{"id":3732,"date":"2023-04-25T16:10:34","date_gmt":"2023-04-25T20:10:34","guid":{"rendered":"https:\/\/www.indigoconsulting.ca\/?p=3732"},"modified":"2024-01-31T18:17:09","modified_gmt":"2024-01-31T23:17:09","slug":"exploring-critical-capabilities-of-iam","status":"publish","type":"post","link":"https:\/\/www.indigoconsulting.ca\/fr\/blog\/exploring-critical-capabilities-of-iam\/","title":{"rendered":"Exploring (and explaining) the critical capabilities of Identity and Access Management"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>

Gartner is largely regarded as an authority on the technology sector. Particularly where cybersecurity is concerned, it’s one of several firms that essentially defines the landscape and market.\u00a0<\/span><\/p>

Gartner’s 2022 Critical Capabilities of Identity and Access Management report<\/span><\/a>, published in November, provides a lot of valuable insights into the industry.\u00a0<\/span><\/p>

While there’s undeniably important information contained within that report, it isn’t particularly easy to parse without a technical background. That’s where we come in.<\/span><\/p>

We’ll explore each of the major talking points \u2014 each of the critical capabilities of IAM \u2014 to explain them in more understandable terms, including why they’re important.\u00a0<\/span><\/p>

Then we’ll go over the major talking points to explain them in simpler terms, including what they mean for your business.<\/span><\/p>

\u00a0<\/span><\/p>

Workforce Identity vs. Customer Identity and Access Management (CIAM)<\/span><\/strong><\/h2>

CIAM and workforce identity, also known as IAM, are two similar but different frameworks that secure access to IT systems, resources, and user accounts. Both share similar technologies, such as Single Sign-On (SSO), Multi-Factor Authentication (MFA), and identity behaviour monitoring.\u00a0<\/span><\/p>

Additionally, <\/span>both CIAM and workforce identity<\/span><\/a> lay the groundwork for the zero-trust model. These new frameworks understand that there are no longer concrete boundaries locked up between four walls. Instead, the modern enterprise architecture is a collection of SaaS platforms, APIs, and third-party access.<\/span><\/p>

However, CIAM and workforce identity management are fundamentally different in their core goals, despite having similar technologies. CIAM strives to enhance the end-user experience, cut down or eliminate fraud, and store consent to privacy policies. Conversely, IAM focuses on better user provisioning, more secure authentication, and robust universal directories.

<\/span><\/p>

Why This Matters<\/span><\/strong><\/h4>

Both IAM and CIAM are critical to managing internal and external identities. CIAM is not only necessary for consumer-facing businesses; even B2B operations will need a secure way to handle partners and clients.<\/span><\/p>

Ultimately, the move to zero trust architecture is the next significant step for enterprises to improve security at every level. Embracing CIAM and workforce identity management is a necessary step toward embracing zero trust.<\/span><\/p>

\u00a0<\/p>

Connecting to Directory Services<\/strong><\/span><\/h2>

This feature is one of the pillars of IAM, allowing a platform to manage both internal and external identities while also synchronizing those identities through the <\/span>SCIM open standard<\/span><\/a>. It’s important to note that in a modern context, these identities are not solely limited to human users. Physical devices, IoT devices, services, applications, automated processes, and scripts may also possess their own identities.

<\/span><\/p>

Why This Matters<\/span><\/strong><\/h4>

As noted by our partner ForgeRock<\/span><\/a>, directory services are essentially databases that store business-critical information such as credentials, authentication preferences, application data, and device information. It follows, then, that if an IAM platform cannot securely integrate with directory services or manage its own, it may as well be non-functional.\u00a0<\/span><\/p>

\u00a0<\/p>

Access Administration<\/span><\/strong><\/h2>

Access administration can be divided into two segments, internal and external. Internal access administration covers onboarding, provisioning, password management, profile management, lifecycle management, and general administration for employees. External access management encompasses very similar functionality for external users, while also supporting federation with third-party identity providers, third-party credential management (BYOI), and consent management.\u00a0

<\/span><\/p>

Why This Matters<\/strong><\/span><\/h4>

Administration is all about keeping your organization in control \u2014 of its systems, its assets, and its ecosystem. Without the ability to directly manage users, particularly provisioning and deprovisioning, your organization’s identities spiral into chaos. Picture an organization where every single user account is a domain administrator, and you’ve a good idea of how that might look.\u00a0<\/span><\/p>

\u00a0<\/p>

Developer Tools<\/span><\/strong><\/h2>

Developer tools, as the name suggests, allow an IAM platform to support open standards, application programming interfaces (APIs), and documentation. Some IAM tools also provide software development kits (SDKs). There’s also an increasing trend towards low-code or no-code development tools.\u00a0

<\/span><\/p>

Why This Matters<\/span><\/strong><\/h4>

If your organization wants to embed IAM controls into an internally-developed application, it needs an IAM platform with built-in development tools.\u00a0<\/span><\/p>

\u00a0<\/p>

Authorization and Adaptive Access<\/span><\/strong><\/h2>

Simply put, adaptive access allows an IAM solution to manage and modify policies, controls, and access decisions based on contextual data. This enables a more dynamic and flexible approach to access management. More advanced solutions may also integrate features such as behavioral analysis and fraud detection.\u00a0

<\/span><\/p>

Why This Matters<\/span><\/strong><\/h4>

In today’s threat landscape, risk is no longer static. Without the capacity to flexibly and automatically assess risk, you’ve no option but to unilaterally apply access controls and decisions without regard for context. In a world of distributed work and sprawling digital supply chains, that’s a dangerous prospect.<\/span><\/p>

\u00a0<\/span><\/p>

SSO and Session Management<\/strong><\/span><\/h2>

Session management allows your organization to exercise global control over session times and access tokens. Single Sign On (SSO) is closely related to session management, allowing a user to authenticate to an entire suite or collection of applications with a single login.
\u00a0<\/span><\/p>

Why This Matters<\/strong><\/span><\/h4>

This capability matters for two reasons. First, SSO makes security and authentication significantly less painful for users, consequently making them less likely to try circumventing your organization’s security controls. Session control, meanwhile, can greatly reduce overall risk.\u00a0<\/span><\/p>

As an addendum, this also applies to deployment and administration \u2014 a system that’s difficult to use and integrate is hardly worth the effort.<\/span><\/p>

\u00a0<\/span><\/p>

User Authentication<\/strong><\/span><\/h2>

User authentication is precisely what it sounds like. It’s how the IAM platform identifies and grants access to legitimate users. In addition to standard credential-based authentication, this includes multi-factor authentication (MFA).\u00a0

<\/span><\/p>

Why This Matters<\/strong><\/span><\/h4>

Every <\/span><\/i>organization, no matter its market or industry, should incorporate MFA into its login processes. The additional layer of security it offers usernames and passwords can often prevent an account from being compromised, and thereby prevent a data breach.<\/span><\/p>

\u00a0<\/span><\/p>

API Access Control<\/strong><\/span><\/h2>

Essentially, this feature controls authentication and authorization to an API rather than a network, device, or application. As you’ve likely guessed, this functionality is largely geared towards application developers.\u00a0

<\/span><\/p>

Why This Matters<\/span><\/strong><\/h4>

By applying IAM controls to an API, the APIs owner can ensure that only users with legitimate credentials are granted access. This enables much finer, more granular control over who can leverage your resources and how.\u00a0<\/span><\/p>

\u00a0<\/p>

Application Enablement<\/strong><\/span><\/h2>

Another critical foundation of IAM, application enablement allows access, SSO, and authentication to both standard SaaS applications and non-standard legacy applications.In some cases, IAM platforms that support non-standard application enablement may also support servers, VPNs, and network devices.\u00a0 Standard application enablement leverages protocols such as OpenID Connect and SAML.
\u00a0<\/span><\/p>

Why This Matters<\/strong><\/span><\/h4>

Simple \u2014 if your IAM tool doesn’t support application enablement, then you can’t use it to manage authentication or authorization to any of the apps or systems your business uses.\u00a0<\/span><\/p>

\u00a0<\/p>

Analytics & Reporting<\/strong><\/span><\/h2>

This capability actually encompasses several distinct features.\u00a0<\/span><\/p>