Identity and Access Management (IAM) is the centralized management of identities and access. The core function of Identity and Access Management is about defining and managing the roles and access control of individual network users. These users can be customers or employees. The reason why IAM is used is that IT systems are typically heterogeneous and are accessible over an internal network.
Identity and Access Management consists of two basic areas – Identity Management (IdM) and Access Management (AM).
Today, most IAM platforms provide some combination of the following tools and features, albeit with varying levels of customization and extensibility.
Identity and Access Management features
User Identity Lifecycle Management
Identity lifecycle management is a core function of Identity and Access Management. It includes identity synchronization, provisioning, de-provisioning, and ongoing management of user attributes, credentials, and permissions.
IAM systems manage users’ digital identities, typically an account or certificate, token, etc. IAM is typically integrated with one or more other user identity sources such as Microsoft Active Directory or HR SAP.
With the deployment of an IAM platform, the entire user lifecycle in an organization is usually covered. Starting from his onboarding, when the initial password needs to be handed over, a joining card needs to be generated and a license needs to be established to o365. Identities change over the course of being in the company – promotions occur and other accesses are needed (e.g. higher licenses in o365) and the IAM platform can help with this. In the event of an employee leaving, all accesses need to be removed to avoid the common scenario of an employee leaving and still having accesses to the CRM. If he goes to a competitor will he use the data from his previous job that he still has access to?
Role-Based access control (RBAC)
Many IAM systems use Role-Based access control (RBAC). Under this approach, there are predefined roles with specific sets of access permissions. An example would be an employee in the accounting department. Each employee is automatically given a company email account and the right to print upon joining by assigning a role.
Provisioning/deprovisioning of user accounts
Once a user is hired into the organization, IT must create accesses to the user’s systems. Because it would be time-consuming to specify each individual’s access to each system, IAM identity management systems allow for role-based access assignment (RBAC). Users are assigned one or more roles, usually based on their job position in the organization.
It is also time consuming to revoke access to all applications and systems. IAM automates this process. Which is important because former employees who still have access pose a serious security risk.
User authentication (Authentication)
IAM systems perform the task of user authentication when a user requests access. Secure authentication today means multi-factor authentication.
User authorization
After user authentication (authorization), the IAM system authorizes the user to access specific applications and resources. Thus, the user has access to clearly predefined data and does not go where he is not supposed to go.
Single sign-on system – SSO
With Single Sign-On (SSO), users only need to authenticate once. The user is then given access to all systems without having to log in to each system separately. For example, when you log into Google, you are automatically logged into your Gmail and YouTube accounts. This is a simplification for the user who does not have to remember additional passwords or logins. At the same time, access can be removed centrally from a single location.
A lot of helpdesk time is often spent on the fact that the user has forgotten their password and needs to reset it. At the same time, what convenience does the user have if he has to remember 10 passwords, plus different lengths with different characters (not counting that he has to change it every 3 months for critical systems). The single sign-on system reduces the number of passwords, increases user comfort and reduces helpdesk costs. For example, a doctor in a hospital has to focus on treating patients and not dealing with the fact that he forgot his password again
Federated identity management
Federated identity management allows you to share your digital identity with trusted partners. It is a shared identity verification (authentication) mechanism that allows users to use the same username, password, or other ID to gain access to more than one network.
Single sign-on (SSO) is an important part of federated identity management. While SSO single sign-on allows users to log on to different systems within an organization, federated identity does the same across multiple organizations. This model only works between collaborating organizations – known as trusted partners – that essentially vouch for their users.
Benefits of Identity and Access Management
Implementing IAM can provide a company with a significant competitive advantage. Today, most organizations need to provide users with access to internal systems from an external network. IAM allows an organization to extend access to its information systems across on-premise applications, mobile applications, and SaaS without compromising security. By providing access from an external network, productivity, employee satisfaction, research and development, and ultimately revenue can be increased.
