Identity and access management (IAM) in enterprise IT is about defining and managing the roles and access privileges of individual network users and the circumstances in which users are granted (or denied) those privileges. Those users might be customers (customer identity management) or employees (employee identity management). The core objective of IAM systems is one digital identity per individual. Once that digital identity has been established, it must be maintained, modified and monitored throughout each user’s “access lifecycle.”
Why identity and access management is important.
The complexity of managing a multitude of individuals who need to be connected and have access to resources requires advanced IAM capabilities, to validate access requests, grant the most appropriate access, and monitor activities to detect anomalies and prevent data breaches. The term “user” referred to humans in the past, but the definition of the term goes beyond humans to include robots, applications, and Internet of Things (IoT). One of the main objectives of IAM is to make sure that authorised users have the appropriate access to the right resources, at the right time, as quickly as possible. This is why proper onboarding, access provisioning, and offboarding, is so important to ensure continued and efficient security without hiccups.
Protect from Past Employees
Preventing access from past employees is a high risk area as managers do not have the same incentive to offboard contractors and temporary employees as they do during their onboarding phase. Managing employees and their access may be more straight forward as they are often tied to the payroll system with integration to the central identity directory which has tighter controls than other systems, yet, if some systems are not integrated with the central identity directory, then removing a user from the directory will not trigger the removal of the user from all systems which is why offboarding can be fraught with mistakes.
No one complains when a user is not removed from the system until it is discovered during an audit or incident. However, past employees who still have access to the internal systems, or systems that they no longer require should be seen as a threat, as this could be a vulnerability that can cause information leakage and loss.
User Access Risks – Protect from external access
Users who have system and data access are often targets of phishing attacks to steal their credentials. More specifically, privileged users who have elevated access are prime targets of cyber-criminals to access high value systems, data, and transactions such as invoicing, procurement, and payments. Stealing existing access is much easier when targeting naive users than trying to hack into systems. This is because all of our high tech security investments can not prevent a data breach when an authorised user access is stolen and used in a manner consistent with the user’s usual activities to evade anomaly detection.
When applied properly, advanced identity and access management tools can help detect suspicious activities quickly, whether they are committed by external or internal criminals. In fact, insiders who have highly privileged access pose the greatest risks as they may be disgruntled or have financial problems, therefore have the incentive and opportunity to commit a perfect crime. Highly technical users who have privileged access can also cover their tracks by modifying system logs.
Sometimes, users also make mistakes and errors which can also be mitigated with IAM tools and education. Identity and access risk awareness education is very important to prevent external threats from stealing user credentials.
Effective access to resources
Another reason why identity and access management is important in cybersecurity is that organisations must comply with increasingly, complex and distributed regulations. They must ensure and demonstrate an effective customer identification process, suspicious activity detection & reporting, and identity theft prevention. Organisations can make use of various regulatory requirements to effectively utilise Identity and Access Management solutions, such as having a Customer Identification Program (CIP), Know Your Customer (KYC), monitoring for Suspicious Activity Reporting (SAR), and Red Flags Rule for identity fraud prevention.
Identity and Access Management is extremely complex and critical in managing security risks. Although technology is an important part of identity and access management and can be leveraged to support an organisation’s cybersecurity objectives and strategy, effective IAM also requires processes and people for user onboarding and identity verification, granting and removing access, detecting suspicious activities, and keeping unauthorised users out of the systems. IAM can help organisations achieve operating efficiency and optimal security through state of the art technology and automation such as adaptive, multi-factor, and biometric authentication.
Should you wish to discuss adding IAM to your ServiceNow environment, or how to optimize what you already have in place, visit zertid.com/contact-us, or try ZertID, available on ServiceNow App Store.
WRITTEN BY
Kris Seetharam
Kris is the PM of Marketing at ZertID and is dedicated to marketing strategy roadmap, brand experience and lead nurturing. With a strong background in the ServiceNow ecosystem, Kris is exploring possibilities of identifying new opportunities across the globe.