Identity and access management (IAM) in enterprise IT defines and manages the roles and access privileges of individual network users and the circumstances in which users are granted or denied those privileges. IAM is used to control user access to critical information within an organization. For any enterprise, IAM is crucial in order to become significantly more agile in supporting business initiatives and meeting ever-changing compliance requirements.
Jump to:
- What is identity and access management?
- History of identity and access management
- How IAM works
- Why is IAM important?
- Pros and cons of identity and access management
What is identity and access management?
Identity and access management authenticates users and systems and sets controls and limitations for who can access enterprise systems. IAM and IAM tools work to secure systems and sensitive company data. They do this through:
- Password management
- Two-factor and multi-factor authentication
- Provisioning software
- Reporting and monitoring applications
- Biometrics
- Behavior analytics
One technology that plays a major role in IAM is artificial intelligence: it’s necessary for automating behavior analytics and monitoring users and networks. AI-based security and authentication tools, such as IAM, analyze network traffic and user behavior patterns and alert IT teams when anomalies arise. These anomalies can signal that a system has been breached or that data is being compromised.
Enterprises have traditionally deployed IAM systems on-premises, but most organizations have made the move towards a cloud-based subscription or hybrid model.
An IAM system should:
- Capture and record user login information
- Manage enterprise databases of user identities
- Arrange assignment and removal of access privileges
- Provide a central directory
- Manage digital identities of devices and applications
- Restrict access to subsets of data based on specific roles.
Before an IAM system is implemented, businesses should identify who will play a lead role in developing, enacting, and enforcing identity and access policies.
Read More: 8 Best Password Managers & Tools
History of identity and access management
IAM is not a new concept or solely a technology. In past decades and centuries, identity and access management would mean showing proof of credentials to be able to enter a certain location, whether physical or digital, or receive certain privileges. This includes:
- Titles (such as king, countess, bishop)
- Birth certificates, which were introduced to the United States in the 19th century
- Driver’s licenses, which certify users to drive cars legally
- Passports, which permit users to travel
- Simple username and password controls, before the era of MFA and biometrics
A shift to cloud-based access management necessitated identity confirmation and access controls that were more secure than a simple username and password.
How IAM works
Identity and access management helps secure physical premises, requiring identification to pass through enterprise doors, and requires authenticated, authorized users for all company applications.
Components of an IAM platform include:
- Provisioning: When an IT team or organization sets up IAM, they must determine access levels and permissions for all users. Teams often perform automated provisioning through policies—when a user has a particular role label, they’re assigned access levels automatically based on that.
- Requests. When a user seeks to access a system, they send a request to the service (such as a web application). A request typically includes data such as IP address and tags attached to the request.
- Authentication. Users must have credentials to prove their access rights to the system. Authentication options include biometrics, real-time field validation, and email confirmation.
- Authorization. Users must be authorized to perform certain actions within a system, like viewing data or creating and deleting other users.
Before an IAM system is implemented, businesses should identify who will play a lead role in developing, enacting, and enforcing identity and access policies. This might be a particular department, commonly IT or HR, or a collaborative cross-departmental team.
Why is IAM important?
The shift to cloud computing makes network and account access much more flexible and streamlined for in-office and hybrid workforces. However, it also increases the opportunity for breaches and falsified identities. Because cloud-based systems and interconnected networks permit more lateral movement—movement between X and Y—the chances of attackers breaching multiple systems rise.
Simple username-and-password based systems are no longer enough: stolen credentials and sophisticated attacks allow hackers to breach accounts. Man-in-the-middle attacks, brute-force attacks, and reused session keys are just a few methods of breaching enterprise accounts. IAM seeks to secure user accounts by requiring more stringent controls.
Data breaches can cost millions of dollars; in 2019, experts calculated that one data breach would set a business back by $200,000, enough to send a small company out of business. This doesn’t take into account the costs of large-scale breaches. The Identity Management Institute estimates that data breaches will cost companies $5 trillion by 2024; for most businesses, that’s much more money than they make in one year (or will ever make). Breaches also increase the likelihood of losing customers’ trust. Strict identity and access controls reduce the risk of breaches by limiting the ways attackers can breach systems and by managing legitimate users more closely.
Identity and access management are also crucial for maintaining compliance with data protection regulations. Regulatory standards like the GDPR expect organizations to know each person who has access to personal data and when they accessed it. IAM is important because it tracks data access, allowing enterprises to manage one aspect of their compliance.
See the top IAM providers: Best IAM Tools
Pros and cons of identity and access management
Pros
- IAM allows companies to extend access to its IT systems across multiple components without compromising security.
- The number of help desk calls to IT support regarding password resets are decreased because they can be automated.
- Internal and external breaches are reduced because control of user access is greater.
- IAM systems strengthen compliance by providing tools to implement security, audit, and access policy.
- IT management is streamlined and ROI is enhanced.
- IAM software typically has both cloud and on-premises options.
Cons
- Incomplete deployment or failure to set up a thorough strategy or methodology results in ineffective IAM. IAM can be a strong security force, but it has to be planned and clearly laid out to truly benefit enterprises.
- Some IAM solutions have security gaps or flaws, such as misconfigurations. Misconfigurations are one of the greatest threats to identity and access security: when policies and permissions get muddled, users’ privileges can be accidentally escalated. The resulting authorization increases the chance of data access being too widely distributed to too many users, which consequently increases the chance of a breach.
View the industry’s top eight IAM solutions for securing accounts and protecting systems.
This article was updated October 2021 by Jenna Phipps.
