February 18, 2016 By Jason Keenaghan 3 min read

Digital transformation: What does it mean for you and your business? The old way of engaging with clients, business partners and even employees is rapidly changing. The new engagement model is focused on collaboration and is increasingly delivered via a mobile channel. Clients demand a first-class user experience; when those expectations cannot be met, low switching costs often result in direct impacts to business results. Even for internal users, the consumerization of IT is driving the same high level of expectations at work.

Digital Evolution Leads to Security Concerns

As organizations adopt technologies like cloud, APIs and the Internet of Things (IoT) to assist them in this digital transformation, security remains a top concern for CISOs and IT professionals. However, one message has come across loud and clear: Business progress will not be derailed by the concerns of security and IT organizations. These groups need to get on board and enable this progress or they risk being left behind or, even worse, completely run over.

Identity and access management (IAM) — that oft-neglected part of your IT environment — holds the key to not only delivering an optimal end user experience in support of your digital transformation, but also to its becoming your first security control. In the digital world, the traditional network perimeter we formerly relied on is no longer sufficient.

Individuals, applications and “things” alike are accessing critical data and resources. Each of these has an identity. It is necessary to have a clear understanding of those identities, what they should have access to, whether their actions are consistent with normal behaviors and what risks they represent to your organization.

Protecting Against Insider Threats

Solutions such as identity governance, analytics and privileged user management are critical components in this digital world for protecting against the myriad of insider threats. First, there is a need to rapidly detect malicious insider activity. This usually requires some form of baselining normal user behavior and then applying intelligence to determine and alert on anomalous behavior.

Identity context is critical to effective insider threat detection. What resources does an identity have access to? Is this normal or expected based on the individual’s role? What is the level of risk associated with a given identity?

The second aspect of an insider threat is being able to actively mitigate the risk associated with insider activity. This may involve implementing tools and processes to control access to shared or privileged credentials in order to protect your crown jewels.

In the world of mobile, that same need to protect critical business assets exists. However, in this world, organizations typically exert less control over the devices individuals use to access those resources. Even where the use of an enterprise mobility management solution might provide greater device-level control, there are still many more variables and risk factors associated with the mobile channel.

Therefore, it becomes necessary for organizations to implement a more dynamic and risk-driven approach to user security. Contextually aware access policies make it possible to deliver increased security without negatively impacting the end user experience.

Read the IBM research report: Battling Security Threats From Within Your Organization

Adding Context to Identity Management

So what do we mean by context in security? This includes information about the device, the user, the environment, the resource being accessed and past behavior.

With a rich set of context, you can implement policies that provide the right level of identity assurance you require to mitigate the risk associated with certain activities. Does it seem odd that one of your employees is suddenly attempting to access an application from a device they have never used before? Perhaps it would be prudent to invoke a stronger form of authentication?

Digital businesses must rapidly adapt to changing market conditions. For all the benefits that IAM can provide in support of these goals, legacy environments that have not been upgraded to provide the latest technological capabilities can become a blocker rather than a business enabler.

To this end, many organizations are turning to cloud-delivered IAM solutions to provide faster time to value, scalability and reduced operational costs. Cloud IAM capabilities may come in multiple forms, from a set of APIs that allow for tightly bound application integration to self-service multitenant software-as-a-service (SaaS) solutions and finally to fully managed, cloud-hosted IAM environments.

More from Identity & Access

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today