IAM Challenges Can Evaporate In The Cloud

Making sure that the right people have access to the right data at the right time can be difficult in an ever-changing business environment. What was once a closed, local network is now a globally connected web of people and devices. Multiple user identities and access points become more difficult to manage thus increasing the risk of a security breach. As organisations begin to interconnect with external users like partners, suppliers, and vendors, the risk of a security breach increases even further.

Verizon’s 2011 Data Breach Investigations Report finds that outsiders are responsible for 92 percent of breaches, which is a significant increase from the 2010 findings. However, although the percentage of insider attacks have decreased significantly over the previous year (16 percent versus 49 percent), this is largely due to the huge increase in smaller external attacks. As a result, the total number of insider attacks actually remained relatively constant. Privilege misuse has been identified to be the number one contributor. Given the difficulty of managing access for a user base that is constantly changing, this is no surprise. Adding mobile devices, remote users, and external partners and suppliers further adds to the complexity, increasing both cost and risk.

More from Biztech

The Incomplete Promise Of IAM

Identity and Access Management (IAM) is the security discipline that promises to make user access management more efficient and more secure. By centralising user management, organisations move closer to the elusive single (or simplified) sign-on and reduce the number of credentials to be managed. IAM can help companies integrate user access management to the extended enterprise, including partners and suppliers, as well as remote access to back-end resources such as file servers and applications.

You may already use software that offers centralised user access management. Most access management software provides policy-based user management, single sign-on to web-based applications, standards-based identity federation, and reporting for compliance requirements.

But identity and access management software has not quite lived up to its hype. It can be common to have organisational turf wars, long implementation times to integrate each application, and laborious development and maintenance efforts. This means a longer wait to demonstrate value. Additionally, total cost of ownership can be high with initial setup costs, high services-to-license ratios, and the need for specialised support staff.

IAM Moves To The Cloud

Cloud-based services are getting plenty of attention these days—and for good reasons. Moving to such a model with subscription-based pricing helps control both CAPEX and OPEX, manage the administrative and operational overhead, and lets an organisation focus on what they do best. Recognising the value of the cloud, a 2011 Forrester research report concluded that the global cloud computing market will grow from $40.7 billion in 2011 to more than $241 billion by 2020.

Like many other services, IAM is now available as a cloud-based service. By using providers who are experts in both cloud and security solutions, you can expect leading-edge security while eliminating the need for additional hardware and software. And, like most cloud services, organisations can expect to be up and running quickly, which is especially beneficial when the business requires it.

For example, a large pharmaceutical manufacturer found itself struggling to meet its IAM needs when they began doing three to four acquisitions per quarter. The acquisition and IT teams realised they were spending a lot of time and money trying to integrate user repositories and/or the applications they inherited. By using cloud-based IAM services, they would be able to rely on experts to help manage the integration and ongoing maintenance, allowing them to concentrate on the business side of their acquisitions.

Adding Federated Identity Enriches IAM

In addition to IAM, implementing federated identity can further reduce the burden of user access management by establishing authentication across systems and even across companies. By establishing a mutual trust agreement between systems, users will log in once and that authentication is passed between trusted systems. Federated identity not only reduces the number of credentials that a user needs to remember, but makes access to critical systems even faster.

However, federated identity can actually increase the complexity of security, as each system must establish trusted links with every other system, creating a web of connections. Cloud-based IAM removes the complexity of federated identity by acting as a broker, enabling authentication between systems, much like a hub with spokes. By removing the complexity, new “spokes” can be added quickly and easily, whether they are additional, internal systems or new systems as a result of a partnership or merger.

Protecting Company And Customer Data: The Highest Priority

As organisations continue to open their systems, it’s imperative to have an effective IAM solution that reduces the risks inherent in user access management. With today’s financial pressures, it’s easy to place IAM lower on the list of IT priorities, but nothing is a higher priority than protecting sensitive company and customer data.

Fortunately, a cloud-based IAM solution lets organisations quickly begin managing user access, while helping to control expenses and risk. Combining the expertise of IAM professionals and an IAM infrastructure based on security best practices, organisations can meet their security goals in less time and for less cost than an in-house solution. New users can be integrated quickly, allowing them to begin contribution to the business immediately.

The author is Principal Consultant, Identity Management at Verizon Business.