Identity Management (IdM) Systems: Explained

Identity

6 min read Aug 26, 2021

Identity Management (IdM), a subset of Identity and Access Management (IAM), is a framework of policies and processes that enables the smooth management of user identities and personas within organizations. This methodology allows smooth management of employee roles and permissions from one centralized location. But while this sounds good on paper, there are numerous roadblocks that companies are facing today. Let’s take a closer look.

Identity Management frameworks make life easier by allowing the provisioning (and deprovisioning) of users, assigning appropriate licences within cloud apps, and of course managing permissions. However, picking the right solution is crucial, especially while scaling up fast and onboarding (and offboarding) dozens of new employees (many of them remotely) on a daily basis.

What is Identity and Access Management (IAM)?

Identity and Access Management (IAM) solutions are helping create a sustainable and scalable way to manage their end-user identities and data access permissions. These solutions are also helping organizations manage their employees (on-prem and remote) in a secure and organized manner, which is becoming more and more crucial due to the ongoing COVID-19 pandemic.

IAM helps SaaS businesses achieve key goals. Some of them include:

Identifying and validating end-users
Properly defining and enforcing roles within the company
Monitoring access activity and understanding the data flow
Creating different levels of access based on positions and roles
Managing (creating, modifying, removing) permissions in real time

Firstly, this methodology helps simplify user management protocols and information sharing processes, while also helping elevate security standards and significantly reducing the probability of internal data leaks (or fraud). Data privacy has become a big concern today with regulatory watchdogs already issuing hefty fines for GDPR, CCPA, and HIPAA violations in Europe and the US.

IAM solutions typically include security tools like encryption, firewalls, data loss prevention (DLP), database monitoring, and customizable alerts.

How does an Identity Management lifecycle look?

As shown in the illustration below, once provisioning is done, the end-user is validated with services like Single-Sign On (SSO), Pre-shared Key (PSK) or Multi-Factor Authentication (MFA). Then comes the Authorization stage, where the access rights are granted to the relevant end-user. This stage should be monitored closely to keep track of access and data flow.

The central user repository hosts all important identity details and information. It serves as a verification hub for all submitted credentials. It can have a meta-directory, where data from various identity sources is merged into one meta-set. There are also virtual directories, where a centralized LDAP view of consolidated identity data is obtained by combining different user sets (databases).

Did You Know?
As per a recent Digital Shadows research, 97% of top 1000 global companies have experienced some kind of internal data leak.

Also, modern IAM solutions should be supporting Security Access Markup Language (SAML) and OpenID Connect (OIDC) to avoid integration issues.

Top 5 IAM Roadblocks in Modern SaaS

Social engineering (over 20% of cyber attacks today involve phishing) and brute force attacks are being used extensively to gain illegal and unauthorised access to databases and repositories. As per a Proofpoint study, 60% of attacks result in stolen personal records, but companies also need to avoid ransomware and malware infections that can be extremely harmful. Ask Accenture.

What are the roadblocks that companies are facing with their Identity Management and what are the reasons for today’s rise in cybercrime?

1. Excessive Permissions (No Zero-Trust Policy)

This is one of the biggest challenges organizations are facing today, even with comprehensive identity and access management solutions in place. With so many new workers joining and leaving the taskforce, streamlining or revoking unrequired permissions becomes extremely difficult. This is before we mention remote work and freelancers joining the company on a temporary basis.

Best Practice: Exercise the Principle of Least Privilege (PoLP) across all channels in your organization. Provide users with minimal levels of access needed. This can’t possibly be done manually in enterprise setups. Check out the latest AI-based analysis tools and secure your perimeter. Eliminating these loopholes will make it harder (albeit not impossible) for the hackers.

2. Third-Party Application Security

The modern organization is not operating in a bubble anymore, nor is it relying solely on proprietary software. The rapid digitalization of the online space is introducing dozens of distributed apps (Dropbox, Salesforce, etc.) into the organizational ecosystem. While these apps boost productivity and allow faster business growth, they also expand the attack surface significantly.

Best Practice: This is where comprehensive identity management solutions come into play. They need to have a centralized dashboard for enhanced visibility and creating a sharable 360 view of all active applications in the organizational landscape. The solutions should also provide information about where the critical apps are being hosted or migrated. Eliminate the blind spots!

3. Compliance and Regulatory Requirements

Data privacy is no longer just a casual buzzword thrown around randomly in cybersecurity circles, nor is it solely the CISOs problem. All organization members need to play a proactive part in achieving General Data Protection Regulation compliance in the European Union (EU) or adhering to the California Consumer Privacy Act (CCPA) guidelines in the United States. The heat is on.

Best Practice: Besides having good identity management software in place, your organization needs to create an airtight identity management lifecycle. How? By having strict policy-based controls in place. Job roles and requirements need to be documented and updated on an ongoing basis, not to mention the automation of audit log creation for offline scrutiny and optimization purposes.

4. Manual Provisioning and Deprovisioning

When identity and access management concepts were materializing a few years ago, it was a common practice to have a dedicated IT worker to handle all provisioning (and deprovisioning) tasks. This included granting new permissions or revoking them. But as companies started to grow and requirements multiplied, issues like misconfigurations and other bottlenecks arose.

Best Practice: Firstly, you must make sure that your identity management software is capable of provisioning you with a centralized dashboard with misconfiguration detection alerting. When your IT teams can easily onboard and offboard employees, they can start focusing on internal training and optimization procedures, while eliminating excessive permission cases and mitigate app stack misconfigurations.

5. End-User Password Fatigue

Passwords are everywhere today. Every employee is using at least a dozen applications in the modern workplace. Self-served SaaS applications can reduce the “pain” to a certain extent, but logging in from on-prem machines and laptops while working from home can become a tiring routine that has a direct effect on productivity and connectability (think about workers getting locked out).

Best Practice: Single-Sign On (SSO) is becoming an essential requirement while selecting the right identity access and access management framework today. The added benefit of having SSO is that it works well with on-prem and cloud-based applications, giving organizations added flexibility while scaling up or expanding the offices to other geographical locations.

Needless to say, all of the aforementioned best practices are not worth much if your employees are not onboarded properly or trained on an ongoing basis.

Identity Management Systems: For a Safer Workplace

Before SaaS exploded in the B2B space around a decade ago, losing a password or maliciously getting locked out of an account was not a big deal. But today, a stolen password is much more than a lost account – it’s a compromised identity. These credentials can give hackers multiple entry points into sensitive databases and lead to massive data breaches that can be hard to contain.

Besides the obvious brand damage, operational losses, and remediation efforts, your organization is also looking at hefty regulatory fines and implications.

The bottom line is that only a secure and airtight identity management system can allow organizations to focus on their product roadmaps with minimal operational and security distractions. The amount of time developers can free up is key when it comes to achieving sustainable compliance and creating a mature product offering with minimal time-to-market (TTM).

Aviad Mizrachi