Identity And Access Management: An Introduction

A solid approach to identity and access management can cut costs and make your organization more secure. Here are some tips for laying the foundation

[Excerpted from Identity and Access Management: An Introduction, a new report posted this week in Dark Readings
Identity and Access Management Tech Center
.]
One of the challenges with identity and access management is that it means different things to different people. Some associate it with single sign-on, while others connect it to federating credentials among varied systems. Some people will argue that it’s all about creating a centralized user record. All of these capabilities are part of the IAM conversation, but they are not the conversation itself.
IAM is really about two things: first, making sure the good guys have ready access to the things they need to do their jobs, and, second, making sure the bad guys don’t. That’s it.
Determining the difference between the good guys and the bad guys is identity. Deciding when to provide access (and when not to) is access. The management part relates to the managing of those two things via a well-planned and thoughtful strategy.
So the goals of IAM should be easy to understand as an outgrowth of IAM’s core principles: to reduce overhead by streamlining user access to resources (letting the good guys in) and to decrease overall security risk by making sure that inappropriate access isn’t given to the wrong people (keeping the bad guys out). The specifics of the technical decisions and efforts that you might choose to undertake -- from federation to SSO to authentication and beyond -- will likely forward at least one of those two goals.
So if the core of IAM is so straightforward, why do discussions about it get so complicated so quickly? The primary reason has to do with the complexity of what it takes to effect IAM in an actual production infrastructure.
First, the base of resources that users need to access is large and constantly expanding over time, as is the number of users.
Second, the number of decision points (that is, the number of individual decisions that go into determining which users can gain which levels of access to which resources) is a function of number of resources (growing), number of users (growing), and the permissions available within each application/system/realm.
Third, individual resources are usually developed with a particular security (and user access) model in mind, and externally facing awareness of users and roles outside of that model isn’t usually a given. All these factors give rise to complexity, and that complexity makes the management piece of the IAM equation difficult to effect in practice.
To find out more about the key concept and basic strategies behind IAM -- including access control, multifactor authentication, federation, single sign-on, user policy, and monitoring --
download the free report on identity and access management
.
Have a comment on this story? Please click Add a Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Identity And Access Management: An Introduction