development and offerings of new and sophisticated IAM solutions.

Coming to the early 2000s, the developers’ realization to store access information in a secured manner was a major milestone which would eventually lead to identity access management. Secure authentication and authorization were the primary reasons for the emergence of access control lists (ACLs). ACLs granted the ability of self-authentication to users using a unique identifier (username) and a security token (password). Adding to that rigid simplicity, each system had its own built-in database that required the user to have separate credentials. People had to keep track of multiple usernames and passwords which was at that time, stored on a piece of paper.

Today, IAM has matured. Businesses of all sizes have a wide range of solutions to choose from which offer varied IAM tools and technologies like authentication, authorization, identity provisioning and deprovisioning, and access controls. Such types of tools are natively designed to work together, and hence, offer a streamlined consolidation of synergistic tools and technologies that enforce the policy of appropriate level of access to resources by appropriate users without compromising or diminishing the overall security.

Significance

IAM comprises systems and processes that allow the it administrator to assign one digital identity to each entity, authenticate all long-ins, authorize access to specific resources and monitor and manage those identities. In other words, managers in the company can control which categories of employees have access to which applications or data, adding an extra layer of security to your business’ network.

IAM systems are as complex or straightforward as you want them to be with personalization options that reveal certain documents, files and records. IAM services should be proactively implemented if your team consists of numerous departments with unique roles. Only the users you choose can access the company portal, and they’ll be able to see the information you want them to see. The concept of identity and access management technology makes it more difficult for an outside party to view, manipulate or steal sensitive data.

IAM systems help you keep track of employee activity. Only certain employees can view programs and applications, making it challenging for unauthorized personals to gain access. It’s also possible to set system parameters to catch any suspicious transactions, communications or errors that might otherwise go undetected.

Besides employees in your company, IAM systems provide secure access for business partners and contractors, mobile and remote users, and customers. A well-established IAM system enhances productivity and the smooth operation of the business’s digital system. Employees can work seamlessly regardless of their locations with the centralized management granting them access to necessary tools. Contractors, consumers and suppliers also benefit from the improved efficiency and reduced expenses.

Identity and access management systems appeal to companies that plan on expanding their staff. It’s recommended to gradually grant permissions to new hires as they climb the corporate ladder with updated titles and qualifications. Utilizing IAM reduces risks of sudden changes in the workplace and sets you up for success in the following areas:

• Stopping the spread of malware
• Opening the company portal to potential clients
• Monitoring employee productivity
• Improving the overall user experience — single sign-on or multi-factor credentials (81% of security breaches occur due to default, weak or stolen password credentials).

A successful IAM solution demands an understanding of foundational IAM concepts to derive its existence in organizational security. There are five pillars that give meaning to IAM solutions as a whole:

IAM versus privileged access management (PAM)

Apart from the fact that IAM primarily focuses on identities and PAM primarily focuses on privileged access, the main differences between IAM and PAM are:

Access management (AM)

Access management is a fundamental component of IAM. Access management within the IAM framework entails the implementation of processes and mechanisms to regulate and govern user access to resources within an organization’s IT infrastructure. It encompasses the determination of authorized users, their permitted access privileges, the conditions under which access is granted, and the particular purposes for which access is permitted.

AM within the context of IAM generally involves the following core elements:

• User provisioning
• Authentication
• Authorization
• ACLs
• Auditing and monitoring
• Privileged access management (variation of IAM created for privileged accounts and/or users)
• User deprovisioning

Access control

Access control by itself is a security technique or mechanism under access management. This procedural mechanism regulates access to resources, defines and implements rules, policies, conditions and restrictions to determine who can access what kind of resources, based on what conditions and to what extent. Mechanisms of access controls might include, authentication, authorization and several other technologies like access control lists.

The principal objective of access control is the protection of sensitive or critical information, prevention of unauthorized access, and the maintenance of confidentiality, integrity and availability of resources.

Various types of access control mechanisms are encompassed by AM. Most widely used control mechanisms include:

Access control lists (ACLs)

An ACL serves as a security mechanism in an operating system. Its purpose is to limit access to files and directories for individuals, or groups based on permissions and restrictions. These ACLs allow users to read, write, execute, and delete operations on specific files or directories.

These are distinct or specific implementations of access control mechanisms used in different systems. Common types of ACLs include:

Authentication versus authorization

Authentication and authorization are two different components of IAM that fulfill two different requirements. Consider the this scenario: Employee X enters the physical location of their workplace. They will need to show their ID to the security. The security guard is tasked with cross-verifying whether the picture on the ID provided matches the employee’s face. If they match, the guard allows entry to the local, including different areas and rooms to access. If they don’t match, the guard denies entry. It’s important to understand that the guard is not responsible for specifying the areas the employee can access, instead, the guard only asks for proof of identity. This is the first component of IAM: authentication. It is the process of confirming user identity.

On the other hand, authorization deals with granting or denying access to resources. Consider this scenario: Employee X operates on the fifth floor of his workplace-premise. There are multiple rooms on that floor that are private workspaces (resources) for each employee. Entry to a particular room is granted or denied based on the badge of the employee swiping their card on a key sensor. In this case, employee X trying to swipe their ID badge on a colleague’s room will be denied entry because the resources in that particular room do not belong, or are supposed to be inaccessible to employee X. This is the second component of IAM: authorization. It is the process of granting or denying access to various resources based on user identity.

This table further emphasizes the difference between authentication and authorization.

Single sign-on (SSO)

SSO is one of the most common and secure authentication methods that enables users to access multiple applications and websites with a single set of login credentials, simplifying their online experiences and reducing the burden of remembering several passwords. This streamlined access not only improves user convenience but also bolsters cybersecurity by minimizing the risk of password-related vulnerabilities.

Shared access to the Amazon Web Services (AWS) account

This is a key feature of IAM. It enables users to create separate credentials (usernames and passwords) for each user or resource followed by delegation of access.

Granular permissions

Granular permissions means that access requests are subject to restrictions. An example of this case can be using policies to allow a user to view the information but deny them the right to update or download.

Multi-factor authentication (MFA)

MFA is a feature of IAM that enables users to provide their credentials (username and password) alongside a one-time password (randomly generated number) from their device as an additional factor of authentication.

Payment card industry data security standard (PCI DSS) compliance

MFA is a feature of IAM that enables users to provide their credentials (username and password) alongside a one-time password (randomly generated number) from their device as an additional factor of authentication.

Password management

IAM’s password policy allows the remote reset or rotation of passwords. Setting rules or conditions like specific requirements in a password when the user is making it or the number of attempts provided for entering the correct password before access denial are two of many ways of managing passwords within the IAM framework.

Policies and permissions

The policy types mentioned below are itemized based on most to least popular:

Identity-based policies, also known as user-based policies

Identity-based policies are a specific kind of mechanism for access control that takes the identity of a user, individual, or an entity into account to determine managed and inline policies which can be attached to IAM identities (users, user-groups, or even roles).

Identity-based policies allow:

• Defining fine-grained access control rules by determining and stating the type of actions or resources permitted or denied to a particular identity. The implementation of these policies is usually carried out by utilizing a policy framework or language supported by the IAM platform or system.
• Permissions to be directly assigned to singular users, user-groups, or even roles.
• Centralized management of policies within an IAM system after defining them. Via centralized management, administrators can carry out the establishment and enforcement of access controls across a plethora of systems, services, or applications in a consistent manner.
• Exertion of granular control over access permissions to ensure that the necessary privileges are granted to users for them perform their daily tasks while simultaneously reducing the risk of data breaches or unauthorized access.
• Flexible and scalable management of access permissions as it enables organizations to add or remove users effortlessly, update group memberships, or modification of role assignments while leaving the underlying policies unaffected.

Resource-based policies

In the context of IAM, resource-based policies are a kind of access control mechanism that utilize resource-characteristics and resource-attributes for the determination of user-permissions and user-access rights. The concept of resource-based policies is based on assigning particular permissions to resources. At their core, they are Javascript Object Notation (JSON) policy documents that are attached to resources. Resources can be any of the following: folders, files, documents, APIs or even services like the Amazon S3 bucket.

Unlike identity-based policies, which involve defining access control rules at the identity level, resource-based policies involve defining access control rules at the resource level. Policies like these are usually formulated and enforced using an IAM framework or policy language.

Uses of resource-based policies include the following:

• Particularization of permissions
• Defined conditions that grant permissions
• Administrative management of permissions pertaining directly to resources enabling flexibility and control over resource-access
• Decentralized access control management
• Enhancing security
• Sustaining a robust governance framework for the entire IT infrastructure.

Examples of resource-based policies include the following:

• Enforcing a resource-based policy that grants read and/or edit access to a file (in a file storage system) for a specific set of users or group of users
• Denying operations of deletion on a particular folder for every user excluding the folder owner
• Granting API access to specific services contingent on the initial IP address
• Access restriction to specific resources contingent on user attributes

Role-based policies

As the name suggests, this kind of IAM policy enables access and permission governance based on predefined roles. Policies of this nature are corresponded with precise roles defined within the IAM environment to grant permissions to users. Access management is streamlined using role-based policies as administrators gain the ability to assign permissions, or sets of permissions to corresponding roles, and those permissions are inherited by the user once assigned. Streamlined access control management means that there is precision and consistency in the assignment of permissions across all users or identities with homogeneous tasks or responsibilities.

Rule-based policies

In the context of IAM, rule-based policies are used to determine access and permissions based on conditional rules or parameters. Specific attributes or conditions of the access request are evaluated by policies of this nature to make appropriate access decisions. Examples include, user identity, time of access, device identity and/or properties and other circumstantial data. By utilizing rule-based policies, administrators can define intricate rules contingent on particular risk requirements which are affected by the type of risk scenario. Via rule-based policies, organizations can execute fine-grained access control with the consideration of different factors outside user identity.

Attribute-based policies

This type of IAM policy takes attributes associated with resources, users, and/or access requests into account to determine relevant access and permissions. Attributes can include the following:

• Subject or user attributes: Username, clearance level, job title, employee ID, department
• Object or resource attributes: Resource or object author/owner classification, last updated, type of resource
• Environmental or context attributes: Current time and day, current location, current timezone, type of device
• Action attributes: View, read, write, edit, share, delete

Organizations considering diverse attributes gain the ability to apply policies in alignment with their compliance and security requisites.

IAM security operations (SecOps)

While IAM policies focus on the right assignment of access and permissions, IAM SecOps alludes to the combined implementation of activities, processes and practices to establish and maintain the security and integrity of organizational identity access management. The focus of IAM SecOps is the protection of user identities, access control management, and safeguarding sensitive user and/or account-related and resource-related data.

Security incident management

In the context of IAM, security incident management is defined as the security operation of identifying, recording, managing, and analyzing security incidents or threats in real-time. It defines how an organization strategically manages a security incident. The primary objective is to scour the IT infrastructure for any and/or all security incidents and ultimately, provide an extensive, transparent and practical view into those security incidents.

It is important to understand what can be considered as a security incident. AData security incidents that are active threats include attempted intrusion to a successful compromise and exploitation, and data breach. Security incidents can also include unauthorized data-related access to health, financial, personally identifiable records, and policy violations relating to the same.

Incident management teams are typically responsible for the following:

• Undertaking preparatory incident management plans before the occurrence of a security incident
• Supervision of technical response operations during an active incident
• Invoking third-party assistance if necessary
• Decision-making regarding the communication of incident details (when and how to communicate) and response of organization with internal staff, clients or customers, industry regulators and the media
• Follow-up after resolving the incident to perform an evaluation as to how it informs and suffuses future incident management strategies

Incident response

While the process of incident management has a wide focus and strategy, incident response has narrow focus and tactic. To grasp the difference between incident management and incident response process, it's helpful to think of incident response as a technical element of the overarching process of incident management. A major correlation between incident management and incident response in terms of impact on the business is that incident response will have a direct influence on the probability that a business might lose critical data to encryption or theft, revealing that it's a core and dictating factor of incident management. A robust incident response process should gauge the immediate effects of a security attack or incident. and ascertain the swiftness and effectiveness by which the business can recover from it.

An incident response process includes the following activities:

Incipient identification or discovery of incidents via automation and response tools, security orchestration, or security information and event management (SIEM).

• Alert given by a security staff member or the security operations center (can be of third-party as well).
• Incident containment, which depends on whether the identification or discovery of the incident was prompt enough
• Striving towards the eradication of infiltration from the network environment no matter how many attempts it might take
• Making and utilizing backups for data restoration

Vulnerability management

Vulnerability management has a similar process as incident management, the main difference being that the former is performed for an organization's system vulnerabilities while the latter is performed for security incidents or threats faced by the organization. Vulnerability management is an indispensable aspect of IAM and cybersecurity as a whole. It involves the identification, assessment and the prioritization of system and software vulnerabilities in an organization's IAM environment, followed by the elimination or mitigation steps for those vulnerabilities. The primary objective of vulnerability management is risk-reduction of security breaches and the protection of organizational assets from cyberattacks.

The complete process of continuous monitoring and assessing systems and software, regularly updating and patching, and testing to guarantee effective remediation of the vulnerabilities is known as vulnerability management lifecycle.

The following stages are involved in vulnerability management

Stage 1: Identifying

Scanning the network and software on a periodic basis for identifying and indexing current vulnerabilities in the network's or software's environment.

Stage 2: Assessing

Scrutinizing the potential vulnerability impact and subsequently, ascertaining the level of risk they pose.

Stage 3: Prioritizing

Ranking or classifying vulnerabilities based on their risk severity (which is then used to derive the risk level) and potential impact.

Stage 4: Mitigating

Implementing and enforcing appropriate remediation solutions for the reduction or eradication of vulnerabilities.

Stage 5: Testing

Measuring and validating how effective the mitigation efforts proved to be.

Stage 6: Reporting

Conveying the information on vulnerabilities and mitigation efforts to pertinent stakeholders.

As new vulnerabilities are frequently identified, targeted and exploited, it's necessary for organizations to rollout system updates and patches regularly. General vulnerabilities like weak passwords, outdated protocols, and out-of-date or unpatched software should be addressed as soon as possible since vulnerabilities of these kinds are often targeted for exploitation.

Security information and event management (SIEM)

SIEM is a technological approach that entails collecting, aggregating, analyzing and correlating security event logs from different applications, platforms and/or systems within the organizational environment. The term SIEM is derived by combining security information management (SIM) and security event management (SEM) functions into a centralized security management platform or system.

SIEM helps in detecting and responding to security incidents by providing real-time monitoring, threat intelligence, and advanced analytics capabilities.

By integrating with IAM systems, SIEM can enhance the overall security posture by enabling proactive identification of potential identity-related threats, unauthorized access attempts, unusual user behavior, and other security anomalies. It further enables organizations to manage and mitigate risks associated with identity and access, ensuring the confidentiality, integrity, and availability of their critical resources effectively.

Security policy and procedure management

Security policies are dynamic documents that physically and digitally define the mechanism through which an organization seeks to defend their IT and physical assets. These policies are subject to frequent updates and changes depending on the requirements brought upon by new technologies, vulnerabilities and security changes.

Within the context of IAM, security policy and procedure management is the conglomeration of processes and sequential activities that define, implement and maintain the integrity of and adherence to security policies and procedures. There are three types of policies that are dependent on the policy's purpose and scope:

• Organizational security policies are official governing blueprints that clearly define or lay out the complete security program of an organization.
• System-specific security policies are official documents that govern an information network or system's security procedures.
• Issue-specific security policies (ISSP) are official documents that deal with specific elements of bigger organizational policies. Acceptable use policy, access control policy, change management policy, incident response policy and disaster recovery policy are a few types of policies that fall under ISSPs.

A security policy encompasses the following essentials:

• Statement of purpose (defines the purpose of the policy)
• Statement of policy applicability (defines who the policy applies to)
• Statement of objectives (identifies and defines the objectives of the policy; commonly comprises of the CIA triad)
• Authority and access control policy (specifies which resource is accessible by which person)
• Statement of data classification (categorizes organizational data based on criticality and sensitivity)
• Statement of data use (specifies the management of data at every level)
• Statement of responsibilities and employee duties (determines and specifies the person responsible for the supervision and enforcement of policies)
• Security awareness training (defines and dictates employee training on the best security practices)
• Measures of effectiveness (MOEs; measures the efficiency of security policies, edicts improvements, and the way those improvements will be implemented

IAM standards

IAM standards alludes to widely accepted guidelines, best practices, and technical stipulations that are developed, established, often refined and maintained by industry organizations, consortium, or technology communities.

ISO/IEC 27001

ISO/IEC 27001 is a popular standard for information security management systems (ISMS). Requirements that ISMS must comply with are defined by this standard. ISO/IEC 27001 standard provides organizations of any size and sector of activity with guidance for establishing, implementing, maintaining and continually improving an information security management system.

An organization conforming with this standard implies that it has enforced a system in place for the management of risks relating to the security of data handled or owned by the organization. Moreover, it implies that those systems put in place adhere to the best practices and principles embodied in this International Standard.

This standard promotes a holistic approach to information security: vetting people, policies, and technology. An organization implementing an information management system complying with this standard is equipped with a tool for risk management, cyber-resilience and operational excellence.

NIST SP 800-53

NIST SP 800-53 was designed by the National Institute of Standards and Technology (NIST). It's a continuously updated cybersecurity standard and compliance framework that attempts to define or set an under-structure of standards, controls, and assessments based on risk, capabilities and cost-effectiveness. It is designed to support any organization's cybersecurity requirements and priorities.

According to NIST, "SP 800-53 Revision 5 is part of the NIST Special Publication 800-series that reports on the NIST Information Technology Laboratory’s computer security-related research, guidelines, and outreach. The publication provides a comprehensive set of security controls, three security control baselines (low, moderate, and high impact), and guidance for tailoring the appropriate baseline to specific needs according to the organization's missions, environments of operation, and technologies used."

Policy Machine (PM) and the Next Generation Access Control (NGAC)

NGAC adopts a distinctive approach by representing access decision information in the form of a graph. Enabling a systematic, policy-consistent approach to access control, NGAC denies or grants users administrative privileges with a high level of granularity.

NIST states that, "To solve the interoperability and policy enforcement problems of today’s access control approaches, NIST has developed a specification and open source reference implementation, of an authorization system, referred to as the Policy Machine (PM). The PM has evolved from a concept to a formal specification, to a reference implementation and open source distribution. The PM is designed in support of, and in alignment with a NIST led American National Standards Institute/International Committee for Information Technology Standards (ANSI/INCITS) standard under the title of the NGAC. The PM/NGAC is a fundamental reworking of traditional access control into a form suited to the needs of the modern, distributed, interconnected enterprise. The PM/NGAC is being used as the basis for a growing number of commercial and academic product offerings and as the foundation for several dissertations."

System for Cross-domain Identity Management (SCIM)

The SCIM specification was designed to be an open standard for the management of user identities in cloud-based services and applications. SCIM standardizes the automation of identity provisioning in a quick, effortless and cost-effective manner in contrast to traditional identity provisioning. The SCIM specification suite exercises the following elemental aspects:

• Utilizing contemporary schemas and relevant deployments
• Emphasizing on deployment and integration with the absence of complications
• Enforcing contemporary authentication, authorization, and privacy frameworks simultaneously

The rfc7642 specification states, "the System for Cross-domain Identity Management (SCIM) specification is designed to manage user identity in cloud-based applications and services in a standardized way to enable interoperability, security, and scalability."

The diagram above displays the traditional mode of provisioning. Every single service has its own path of communication with the identity provisioning framework. As a consequence, there can be multiple connectors in place which renders the process tangled and the integration effort redundant for the Enterprise Cloud Subscriber and the Cloud Service Provider. Admins will face a nightmarish reality when it comes to the support and maintenance of every single connector; and obviously, there is an extra cost to be incurred. This problematic situation is solved by SCIM as it was created to be an open protocol that aligns with the general consensus for seamless identity provisioning, or the method of communication between services and the identity provisioning framework.

The above diagram describes the concept of SCIM 2.0. It's based on the exchange of the following aspects through an HTTP-based protocol:

• Common user schema
• Group schema
• Extension model

SCIM has a component called an "object model" for which the common denominator is a "Resource," and every other SCIM object is derived from an object model. Resource-attributes must be inclusive of id, externalId, and meta. Common attributes can be extended via User, Group and EnterpriseUser. It's also possible to extend SCIM to support other resource-types.

Security Assertion Markup Language (SAML)

SAML is an open-authentication standard hinged upon the Extensible Markup Language (XML) format. SAML is used to transmit authentication information in a specific format between two parties, typically, the iIdP and the SP. Additionally, SAML's primary role in online security allows the use of a single set of login credentials to access multiple web services and/or applications.

Even though SSO was attainable prior to the introduction of SAML, it's reliance on cookies meant that their viability was limited within the same domain. The way SAML solves addresses this limitation is by involving an identity provider in the process to centralize user authentication.

Some common benefits of SAML are:

• Enhancement of user experience by eliminating the need for multiple logins
• Acceleration of the entire authentication process as the user just needs to remember a single set of login credentials
• Fewer Help Desk calls for password resets
• Increased security
• All login information is stored with the identity provider (experts in handling information of said nature) and not with the service provider
• IdPs are experts in providing SAML authentication and thus, can bring in economies of scale in respect to time and resources to implement multiple security-layers
• IdP's have extensive identity security solutions with built-in features like MFA

OAuth 2.0

According to Auth0, "OAuth 2.0, which stands for Open Authorization, is a standard designed to allow a website or application to access resources hosted by other web apps on behalf of a user." The previous iteration of OAuth 1.0 was replaced by OAuth 2.0 in 2012. Considered as the de facto industry standard for online authorization, it authorizes access and limits the actions that can be performed on resources by the client app on behalf of the user without the exchange or sharing of user credentials.

This open standard authorization protocol can be implemented by any developer. It's designed to work in conjunction with Hypertext Transfer Protocol (HTTP) and enables third-party clients to issue access tokens via an authorization server given the resource owner's approves of it. The protected resources hosted by the resource server is then accessed by the third party using the access token.

Not with standing that the native platform for OAuth 2 is the web, the specification for it characterizes the handling of delegated access of this nature to other client types as well (server-side web applications, browser-based applications, mobile apps, connected devices, etc).

OAuth has four different modes called grant types. The kind of grant types required are contingent on the service being built. Chosen by the United Kingdom to deal with Open Banking authentication and authorization challenges, OAuth 2 and OpenID Connect (OIDC) have evolved to become the favored mechanisms for the enforcement of user permission in regards to payments or the exchange of banking information.

IAM regulations

IAM solutions have gone through an evolution of sorts, primarily to cater business needs and meet compliance laws and regulated-marketplace. Today, modern IAMs fulfill almost all industrial and regulatory requirements, from generally confronted laws to extremely granular compliance regulations. Majorly known compliance regulatory laws include:

The General Data Protection Regulation (GDPR)

The GDPR is a wide-ranging privacy bill adopted by the EU in 2016 and enforced on May 25, 2018. It was adopted to protect the personal data and identity information of EU citizens. Any company doing business with European customers must adhere to the GDPR as this privacy bill mandates ensuring customer awareness and consent in regards to access to private data and use by both domestic and foreign companies.

The bill also states that the security of data during the collection process and it's eventual storage is the responsibility of the organizations. To meet the GDPR compliance requirements for privacy and data security, an IAM solution needs to include the following:

• Access management
• Access governance
• Identity management (IDM)
• Identity governance
• Authorization
• Authentication (inclusive of MFA)

Note that an IAM solution monitoring access to customer's personal data is not all the solution needs to do. In accordance with the GDPR, the right to "be forgotten" and to revoke or deny their data collection is provided to and rests actively with the consumer; therefore, organizations should choose an IAM solution that meets all the legal requirements for data security and privacy.

Sarbanes-Oxley (SOX)

The Sarbanes-Oxley Act of 2002 was created as a response to several, high-profile corporate fraud cases. SOX primarily targets banks, insurance companies and other financial services, but extends its reach to virtually all publicly-traded organizations. To meet the security standards of SOX, an IAM solution must address both data security and identity management. The objective of SOX security standards is to ensure the integrity and security of financial reporting by mandating adequate, tested, and documented internal controls for both physical and digital asserts; including, the accounting data's integrity that is fed into the reports. The following internal controls are mandated by this act:

• Equipping and effectuating centralized administration for the management of user access rights and authentication
• Implementing and enforcing SoD
• Rectifying access rights whenever someone's job function changes
• Rescinding user access upon termination
• Managing user access based on their job roles; and deploying "least privilege"
• Regularly auditing access rights and privileges; and generating automated audit reports

Via granular and conditional controls, and automation of IAM operations like user provisioning and deprovisioning, access logging and usage tracking and predictive SoD analysis, organizations can gain the ability to condense the total risk of data breaches. The key to align with SOX requirements hinges on the organization's ability to generate on-demand evidence for an audit.

Health Insurance Portability and Accountability Act (HIPAA)

According to the United States Centers of Disease Control and Prevention, "The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge."

As health insurance and healthcare providers collect and store protected health information (PHI), HIPAA was enacted as a national healthcare standard in 1996 to regulate its collection, storage, and exchange. In specific, it's a federal law that ensures the privacy and security of PHIs.

Similar to SOX and the GDPR, access based on identity and purpose to PHI is limited by HIPAA compliance procedures. Moreover, HIPAA and the HITECH Act, which enforces the obligation of data security for electronic healthcare records are closely connected, which in turn provides more of an incentive for organizations to meet the aforementioned standards.

While the proliferation of digital healthcare data continues, pairing IAM solutions with HIPAA compliance policies aids in widening the boundary of protection against privacy violations.

An IAM solution aimed towards achieving HIPAA compliance must include the following capabilities for it to be effective:

• Using SSO for credential protection
• Integrating healthcare business partners in a variety of ways and simplifying the onboarding process
• Implementing centralized access governance for the curation of HIPAA-compliance access management across the organization's infrastructure, which is inclusive of human and non-human entities like IoT devices
• Utilizing an automated access logging system that tracks access to patient data and reports automatically for auditing purposes

Implementing the above-mentioned IAM capabilities can provide healthcare-related businesses with several benefits like effective management of rights and apt account termination for the simplification of administrative transactions. Additionally, the task of verifying electronic media policy compliance is made easier for HIPAA auditors via automated logging.

Family Educational and Privacy Act of 1974 (FERPA)

FERPA is a federal law the ensures the protection and privacy of students in post-secondary educational foundations. Student rights to restrict access to their student data and educational records including public-facing directory information are specifically protected by FERPA. Students eligible to invoke FERPA are also given the right of prevention or provision of record access to their parents.

An IAM solution should address the following FERPA compliance requirements for appropriate adherence:

• Federated infrastructure allowing eligible non-university affiliates access to relevant education records
• Means by which students can delegate access of education data to third parties
• Accurate, complete, and time-stamped logging of users with access to student data
• Automated reporting with audit-worthy access management evidence

An ideal IAM solution will centrally manage and cross-reference accounts of students and their parents, staff and faculty members, and limit access to their records in order to comply with FERPA.

The Payment Card Industry Data Security Standard (PCI DSS)

The PCI DSS standard pertains to major credit card companies. It's an industry-wide security standard for companies responsible for the management of major credit cards. Several components of this standard can be met via the incorporation of IAM frameworks. The number of employees who can access payment card data is limited by PCI DSS, for example.

Meeting this standard is possible via IAM, which espouses the notion of granting minimal or least privileges necessary for users to carry out their job or function. Use of IAM meets a good portion of PCI DSS requirement 8.1, which says, "Define and implement policies and procedures to provide accurate user identity management for non-consumer users and administrators in all system components.". It is inclusive of:

• A unique ID for each user
• Revoking access to terminated users automatically
• Disabling or removing inactive user accounts within a defined duration

New York SHIELD Act

The SHIELD Act, commonly known as New York's "Stop hacks and Improve Electronic Data Security Act" was implemented in 2019. Much like the GDPR and the California Consumer Privacy Act (CCPA), companies falling under the regulation of the SHIELD Act (storage of the personal information of New York citizens) have their security and privacy notification requirements expanded drastically. The SHIELD Act is targeted towards:

• Enforcement of better protection of personal data
• Prevention of breaches
• Improvement of consumer notification requirements

Organizations compliant with either HIPAA or Gramm-Leach-Bliley Act (GLBA) will notice the similarities in the SHIELD Act in terms of safeguarding consumer privacy rights. Having said that, the SHIELD Act considers the burden of cybersecurity requirements for small businesses and rectifies its directives to adjust to the size and complexity of organizations. IAM solutions adhering to the NY SHIELD Act data security standards are strongly encouraged include:

• Automated provisioning and deprovisioning of users as personnel change roles and jobs
• Entitlement management to limit permissions to least privileges
• Federated identity management to simplify integration and tracking of business partners
• Multi-factor authentication to increase the difficulty of stealing credentials to access data illicitly

California Consumer Privacy Act (CCPA)

The CCPA of 2018 adheres to the same privacy principles as the GDPR. Consequently, businesses that serve California consumers are subject to massive privacy implications. Moreover, in much the same way the GDPR empowers EU citizens with control over their personal information, the CCPA does the same for California citizens. Any company that makes more than $25 million in gross revenue and collects personal information from California consumers will be subject to regulation under the CCPA.

According to the California Department of Justice, "This landmark law secures new privacy rights for California consumers, including:

• The right to know about the personal information a business collects about them and how it is used and shared;
• The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale or sharing of their personal information; and
• The right to non-discrimination for exercising their CCPA rights.

As of January 1, 2023, consumers have new rights in addition to those above, such as:

• The right to correct inaccurate personal information that a business has about them; and
• The right to limit the use and disclosure of sensitive personal information collected about them."

Implementations strategies

An IAM solution serves as a fundamental element in a zero-trust network architecture, requiring the application of zero-trust principles, least privilege access, and identity-based security policies for it's implementation. The following tactics should be used to compose the best implementation strategies:

Centralized identity management

One of the core principles of a zero-trust architecture is access management of resources at the identity level. The approach towards this strategy is much simpler if an organization deploys a centralized management system for those identities. Via this type of management, user-migration from different systems, or to the least, synchronization of IAM with other user directories (for example, Human Resources directory) within the bounds of the organizational-environment is made possible.

Secured access

An IAM solution needs to ensure that it verifies the identities of those who log in as security at the identity level is an integral part of any SecOps strategy. This could imply deploying two-factor authentication (2FA), or MFA, or a fusion between MFA and adaptive authentication that can consider the frame of reference or attributes of login attempts such as time, location, and device-type.

Policy-based control

Policy-based control delineates who has authorized access to what resource and determines the privileges necessary for users to execute their job roles or functions. An effective policy-based control will grant least privileges, or only privileges required for user's tasks and no more. An IAM solution should use attributes such as job role, department, or any other attribute deemed appropriate as a function for providing user access to resources. Adjoining these policies as vital for central identity management can further ensure the security of those resources independent of access-location.

Zero-trust policy

Enforcing a zero-trust policy within an organization's IAM framework and/or solution results in consistent monitoring and securing user identities and access points within the IAM infrastructure. The opposite of traditional notions of access policies, like "you have access once you've logged in, "zero-trust policies were created to identify and manage access of all organizational members constantly while ensuring that no one is blindly trusted during the authentication and authorization phase.

Secured privileged accounts

There are different types and levels of accounts in an access management system. The level of capabilities, security and support provided to accounts with special tools or privileged access to sensitive information deserve a tier of their own and can be determined according to their role as the organization's gatekeepers.

Training and support

Users and administrators who will be most engaged with the product should receive training offered by most IAM providers. IAM providers also provide long-term customer service to ensure the continued health of the organization's IAM installation and its users.

Best practices

Adopting the best IAM solution is just brick and mortar for the identity-security fortress. Ensuring that the entire organization adopts and follows best IAM practices will in turn ensure that maximal security benefits are reaped.

Here are some of the core best IAM practices:

Opt for a zero-trust approach to security

As mentioned earlier, a zero-trust approach to security is defined via zero-trust policies. Unlike the traditional method of security-approach, a zero-trust security model relies on the core principle of "never trust, always verify." A zero-trust strategy is positively synergistic with contemporary IAM tools and, thus, they make for a powerful duo for an organization's IAM architecture.

The benefits of adopting and implementing a zero-trust approach include:

• Empowered productivity: Users can work in a more secured manner from any place, at any time, and on any device.
• Cloud migration: Intelligent security for current, complex environments (for example, hybrid environments) to enable and support digital transformation.
• Risk reduction and/or mitigation: Minimize the risk of lateral movement and close security gaps.

Distinguish and defend high-value assets (HVAs)

While limiting access to sensitive resources or HVAs is necessary to protect an organization's most valuable data, an organization will first need to identify their HVAs and the systems that encloses them. HVAs are usually defined as the data that would pose the biggest threat to the pertinent organization if it was compromised or lost. HVAs typically include: trade secrets, employee and customer personal identifiable information. Once HVAs are defined and identified, the next step would be to consider their storage locations, and the tools and applications with access to that data. The aforementioned exemplary HVAs are typically stored on the cloud and thus, are critical to cloud-based IAM environment.

Automate workflows

Automation is indispensable when it comes to IAM workforce management. A myriad of IAM tools exist to fortify the organization better. The following exemplary actions and benefits can be reaped from automating IAM functionalities at various stages:

Overall, leveraging IAM automation tools can maximize the efficiency of IAM systems, leading to massive savings in terms of both time and money.

Enforce the principle of least privilege

Applying this principle will permanently enforce a particular defensive barrier around the foundation of IAM security. In effect, it will adopt the belief of maximizing restrictions on access and permissions, given that the restrictions do not prevent users from performing their daily workflows. For that reason, role management best practices need to be used for defining each role and minimizing privileges provided to each user depending on their role, which primarily entails considering their daily workflows. For organizations seeking a deeper level of granularity, attribute-based access control should be used in conjunction to define permissions based on department.

It's of exceptional importance that administrative and alteration capabilities are limited so that a single admin is not subject to excessive permissions when it's not required. SoD should be

kept in mind for the division of responsibilities to abstain from over-provisioning of access and conjoin PAM best practices.

Regularly audit access to resources

Enforcement of strong policies encompassing access control is not enough to solve the issue of over-provisioning faced by a good chunk of organizations. Maintaining the principle of least privilege will demand auditing to be a foundational IAM best practice built into the all-inclusive IAM strategy.

New tools and applications are added to an organization's tech stack constantly, and this might lead to the encouragement of belief that employees might need access to every single tool even though they don't. As a consequence, when employee workflow is streamlined via the utilization of those tools, IT teams might discover a high amount of orphaned/stale accounts. This problem can be solved by auditing access permissions and usage logs on a regular basis. IT teams can then deprovision access to those orphaned/stale accounts, which will in turn lead to a reduction in the attack surface.

It's recommended that organizations ensure the creation and implementation of an auditing schedule within their IAM framework if they want their teams to prioritize this specific security procedure.

Centralize log collection

Log generation and collection can be automated using most, contemporary IAM tools. Logs are useful sources of information that aid with meeting audit usage, compliance requirements and reinforcing IAM policies.

Numerous organizations prefer storing logs on the cloud for ease of reference, instead of going through the pain of extracting logs from multiple locations. A hybrid environment will utilize the cloud-storage for logs as it's an easier and cheaper way to ensure their availability and accessibility in contrast to storing them on-premises. However, it's vital for organizations centralizing log collection to take contemporary cloud IAM best practices into consideration for the security of valuable log data without affecting accessibility.

Adopt and leverage contemporary IAM solutions

Most technical issues in IAM stem from the solution itself. Organizations trying to adopt an IAM solution to fit their existing tech stack will see a far lesser chance of success in terms of applicability of IAM best practices than the ones that search, adopt, and apply the right solutions for their organization. Right solutions will have a higher probability of supporting current organizational tools and applications and it'll be much easier to integrate them into the IAM infrastructure.

Note that not all tools might immediately support an oraganization's IAM technology, and as such, would require reconfiguration. Regardless, it's recommended to limit the number of reconfiguration to not hinder the IAM implementation best practice which favors seamless interoperability between IAM tools and applications.

The identification and adoption of user account management best practices can be initiated parallel to the search for the right tools to support an organization's tech stack. The need to wait for the right automation tools to define policies is eliminated as a parallel search for both best practices and automation tools will influence setting up the IAM architecture and framework way before determining the technology integrations.

Set password expiry policy

Having weak passwords that are vulnerable to brute-force attacks or credential stuffing is not an IAM best practice. Nearly 81% of security breaches occur due to default, weak or stolen password credentials. A strong password serves as a strong pillar to support an impactful IAM solution. The best way to circumvent the problem of weak passwords is to set a password expiry policy. A general recommendation of password expiry policy would be 45 or 60 days. Password expiry ensures that employee accounts gain new passwords periodically for protection against credential stuffing, identity theft, brute-force or other attacks.

A general rule of thumb when setting passwords is ensuring they are difficult to crack or guess (for adversaries) while being easy to remember (for users).

Guidelines recommended by NIST for password creation are:

• A password's length should fall in the range of 8 to 64 characters
• Special characters in the password are encouraged
• Repetitive or sequential characters within the password should be avoided (for example, 12345 or hhhhh)
• Password expiration policy is good practice

Modernize IAM systems

The table describes some of the key terms and factors utilized in legacy and modern IAM scenarios.

Benefits

IAM offers a myriad of benefits for all scales of organizations. A few of the appealing benefits include:

Greater IT savings

Efficiency of an organization's IT team is increased since manual tasks like employee onboarding, offboarding, and role changes can be automated by IAM systems. Automation has benefited the IT help desk too. Help desk requests and service tickets now are typically resolved more efficiently, saving organizations time and money.

Bolstered employee workflow and productivity

The right IAM tools can facilitate swift employee logins, allow for effective employee-traversal across different tools and platforms, and decrease help-desk friction.

Boosted security

IAM best practices and systems governed by the right policies limit access to proprietary and critical data to users, which is crucial in case of an unauthorized breach.

Increased information-sharing efficiency

Many organizations store large volumes of data. In many situations, information can be displaced in bigger groups of users. This lost information contributes to reduced information-sharing efficiency, which can be avoided through IAM frameworks and tools. Displaced information can cross-integrate across different systems, permitting painless transferability of information between users and applications alike. On top of that, knowing that a shared IAM platform securely encompasses all organizational systems and services instills trust between all stakeholders and adds value to the company.

IAM also plays a key role in mobile device management (MDM) for companies extending IAM to mobile devices. Some of the best benefits include:

• Simplified management of device fleets and streamlined operations
• Control apps and users working with the device
• MDM implementation allows provisioning apps to devices and imparts extensible IAM security best practices
• Cross-utilization of IAM and MDM security and control capabilities

Other general benefits of IAM include:

• Streamlined customer and user experience
• Risk mitigation and enhanced safety measures
• Valuable insights to improve business intelligence
• Superior control over users and data
• Administrative expense-reduction
• Easier initiatives for digital transformation

Risks

Some of the common risks organizations need to be aware of when considering to adopt IAM solutions and during and after IAM implementation process include:

Incorrectly defined roles and attributes

IT visibility into the required access for user groups is limited and tends to add too many users into a single group. Widening the spectrum of access permissions and over-provisioning of access should be avoided by collecting input from business leaders as to which factors need to be considered to determine access.

Irregular access management auditing

Integrating new IAM technologies is exciting as it defines policies and reveals its effectiveness. However, organizations tend to underestimate the significance of updating audit practices for access policy-alignment. Regular audits should be conducted for the following reasons:

• Preemptive discovery of attack vectors
• Defining new activities to automate
• Uncovering opportune phases to strengthen security by revoking or disabling unnecessary access

Inadequate process automation

Access management has scores of moving components. Without the automation of recurring processes, admins might encounter situations where they neglect the execution of particular processes on time. Situations like this can arise in user offboarding, where due to lack or absence of automation, a terminated employee's corporate authentication and resource-access has not been revoked or disabled, which can result in security threats.

Complex implementations

Often, companies taking advantage of IAM technology have to facilitate several deployments and reconfigurations, which given the complexity, can deviate from its course if IAM is not incorporated in the overarching security strategy. This involves formulating an implementation roadmap (especially, for companies rolling out tools incrementally) and ensuring that it synergizes with the chosen security strategy. By doing so, companies will be able to avoid problems of scalability, and rushed situations which create new security gaps and disregard for employee-training.

Centralized management = Single and critical target

Centralized identity management is invaluable, but remember that as the reach of centralization increases and authentication mechanisms converge, the overall process is much larger. With a myriad of processes in one place, it inevitably becomes a centralized security target for adversaries. The use of diverse network-security tools to keep IAM platforms healthy and protected is recommended to combat this.

Challenges

There are five major challenges when it comes to modern and/or hybrid IAM systems and solutions:

Password fatigue

While the Software as a Service (SaaS) model simplifies initial application access, it becomes complex as the number of applications grows. Each app has its unique identity store, login URLs, and password requirements, leading to reduced user productivity and increased frustration as users struggle with password management.

Security risks arise from users using weak or reused passwords, often jotting them down on Post-it notes or saving them insecurely. Cloud-based IAM services offer a solution with SSO across all apps, providing a central access point with one username and password.

Effective SSO seamlessly connects to both cloud and on-premises apps, which is critical for organizations needing access to both. Many enterprises rely on Microsoft AD for user management, including access to IT services and business apps. An ideal on-demand IAM solution integrates with AD, enabling users to use their AD credentials for SaaS apps, promoting the adoption of new offerings.

According to Statistica, "The majority of respondents in the United States reported reusing a password for multiple accounts as their most common password fatigue habit in the year 2022. By contrast, 36% of respondents indicated auto-generated passwords for multiple accounts as a common habit in the same year."

Complications in user life cycle management

IT traditionally provides access to resources like the corporate network, email accounts and file servers for new employees or employees who have just joined. However, the management of access to SaaS applications often occurs at the departmental level, with individual application administrators responsible for this, rather than following a centralized IT process.

The dynamic nature of SaaS applications should ideally allow for centralized provisioning. A modern IAM solution should possess the capability to automate the onboarding process for new SaaS applications.

Adding users to the core directory service, like Active Directory (AD), should automatically trigger the provisioning of essential applications and role-specific access permissions based on their security group membership. Conversely, dealing with employee terminations proves more complex, as revoking access to SaaS applications typically depends on external application administrators. This leaves the company exposed, as former employees may still have access to crucial business applications and data.

An ideal IAM solution should not only support IT in adding new applications automatically but also:

• Automate the user deprovisioning process for all applications
• Establish in-depth integration with all user directories, including Active Directory(AD) and LDAP
• Maintain transparent audit trails.

Isolated user directories for every single application

Many enterprises have heavily invested in corporate directories like Microsoft AD for managing on-premises network access. As they embrace cloud services, it's prudent to maximize this investment by extending it to the cloud instead of creating a separate directory and access management system exclusively for new SaaS applications.

A top-notch cloud-based IAM solution should seamlessly integrate with your central AD or LDAP directory, offering centralized, ready-to-use integration. This enables you to effortlessly leverage and expand your investment to new applications without the need for on-premises hardware or firewall adjustments. When users are added or removed from this directory, access to cloud-based applications should automatically adapt, following industry standards like SSL, without requiring network or security configuration changes. It's a set-and-forget solution, streamlining access management across your entire environment.

Keeping application integrations updated

Achieving centralized SSO and user management involves integrating scores of applications and keeping up with their evolving versions, a task often impractical for IT departments. Today's enterprise cloud applications, built with advanced internet-optimized architectures, offer flexibility but pose integration challenges, especially regarding user authentication and management.

In both on-premises and cloud environments, applications evolve over time. Ideal hybrid IAM solutions should simplify various integration technologies and approaches, relieving IT of this complexity. With the proliferation and evolution of service APIs, it's essential for the cloud IAM provider to take charge of managing these interfaces. This relieves IT of the responsibility to monitor connector dependencies and application versions. In an ideal situation, the process of adding a new application should be as effortless as installing a smartphone app. It should demand only the slightest organization-specific configuration to ensure a smooth integration with Single Sign-On (SSO) and user management capabilities within minutes.

Compliance visibility

Understanding who has access to applications and data, plus where and how they utilize it is crucial, especially in the context of cloud services. However, most cloud service providers offer limited compliance reporting, often restricted to a single application.

Addressing auditor inquiries about employee access to applications and data comprehensively requires centralized vision and control spanning all your systems. Organizational IAM services should empower admins to configure access rights consistently across various services. Also, it must deliver centralized compliance reports that encompass access rights, provisioning, deprovisioning, and the activities of both users and administrators. This guarantees accountability and compliance throughout your entire IT infrastructure.