{"id":3488,"date":"2022-11-21T10:37:28","date_gmt":"2022-11-21T15:37:28","guid":{"rendered":"https:\/\/www.indigoconsulting.ca\/?p=3488"},"modified":"2024-01-31T18:14:55","modified_gmt":"2024-01-31T23:14:55","slug":"shaping-the-future-of-iam","status":"publish","type":"post","link":"https:\/\/www.indigoconsulting.ca\/fr\/blog\/shaping-the-future-of-iam\/","title":{"rendered":"8 trends shaping the future of Identity and Access Management"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>

Identity and Access Management (IAM) has always been a critical technology for the enterprise.\u00a0<\/span><\/p>

Yet <\/span>COVID-19 somehow made it even more essential<\/span><\/a> as businesses sought to support distributed work and cloud adoption in the face of an increasingly sophisticated threat landscape.\u00a0<\/span><\/p>

As the world continues to embrace digital transformation, the IAM market will continue to grow, <\/span>reaching an estimated $34.52 billion USD globally by 2028<\/span><\/a>.\u00a0<\/span><\/p>

So, what\u2019s driving the rise of IAM? The trends defining this growth are many and varied, ranging from user expectations and emerging technologies to sociopolitical factors. In this article, we\u2019ll tackle a few of the biggest trends we see driving IAM forward.<\/span><\/p>

Digital Identification for Digital Lives<\/span><\/strong><\/h2>

During the pandemic, contactless payments and virtual currency became the norm for retail. People increasingly lived their lives online, connecting with one another via platforms like Zoom. Even once the pandemic ends, this digitalization will remain.\u00a0<\/span><\/p>

And as more people continue to embrace it, we will need to change how we approach and understand identity.\u00a0<\/span><\/p>

We’re already seeing this to some extent with banking. The Bank of Canada, for instance, is <\/span>exploring the development of a new type of currency<\/span><\/a>. Known as Central Bank Digital Currency, it would be issued either as a response to widespread adoption of private digital currency or the inability of Canadians to access and use cash.\u00a0<\/span><\/p>

Such currency could even be programmable. Funds in an account holder’s wallet might be tied directly to them, making theft or fraud considerably more difficult. Money given by certain programs could be coded to only be spendable on approved categories like food or housing.\u00a0<\/span><\/p>

Identity remains the underlying issue here. Achieving something of this scope and scale would require some sort of national, government-approved digital ID. The ramifications of this go far beyond banking.\u00a0<\/span><\/p>

On the one hand, digital ID is immensely beneficial to businesses, which have easier access to credit data, virtual transactions, and demographic information. Digital ID will also make it easier to onboard new vendors, employees, and partners while also enabling better personalization for customers. The challenge lies in <\/span>managing <\/span><\/i>all of this information.\u00a0<\/span><\/p>

Businesses will need a means of securely managing and organizing these digital IDs, a fact which will necessitate more effective, robust federation, authorization, and provisioning.\u00a0<\/span><\/p>

Zero Knowledge Proof<\/span><\/strong><\/h2>

Multiple social networks and online services over the years have flirted with requiring real-world information, with varying levels of success. The central concern raised time and again is the scope of requested data. We’re encouraged \u2014 perhaps even expected \u2014 to overshare, potentially showing details about our personal lives to the entire world.\u00a0<\/span><\/p>

This not only makes it easy for bad actors to collude and sell personally-identifiable data online, but also opens up a potential hornet’s nest. The Internet is brimming with examples of what happens when its less savory elements obtain details like a person’s home address. We’ve seen everything from stalking to life-threatening practical jokes to devastating harassment campaigns to outright murder.\u00a0<\/span><\/p>

The concept of Zero Knowledge Proof (ZKP) represents a solution to this problem. The basic idea is that when you’re asked for verification, you’ll provide the <\/span>bare minimum <\/span><\/i>amount of required data. Let’s say, for example, you go to a bar for a drink.\u00a0<\/span><\/p>

Traditionally, you’d need to present your ID, which includes everything from your address to your date of birth. Under a ZKP framework, a trusted third party would simply tell the bar that you’re over eighteen. Bar staff wouldn’t necessarily even need to know your name.\u00a0<\/span><\/p>

ZKP could also extend to authentication for everything from online banking to network access, greatly streamlining IAM in the process.\u00a0<\/span><\/p>

Decentralized Identity<\/strong><\/span><\/h2>

Blockchain represents arguably the best way to ensure ZKP through a concept known as decentralized identity. The basic idea is that everyone would have their own ‘identity wallet’ that could be used for authentication without revealing anything the user doesn’t want known about themselves. On a more macro level, decentralized identity also eliminates the need for separate identities between applications and services.\u00a0<\/span><\/p>

A user could seamlessly leverage their identity wallet for every business with which they interact. On the enterprise side of things, allowing users to manage their own data and personas makes for easier compliance and authentication. With that said, analyst Gartner rightly notes that IAM capabilities will <\/span>need to evolve so that they align with a cybersecurity mesh architecture<\/span><\/a>.\u00a0<\/span><\/p>

Identity is a great fit for blockchain technology no matter how you look at it. However, in order to enable it, we must first topple existing constructs and concepts. That means moving away from how we currently perceive identity \u2014 a shift which will likely take a great deal of time.\u00a0\u00a0<\/span><\/p>

The Intersection of Identity and Zero Trust<\/span><\/strong><\/h2>

IAM and Zero Trust go hand-in-hand. Identity-based authentication is not only more efficient than purely device-based authentication, it’s also more effective at verifying a user is who they claim to be. Linking a user to the devices they typically use, the locations from which they typically log in, and the behaviors they typically display makes continuous authentication far easier to accomplish.\u00a0<\/span><\/p>

Many IAM platforms have already evolved to include device and information management capabilities \u2014 the capacity to link each user to a semantic network of data regarding who they are and how they work. This evolution will continue as more and more businesses adopt Zero Trust.\u00a0<\/span><\/p>

Passwordless Authentication Continues to Gain Ground<\/span><\/strong><\/h2>

The fact that password-based authentication is outdated and insecure is widely-known. Security experts have been calling for an end to passwords for years. Solutions like multifactor authentication currently exist largely as a band-aid for the inherent weaknesses of usernames and passwords.\u00a0<\/span><\/p>

Passwordless authentication, we’re told, is the future of cybersecurity, a future guided largely by IAM. Unfortunately, accessible alternatives have typically been few and far between. Methods such as biometric or location-based authentication, while valuable, have proved insufficient on their own.<\/span><\/p>

It’s through the exploration of trends such as decentralized identity that we find a possible solution. A user that authenticates through an immutable, unassailable asset like a digital identity wallet has little need for a username and password. Multifactor authentication again provides an extra layer of verification, and the entire system is considerably more secure than it would be with passwords.\u00a0<\/span><\/p>

A Poor User Experience is No Longer Acceptable<\/span><\/strong><\/h2>

User experience is a cornerstone of effective cybersecurity, and has been for quite some time. This applies equally to IAM solutions. With digital interactions and identity management becoming increasingly prominent in our professional lives, businesses that offer a poor user experience will find themselves falling progressively further behind.<\/span><\/p>

Gartner predicts that by 2024, organizations that provide a great overall experience will <\/span>outperform competitors by 25% in satisfaction for both customers and employees<\/span><\/a>. That translates to better productivity, increased revenue, and reduced turnover. For IAM specifically, Gartner recommends the following:\u00a0<\/span><\/p>