What is IAM? (Identity and Access Man­age­ment)

An in­creas­ing volume of data is generated and consumed every day, and this has con­se­quences for companies, gov­ern­ments, and other or­ga­ni­za­tions. They have to manage the data of thousands and thousands of users with different access rights, across a wide range of platforms and systems. Whether the users are customers, corporate partners, employees, or cloud providers, they all rely on networks. In fact, identity man­age­ment has grown to such an extent that it now often reaches far beyond an or­ga­ni­za­tion’s own in­fra­struc­ture.

But that’s not the only reason why companies and gov­ern­ments have to be so careful about managing and main­tain­ing data. They are also required to manage access rights on an ongoing basis to fulfill com­pli­ance reg­u­la­tions. The purpose of Identity and Access Man­age­ment, or IAM for short, is to manage user iden­ti­ties and the as­so­ci­at­ed access rights.

Due to the de­cen­tral­iza­tion of systems, global cloud access and the increased use of mobile devices, IAM is becoming the most important data man­age­ment solution. Without an Identity and Access Man­age­ment system it is almost im­pos­si­ble to keep track of which users need which rights, why and when they need them, and how they use those access rights on their device. IAM provides a way of nav­i­gat­ing through this labyrinth of data.

The larger a company, an or­ga­ni­za­tion or a gov­ern­ment, the more iden­ti­ties, accesses, and au­tho­riza­tions it has to manage. This is where Identity and Access Man­age­ment comes in useful. It sim­pli­fies and automates the col­lec­tion, ver­i­fi­ca­tion, and man­age­ment of user iden­ti­ties and access rights. That alone is a huge help, but as well as this, IAM systems help or­ga­ni­za­tions to fulfill their com­pli­ance oblig­a­tions. They ensure that all in­di­vid­u­als and services are correctly au­then­ti­cat­ed, au­tho­rized and verified, and that all access rights cor­re­spond to the defined policies and the user’s role within the company.

Thanks to IAM, users can quickly and securely access various systems, ap­pli­ca­tions, cloud struc­tures and so on. This process is known as pro­vi­sion­ing. The opposite process – de­pro­vi­sion­ing – can also be done via IAM. These prin­ci­ples form the basis of Identity and Access Man­age­ment, which is based on roles and rules.

In many cases, accesses and access au­tho­riza­tions can be de­ter­mined by users them­selves. With self-service portals or fully automated sign-up and approval processes, all the re­spon­si­ble parties are nonethe­less involved so that control and security never get out of hand.

Some IAM terms:

• Access Man­age­ment is about mon­i­tor­ing and con­trol­ling network access.
• Context-aware Network Access Control is a policy-based method for accessing network resources which considers the user’s context.
• Identity Lifecycle Man­age­ment covers all the processes and tech­nolo­gies used to store, delete, and maintain digital iden­ti­ties.
• Identity Syn­chro­niza­tion ensures that different systems all receive the same in­for­ma­tion for a par­tic­u­lar digital identity.
• Multi-Factor Au­then­ti­ca­tion (MFA) is an au­then­ti­ca­tion method that requires more than one factor (password and username). Two-factor au­then­ti­ca­tion is one example of this.
• Risk-Based Au­then­ti­ca­tion (RBA) is a flexible type of au­then­ti­ca­tion which allows a user to log in to a network from a new location for instance.
• Security In­for­ma­tion and Event Man­age­ment (SIEM) provides a broad overview of IT security, including any sus­pi­cious events and current attack trends.
• User Behavior Analytics (UBA) involves analyzing user behavior to detect security threats.

The main role of IAM is to assign each user a digital identity. Once this identity has been es­tab­lished, it has to be main­tained, updated and monitored. Identity and Access Man­age­ment systems provide ad­min­is­tra­tors with the tools they need to modify user roles within their network, monitor ac­tiv­i­ties, generate reports, or simply enforce security policies.

IAM systems are designed to cover the access au­tho­riza­tions of an entire network, including all internal and external com­pli­ance reg­u­la­tions. Con­se­quent­ly, they include a wide range of tech­nolo­gies, tools, software, and apps, including password managers, pro­vi­sion­ing software, and apps for security policies, reporting and IONOS Help: "How to create a mon­i­tor­ing policy".

IAM systems need these features to be flexible, powerful, and secure enough to meet today’s re­quire­ments. Simply au­then­ti­cat­ing or mon­i­tor­ing users in a system is no longer suf­fi­cient. That’s why Identity and Access Man­age­ment now goes much further. It provides a simple way of managing user access rights in­de­pen­dent­ly of location or network, whether that means customers all over the world, or employees working from home. This applies to hybrid en­vi­ron­ments too, from SaaS computing to modern BYOD man­age­ment. The functions of IAM make the system flexible enough to run on all common IT ar­chi­tec­tures: Windows, Mac, Android, iOS, UNIX, and IoT devices.

However, having so many pos­si­bil­i­ties also increases the security risk. The more complex an IT en­vi­ron­ment, the more complex the threat situation. At a basic level, IAM systems regulate access using con­ven­tion­al au­then­ti­ca­tion methods like passwords, hardware tokens, digital cer­tifi­cates, and card systems. Modern Identity and Access Man­age­ment systems use biometric au­then­ti­ca­tion on top of this: fin­ger­prints or facial recog­ni­tion on smart­phones for instance.

And nowadays, machine learning and ar­ti­fi­cial in­tel­li­gence are also being used to ensure the best possible pro­tec­tion of user data. Let’s take a look at an example. Companies today rely on IAM systems that use Multi-Factor Au­then­ti­ca­tion. The factors are: the password chosen by the user, the user’s smart­phone, and the related au­then­ti­ca­tion method (fin­ger­print, or face or iris scanning). That’s already three factors that verify the user’s identity.

IAM functions serve a practical purpose as well as ensuring security. For example, they have a mechanism that allows users to use a single login for several networks. This feature is par­tic­u­lar­ly widely used in today’s smart­phones. By logging in to just one account (Google or Facebook for example), users can access all kinds of apps which would otherwise require them to sign in. Private users really ap­pre­ci­ate this, because it means they don’t have to set up new login details for each account.

This model is known as federated IAM. It relies on co­op­er­a­tion and trust between the parties. Providers like Google and Facebook vouch for their users by allowing them to use their account to log in to partner sites or apps. The technical function at work here is called Single Sign-On (SSO). Once verified, users can use the same identity to log in to multiple networks. Au­then­ti­ca­tion between the different partners takes place in the back­ground without the user realizing, via an identity protocol such as Security Assertion Markup Language.

The ad­van­tages of IAM can best be un­der­stood by con­sid­er­ing the dis­ad­van­tages of not using it, or of only using a very basic system. If a platform cannot clearly identify its users and assign them the ap­pro­pri­ate rights, problems will arise very quickly. And the bigger the platform, the more problems there will be. Using a smart Identity and Access Man­age­ment system sim­pli­fies and automates the process of col­lect­ing and con­trol­ling user data. It ensures com­pli­ance with policies and allows ad­min­is­tra­tors to monitor user behavior and platform service per­for­mance.

The biggest benefit of IAM is its all-en­com­pass­ing nature. Whether on a mobile device, a de­cen­tral­ized IT system or globally via the cloud, IAM can be used every­where.

The slight drawback is that each or­ga­ni­za­tion has to find the right IAM system for its needs. IAM re­quire­ments are largely the same in all systems, so a single solution can fit all. However, each company has its own pro­ce­dures, its own systems, tools, and pri­or­i­ties, and even its own phi­los­o­phy. In fact, this is often a stumbling block that companies and gov­ern­ments encounter when im­ple­ment­ing an IAM system. It has to be supported by every single de­part­ment and not con­sid­ered to be the re­spon­si­bil­i­ty of IT alone. For this to be possible, fun­da­men­tal questions have to be answered in advance, for example, who should have access to what? The next questions to ask are “who will control access” and “what should happen if something is not correct”? In other words, it is essential that or­ga­ni­za­tions take a holistic approach to defining roles and access rights.

After this, an ar­chi­tec­ture concept can be created. It’s important to remember that as well as users, there might be other systems, partners, as­so­ciates, suppliers, customers, employees, and so on to take into account. Depending on the industry, it might also be necessary to define reg­u­la­tors and auditors, to scale the number of users for instance.

A cen­tral­ized system like this is of course an at­trac­tive target for hackers. Con­se­quent­ly, newer IAM systems in­cor­po­rate a tamper-proof blockchain to prevent cyber criminals from tracking or col­lect­ing login cre­den­tials.

Identity and Access Man­age­ment is used anywhere that users need to be au­then­ti­cat­ed and au­tho­rized. Nowadays, managing user iden­ti­ties and access rights for networks, ap­pli­ca­tions, and other digital systems is the norm.

If a user wants to use a system or an app, they usually have to prove that they are au­tho­rized to do so. In most cases this means logging in with a username or an email address and a password. More modern systems use com­bi­na­tions of key cards, biometric au­then­ti­ca­tion, and smart­phones.

In fact, even for purely practical reasons, companies today cannot afford to operate without an IAM system. By au­tomat­ing so many aspects of identity man­age­ment, IAM systems take pressure off IT de­part­ments. Helpdesk staff no longer have to manually deal with time-consuming processes like resetting user passwords.

Even more es­sen­tial­ly, Identity and Access Man­age­ment forces companies, gov­ern­ments, and other or­ga­ni­za­tions to define com­pre­hen­sive in-house data policies. At the end of the day, this is a good thing not just for the network, but in terms of data security overall.