With so many devices and users accessing networks, applications and data, identity access management (IAM) has become a cornerstone of cybersecurity best practices. The short explanation is that you must make sure everyone (and everything) is who they claim they are. You also need to make sure they are allowed to have the access they’re requesting.

Multiple options for identity access management exist today. You might encounter privileged access management (PAM), identity-as-a-service (IDaaS) or cloud permissions management (CPM). So, choosing an identity management approach can be confusing. Which acronym is right for you?

Identity Management Becoming More Important

At a basic level, IAM uses a password and username to verify a user. Many more advanced identity management processes are now also on the market, such as multifactor, biometric and risk-based authentication.

Today, Internet of Things (IoT) sensors are common and more people work remotely. So, more devices are attempting to gain access, making IAM even more important. In the past, manufacturing plants likely only had employees accessing the company’s systems from their computers at work. Now, employees log on from their phones, tablets from the production floor and their laptops when working from home. In addition, today’s manufacturing processes include many IoT devices that send data in real-time to make sure the robots used for production are safe and efficient.

Each of those devices and access locations offers a chance for attackers to breach the network. So, identity management is critical. Forrester found that 80% of all breaches are the result of compromised privileged credentials.

Based on the increased need for IAM, Garner predicts that, by 2022, 90% of organizations will recognize that mitigation of privileged access risk is key to protecting their data.

Not surprisingly, privileged access management (PAM), which is one approach for identity management, has grown in response to the need, with a 17% market growth rate from 2019 to 2020.

What Is Privileged Access Management (PAM)?

While people sometimes refer to PAM as simply managing passwords, the approach includes so much more. PAM involves knowing who has access to every part of your network and then creating a process for how to prove trusted access — even more so for sensitive data and admin accounts.

When organizations begin the PAM process, they often discover accounts they didn’t even know existed, each of which increases risk — because you can’t protect what you don’t know about. PAM also enables them to monitor every keystroke that a user takes, allowing the admin to detect risky behavior in real-time and then terminate the account. If done in time, this can often prevent a breach or attack.

Other Components of Identity Management

Part of the solution comes from secure shell (SSH) keys. By using SSH keys, which enable automated processes and single sign-on by system admins, you can use Role-Based Access Control (RBAC) and permission sets to control who has access to which sets of keys, regardless of location or IP address. With RBAC, you can also create an approval workflow that allows transparent access and time restrictions.

Identity-as-a-Service (IDaaS)

While PAM focuses on the most privileged accounts and most restrictive access as an overall approach, IDaaS is a way to implement a portion of PAM. IDaaS uses secure methods, such as multifactor authentication and self-serve user account management. Instead of creating your own IAM solution as part of your internal or external app or network, you can use IDaaS, which is a third-party service that manages all aspects of identity management.

You can then include it as part of your product, which makes your time to market much shorter. Because IDaaS focuses solely on IAM, the solutions often use the latest methods. Experts monitor current threats to ensure the safety of their clients. Already have an internal app that needs more secure IAM, or working on an external product that needs IAM? IDaaS is probably the right fit.

Cloud Permissions Management (CPM)

While IDaaS manages the identities and authentication, cloud permissions management (CPM) uses AI technology to make recommendations on changes based on the zero-trust approach. This tech is in its early days, but CPM is critical because it puts AI into defenders’ hands — which is becoming essential, as attackers are using AI for breaches.

Moving Forward With Identity Management

As the number of devices and access points businesses use increases, IAM will only become more critical. By knowing the different types and components of IAM, you can create the strategy that best meets your needs.

To learn more about IAM and Privileged Accessed Management, visit IBM.com.

More from Identity & Access

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today