An identity access and management (IAM) system is a set of protocols that IT and security administrators use to positively identify a person and control that person's access privileges to networks, systems and data. Beyond providing access to the technology and resources employees and customers need, these enterprise security processes greatly reduce the risk of data loss through accidental file deletion as well as security breaches from malicious outside threats.
What is an access management system?
Access management is the process, software and hardware used to control and monitor admittance. These management systems are designed to ensure the proper user has the appropriate access to the right resources when they need them, regardless of how their role evolves or where it takes them.
You're already familiar with access management systems in the real world. In physical security, the best access control systems manage entry to buildings and doors, allowing businesses to set and then adjust levels of access based on the individual's needs as defined by management. These systems can also track which users have entered specific access points, enabling the use of data analytics to track employee movement inside secure areas and thus improve efficiency or identify suspicious activity and alert the appropriate individuals.
For example, a physical access management system could allow the business owner 24-hour admission to all areas of the building, as verified through a keychain tag with RFID technology, while access for employees may be restricted to normal business hours. That means that, if an employee were to attempt to enter the building during nonbusiness hours, they would be denied access and a record of their attempt would be noted.
In cybersecurity, an access management system limits access to systems, software and data based on the network user's digital identity. Once a user's identity is created, their network access can be monitored or adjusted as needed throughout the life cycle of their career or within the life cycle of a special project. These systems ensure the correct individuals in an organization have the appropriate access to the technology and resources they need to accomplish their objectives efficiently. Digital access management also keeps networks, systems and data secure from malicious actors.
Editor's note: Looking for the right access control system for your business? Fill out the below questionnaire to have our vendor partners contact you about your needs.
Why is IAM important?
Simply stated, identity and access management systems are essential to protect and control access to secure data.
In 2020, the average total cost of a data breach was $3.86 million, only a 1.5% reduction from the previous year, according to IBM's annual Cost of a Data Breach Report. Another daunting figure was the 280 days, on average, it took organizations to identify and contain their data breaches in 2020.
But outside threats aren't the only major and costly problem that IAM systems are designed to help mitigate. The report found that malicious actors were responsible for roughly 52% of the 524 breaches examined by IBM's cybersecurity experts, meaning systems and human errors accounted for less than half of all data breaches last year.
Proactively managing user identity and user access is a critical step in eliminating a significant portion of these easily avoidable and costly user errors that plagued many businesses in 2020.
For companies with valuable intellectual property, the cost associated with improper user access and mistakes can easily reach hundreds of millions of dollars. In January, Tesla filed a lawsuit against a former employee and software engineer for uploading files and scripts to a personal Dropbox account days after his employment began. Tesla claims the code in question could show competitors "which systems Tesla believes are important and valuable to automate and how to automate them — providing a roadmap to copy Tesla's innovation." Tesla spent an estimated "200 man-years of work" developing the code referenced in the complaint. According to Tesla, the uploaded files in question were "unrelated to his job."
With a better or more granular IAM system in place, the defendant in the Tesla case wouldn't have been granted access to files that were outside the scope of his work. Tesla was able to identify and contain the issue within 10 days, greatly reducing the potential impact. The defendant said the files were uploaded by mistake.
The COVID-19 pandemic also highlights the increasing importance of IAM for day-to-day operations as more companies and professionals continue the work-from-home trend. In 2021, the percentage of remote workers is expected to double, according to an Enterprise Technology Research survey of chief information officers.
Allowing employees to access the tools they need on numerous devices from anywhere in the world requires a robust, flexible and forward-thinking solution for identity and access management. Such a system includes automated workflows for onboarding employees and granting access to the applications and resources they've been authorized to use. IAM platforms also feature one-click controls for IT administrators to instantly remove users from all accounts, thereby saving time and money while ensuring security.
Features and functionality of IAM systems
Today's best IAM systems are designed, implemented and managed to evolve alongside the emerging cybersecurity and corporate trends in physical security. The ways we grant access are constantly changing with new technology, but the core features and functionality of identity and access management systems are here to stay. Here are some of those key features and capabilities:
- Managed identities: Whether through cloud IAM service or in-house systems protected behind the organization's firewall, the management of each user's identity is one of the core functions of every IAM system.
- User provisioning and deprovisioning: Once the verified user is in the database, the task of provisioning or assigning permissions for specific tools and resources (apps, software, financial information, medical records) can begin. The process of assigning and managing permissions to numerous resources with varying degrees of access can be tedious, which is why IT managers often enable role-based access, with permissions granted based on an individual's position or job function within the organization. IAM systems can automate this process to ensure the proper people have the correct level of access to the resources they need at the exact time they need them.
- Authentication: When a user requests access, IAM systems verify the correct identity based on secure information stored in a database, either in-house or through a cloud-based service. This task is increasingly completed through multifactor, situational and risk-based authentication.
- Authorization: After user authentication is complete, IAM systems authorize access to all of the user's permitted tools and resources based on that user's provisioning. If provisions are changed, adjustments in a user's authorizations can immediately follow suit to protect against improper use or data theft.
- Custom reporting: IAM systems can provide actionable data that stakeholders can use to improve their organization's security, productivity and profitability. Many IAM systems can provide custom, granular reporting based on the actions of each user in the database. In some instances, these reports are required to adhere to a variety of compliance regulations. In other instances, the reports can be analyzed to improve worker efficiency, eliminate unused services and increase security protocols where necessary.
What are the benefits of an identity management system?
Aside from data protection, the benefits of identity management systems are shared throughout an organization's stakeholders, vendors and customers. Here are some of the main advantages:
- Enhanced security: Data protection is the primary objective organizations are looking to accomplish with identity and access management systems. Through the proper control of user identification and access, businesses can greatly reduce their chances of a costly data breach, malicious data manipulation and unwanted access to secure information. A robust and properly managed IAM system helps organizations protect against outside threats – including cyberattacks, phishing, hacking and ransomware – and costly internal mistakes by employees.
- Streamlined compliance: IAM systems adhere to the principle of least privilege, in which the information and resources are strictly limited to the authorized users who need it for legitimate purposes. Applying these security principles can greatly minimize the impact of a data breach. When authorized users have access only to the information they need, anyone who successfully compromises their account will be greatly limited in what they can access and steal.
- Lighter IT workload: IT and security professionals working from a centralized hub can access and modify all user privileges throughout an organization in a single, sweeping action. Through the automation available from many IAM vendors, IT and support staff can save time by completing repetitive tasks, like password resets, based on predetermined protocols. And for the human resources department, the employee onboarding process is streamlined by granting access to a suite of tools and resources based on job roles. Similarly, the offboarding process is streamlined through the use of a centralized system that controls all user access across multiple resources.
- Improved user experience: IAM systems can make it much easier for users to access the technology and resources they need in a secure and convenient way. Instead of having to remember or record increasingly complex passwords, users can take advantage of biometric tools, such as fingerprint and facial scans, to gain access. They can also access multiple secure systems and services by logging in to all applications with a single sign-on. Companies can also provide outside contractors, suppliers and customers secure access to the resources they need, without compromising network security.
Types of IAM digital authentication
Granting access to the appropriate individuals or groups in an organization begins with the ability to identify the correct user positively and confidently. There are a variety of ways to accomplish this critical task, many of which you already encounter daily. Selecting the correct form of IAM digital authentication requires the right balance of convenience and complexity for your needs. Here are some ways to authenticate users:
- Unique passwords: The most common method of IAM digital authentication is a unique username-and-password combination to verify the user's identity. With a seemingly endless list of passwords and a variety of requirements for length and special characters, however, it can be tedious and time-consuming to reference (or remember) each one. As such, many companies are moving to single sign-on (SSO) authentication to lessen the number of passwords employees need to remember and type daily. With SSO, a user enters their username and password one time to access a suite of programs or services.
- Multifactor authentication: Multifactor authentication adds multiple layers of access security, frequently through the use of physical objects or identifiers. In a simple two-factor authentication, a user could be identified through a unique access token in addition to a username-and-password combination. In three-factor authentication, a user may have to verify their identity through a password, fingerprint scan and facial recognition.
- Biometric authentication: Biometric authentication relies on individuals' distinctive, measurable biological identifiers. Today's smartphones have made biometric authentication rather commonplace through the use of fingerprint scanners and facial recognition. However, DNA, palm prints, hand geometry, iris recognition, retinal scans and odor/scent can all be used to positively identify an individual in this context.
- Risk-based authentication: In risk-based authentication, context-aware smart networks can determine the level of risk and set new levels of security based on a multitude of factors for potential threats. As the perceived level of risk increases, so does the stringency placed on the authentication process. For example, if a customer attempts to access their secure account from an IP address not previously associated with the user or their device, they could be prompted with an additional security question (e.g., mother's maiden name, first pet's name, first car) to verify their identity.
- Identity as a service (IDaaS): The future of authentication for businesses looking to replace traditional authentication methods rests in cloud-based services. IDaas is an authentication infrastructure that relies on a third-party service provider to manage all user credentials. It offers the benefits of SSO, granting users access to multiple services, multifactor and biometric authentication, savings from lower implementation costs and an efficient credential management system to process a significant volume of accounts.