E-guide

IAM:
Manging identity
remains key to
cyber security
 IAM: Managing identity remains key to cyber security

In this e-guide
In this e-guide:
Mitigating social engineering
IT and regulatory environments are changing rapidly driven by
attacks with MFA the EU’s GDPR and digital transformation that is seeing
accelerated adoption of cloud and IoT-based technologies, and
How to bolster IAM strategies while identity remains key to cyber security, organisations need
using automation
to reassess and adapt their identity and access management
(IAM) strategies accordingly.
Passwordless enterprise
already possible, says RSA
While end user awareness remains vital, a key shift needs to be
to multifactor authentication, particularly as social engineering,
Digital business is connected
business, says and phishing in particular, remains a top method for attackers
KuppingerCole getting inside corporate IT environments, underlining the fact
that the ability to restrict access to legitimate users based on
New approach to risk
passwordless digital identities is essential to protecting
management needed, says
Gartner systems and data, and therefore to the associated regulatory
compliance.
IAM market evolves, but at a
cost Another key shift needs to be to automation to keep pace with
provisioning, deprovisioning and real-time updates to identity
The benefits of IAM can far information in applications on-premise and in the cloud. In the
outweigh the costs

Page 1 of 47
 IAM: Managing identity remains key to cyber security

digital era, businesses also need to build the capability to

In this e-guide
orchestrate data, identities and artificial intelligence to enable
Mitigating social engineering
new applications and services, while keeping a firm hand on
attacks with MFA third-parties. These shifts inevitably come with a cost, but in
light of the fact that IAM can boost data security and
How to bolster IAM strategies governance, it can be well worth the investment.
using automation

Warwick Ashford, security editor

Passwordless enterprise
already possible, says RSA

Digital business is connected

business, says
KuppingerCole

New approach to risk

management needed, says
Gartner

IAM market evolves, but at a

cost

The benefits of IAM can far

outweigh the costs

Page 2 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
Mitigating social engineering attacks with
Mitigating social engineering MFA
attacks with MFA
Peter Allison, guest contributor
How to bolster IAM strategies
using automation
Social engineering attacks are one of the most prevalent forms of attack against
organisations. They can target any organisation, regardless of size or type.

Passwordless enterprise In fact, many of us will have experience of them, such as automated calls
already possible, says RSA
claiming to be from your internet service provider or emails offering
“unbelievable” discounts, for example. They can vary in sophistication, with
Digital business is connected some easy to spot, while others are highly convincing.
business, says
KuppingerCole Europol’s Internet organised crime threat assessment (IOCTA) 2018 highlights
the growing prevalence of social engineering attacks, stating that “criminals use
New approach to risk social engineering to achieve a range of goals: to obtain personal data, hijack
management needed, says accounts, steal identities, initiate illegitimate payments, or convince the victim to
Gartner proceed with any other activity against their self-interest, such as transferring
money or sharing personal data”.
IAM market evolves, but at a
cost Phishing attacks can have a hugely damaging effect on businesses and
individuals, according to the Home Office.
The benefits of IAM can far
outweigh the costs

Page 3 of 47
 IAM: Managing identity remains key to cyber security

“That is why we have invested more than £200m since 2010 in the law
In this e-guide enforcement response and are funding local specialist cybercrime units to
ensure that cyber criminals are brought to justice,” a spokesperson tells
Mitigating social engineering Computer Weekly.
attacks with MFA
Social engineering attacks can be broadly broken down into three distinct types,
How to bolster IAM strategies with the first being the most frequent:
using automation
 Phishing – Email or social media based social engineering attacks.
 Vishing – Voice-based social engineering, frequently over the phone but
Passwordless enterprise can also be in person or VoIP (i.e. Skype).
already possible, says RSA  Smishing – Mobile phone-based text messaging (SMS) social
engineering attacks.
Digital business is connected
Whaling and spear phishing
business, says
KuppingerCole
Targeted phishing attacks against senior management (whaling) and specific
people/organisations (spear phishing) have also recently become a popular
New approach to risk form of social engineering attack for criminals.
management needed, says
Gartner Spear phishing may act as a precursor to a much more damaging attack. For
example, a spear phishing attack could be used with the intent of acquiring
IAM market evolves, but at a access to a network, with a subsequent data breach taking place once access
cost rights have been acquired.

The benefits of IAM can far

outweigh the costs

Page 4 of 47
 IAM: Managing identity remains key to cyber security

One of the reasons that phishing is so frequently used is that it does not rely on
In this e-guide vulnerabilities in an organisation’s security infrastructure in order to be effective,
but on the natural goodwill of people. It is for this reason that it can be so
Mitigating social engineering effective, as people are naturally inclined to be helpful and efficient – the same
attacks with MFA qualities that makes employees good at their jobs.

How to bolster IAM strategies Therefore, no matter the technological solutions in place (such as limiting
using automation access rights, identifying external senders or preventing users from installing
software), phishing attacks can still be successful if employees are insufficiently
Passwordless enterprise trained to detect them. Therefore, it is crucial to educate employees, especially
already possible, says RSA those in public facing roles, in how to detect social engineering attacks and
report them.
Digital business is connected
Educating employees in this matter can provide a valuable contribution to an
business, says
KuppingerCole organisation’s network defences. This education should be non-judgemental
and explain the common indicators of a phishing message that employees
should be on the lookout for.
New approach to risk
management needed, says
Simulated phishing scenarios are an effective tool for educating employees in
Gartner
how to detect social engineering attacks, by providing real-world examples of
what can be expected without any genuine threat to the organisation. However,
IAM market evolves, but at a
care should be taken.
cost

While such simulations can help provide an understanding of susceptibility to

The benefits of IAM can far specific phishing messages, it could also impact upon productivity through
outweigh the costs

Page 5 of 47
 IAM: Managing identity remains key to cyber security

uncertainty of genuine emails, as well as employees feeling as if they have

In this e-guide been tricked by their organisation.

Mitigating social engineering Another option is to request that all employees complete an e-learning course,
attacks with MFA which will allow them to practise spotting phishing emails. Such courses
typically conclude with a test in order to verify that the required competence has
How to bolster IAM strategies been achieved.
using automation
Providing a tool for employees to report phishing incidents, even just an email
Passwordless enterprise address for forwarding suspected phishing emails, can also help organisations.
already possible, says RSA Not only does this allow trained professionals to review suspected phishing
emails, but it can also alert security teams if the organisation is being targeted
Digital business is connected as part of a spear phishing campaign.
business, says
KuppingerCole One technological solution that has proven successful against social
engineering attacks, especially when the goal has been for acquiring access
details, is the implementation of two-factor authentication.
New approach to risk
management needed, says
Two-factor authentication (2FA), and multifactor authentication (MFA), are
Gartner
access management systems that require two – or more – pieces of evidence,
whether it be knowledge (such as passwords), possession (a physical token for
IAM market evolves, but at a
example) or inherence (eg fingerprints) in order for access to be granted.
cost

The reason that 2FA/MFA is so successful is that should one of their verification
The benefits of IAM can far stages (such as a password) become compromised, a hacker will still be unable
outweigh the costs

Page 6 of 47
 IAM: Managing identity remains key to cyber security

to gain access to the organisation’s network without the other pieces of

In this e-guide authentication.

Mitigating social engineering Although broadly similar, each type of 2FA/MFA methodology can be broadly
attacks with MFA subdivided into the following categories;

 Email – a unique one-time password is sent to the user’s email address.

How to bolster IAM strategies
using automation  SMS – a unique one-time password (OTP) is sent by text to the user’s
mobile phone.
Passwordless enterprise
already possible, says RSA
 Application – a unique one-time passcode sent to an app on the user’s
smart phone.

Digital business is connected  Device – a unique one-time passcode displayed on a separate physical
business, says device.
KuppingerCole
 Token – a physical token that can be inserted into a USB port.

New approach to risk  Biometrics – reading aspects of the user’s body to check they are who
management needed, says they claim to be.
Gartner
Version of authentication
IAM market evolves, but at a
Commonly, for the authentication system to be robust, each stage of the
cost
2FA/MFA process relies on a different channel being used.

The benefits of IAM can far

outweigh the costs

Page 7 of 47
 IAM: Managing identity remains key to cyber security

“There are lots of different versions of authentication, but they broadly boil down
In this e-guide to being unique every time you log on, and that is why they are so good,” says
Colin Tankard, managing director of security firm Digital Pathways.
Mitigating social engineering
attacks with MFA Email, SMS, device and application based 2FA/MFA systems all work on the
same principle of sending the user a one-time passcode when they are
How to bolster IAM strategies attempting to log in. This passcode has a brief window in which it can be
using automation entered, otherwise it becomes invalid.

This is commonly 30-60 seconds for Email, app, or device methods, but SMS
Passwordless enterprise
commonly has a longer window of two minutes, to allow extra time for the SMS
already possible, says RSA
message to be received.

Digital business is connected Some SMS-based authentication systems offer the opportunity to send multiple
business, says
one-off passcodes. This allows users to have a stock of pre-generated
KuppingerCole
passcodes in advance, which can be helpful in areas where there is limited
coverage by mobile providers.
New approach to risk
management needed, says However, this is also carries the risk that someone might be able to obtain the
Gartner phone and acquire the passcodes. The lifespan of these passcodes sent in
advance can vary from weeks to months or even years, and their duration is
IAM market evolves, but at a dependent upon the risk attached.
cost
SMS is potentially the weakest method, due to the extended duration in which
The benefits of IAM can far the code remains valid and the potential for the message being intercepted.
outweigh the costs

Page 8 of 47
 IAM: Managing identity remains key to cyber security

That said, this is such a comparatively low risk that it remains a robust method
In this e-guide of 2FA/MFA.

Mitigating social engineering Application-based methods

attacks with MFA
The application-based method of 2FA/MFA methodology is comparatively
recent, as well as becoming the most common, with apps like Google
How to bolster IAM strategies
Authenticator and Sophos Authenticator being easily available for organisations
using automation
to use.

Passwordless enterprise Furthermore, this does not require the additional expense of purchasing more
already possible, says RSA
devices, as would be required with token and device-based 2FA methods.

Digital business is connected “The primary issue with these is that you do need a backup method of getting in.
business, says If your phone breaks or gets lost, your account will most likely be inaccessible,”
KuppingerCole says Chris Johnson, a solutions architect.

“Many sites get around this by providing a set of rescue codes that you can print
New approach to risk
management needed, says out or save somewhere in case of phone loss.”
Gartner
Device-based 2FA/MFA relies on the user having a small device with them
(typically credit-card sized). It may also require them to enter a pin-code in order
IAM market evolves, but at a
to activate the device to receive the passcode, adding a further layer of security
cost
to the process.

The benefits of IAM can far

outweigh the costs

Page 9 of 47
 IAM: Managing identity remains key to cyber security

One downside to this method, is that the batteries can run out or the device be
In this e-guide lost, which will necessitate a new device being sent, with the user unable to
access the organisation’s network during that time.
Mitigating social engineering
attacks with MFA Physical tokens

Physical tokens, such as USB keys, carry within them a second passcode. Care
How to bolster IAM strategies
has to be taken with these, as there have been instances where users have
using automation
kept their token in the same bag as the laptop it is designed to unlock. Users
should be encouraged carry tokens on their key rings or security lanyards; a
Passwordless enterprise
habit that can be encouraged by adding a keyring to the token.
already possible, says RSA

“I’ve used various forms; the most common was RSA Security’s one-time
Digital business is connected tokens which we've used to protect sensitive environments, as these just work
business, says and last for years,” says Johnson. “The downside is that they aren't the
KuppingerCole
cheapest when you ramp up the user count.”

New approach to risk Token and device-based systems also have the advantage of ensuring
management needed, says employees cannot login after they leave an organisation, because at the exit
Gartner interview, they are typically required to return all equipment belonging to the
organisation.
IAM market evolves, but at a
cost Biometrics have become the holy grail of 2FA/MFA because it is an
authentication method that is inherently unique to the user and cannot be easily
The benefits of IAM can far
outweigh the costs

Page 10 of 47
 IAM: Managing identity remains key to cyber security

taken from them. Biometric authorisation can be performed using fingerprints,

In this e-guide voice-print or retina-scanning, but each carries significant challenges.

Mitigating social engineering Fingerprint scanning is the most commonplace, as many smart phones and
attacks with MFA laptops carry fingerprint scanners, but they are also the most unreliable and
inaccurate. Rather than requiring a specific match, fingerprint scanners allow for
How to bolster IAM strategies some accuracy deviation – to compensate for dirty fingerprint readers – and
using automation thereby potential false-positives.

“It is like saying you got your password a little bit wrong, but I am going to let
Passwordless enterprise
you in, which you do not have if you are using the token readers,” says Tankard.
already possible, says RSA

Storage security
Digital business is connected
business, says There have also been several instances of fingerprints being spoofed, and there
KuppingerCole is the additional concern of where the fingerprint is stored and how secure this
storage is. This point was illustrated by the recent discovery by security
New approach to risk researchers of a publicly accessible database of biometric information, including
management needed, says unencrypted fingerprint records.
Gartner
Retina scanning remains most the reliable method of 2FA/MFA. However, as a
IAM market evolves, but at a vast number of people remain phobic about eye scans, and the equipment is
cost still expensive, it remains impractical for mass-market adoption.

The benefits of IAM can far

outweigh the costs

Page 11 of 47
 IAM: Managing identity remains key to cyber security

Voice recognition, frequently used in telephone banking (many will have had to
In this e-guide repeat “my voice is my passport”), bridges the age gap and does not require the
additional devices that apps or device-based 2FA/MFA can require.
Mitigating social engineering
attacks with MFA Voice-based 2FA/MFA systems can also be combined with speech recognition
systems to provide an additional layer of security, with users having to state an
How to bolster IAM strategies additional passcode. However, the sensitivity of the system is such that it may
using automation not recognise the user where there is a poor connection.

Before implementing any biometric system, it is important to ensure that any

Passwordless enterprise
current or future employees with disabilities will not be affected adversely.
already possible, says RSA

With the exception of biometrics – and especially retina scanning – the price of
Digital business is connected 2FA/MFA technology has dropped in recent years, making them a readily
business, says
affordable solution for many organisations.
KuppingerCole
No unified standard
New approach to risk
management needed, says However, this recent rapid emergence of 2FA/MFA systems has meant there is
Gartner no unified standard amongst security providers. For example, Google
Authenticator will not work with Sophos Authenticator. That said, some
IAM market evolves, but at a platforms allow for a range of 2FA methodologies under the same system,
cost which some industry commentators see as being key to making passwordless
access to systems ubiquitous.
The benefits of IAM can far
outweigh the costs

Page 12 of 47
 IAM: Managing identity remains key to cyber security

Organisations must carefully choose which 2FA/MFA solution to use, as each

In this e-guide platform has its own limitations. “I do not think we will ever get to a point where
there will just be one unified approach for multifactor authentication, and that is
Mitigating social engineering going to be the problem,” says Tankard.
attacks with MFA
Nonetheless, 2FA/MFA remains a valid solution for mitigating the effects of a
How to bolster IAM strategies social engineering attacks, especially spear phishing and whale phishing
using automation attacks where the intent is to acquire access information to an organisation’s
network. With a 2FA/MFA system in place, even if a name and password is
Passwordless enterprise acquired by hacker, access will not be permitted unless the corresponding
already possible, says RSA passcode(s) are also entered.

“We moved from manual to third-party software for driving licence and vehicle
Digital business is connected
checks to meet our obligations for our grey fleet [use of an employee's private
business, says
KuppingerCole vehicle for business use] and company car drivers,” says Darren Pulsford, a
finance analyst.

New approach to risk “To meet IT protocols, we asked them to add 2FA,” he says. “Implementation
management needed, says
was easy enough, and by and large we have had no difficulties. The company
Gartner
has since moved to 2FA for remote logging on, so all our mobile or travelling
users are accustomed to it.”
IAM market evolves, but at a
cost Given that social engineering is a key element to the majority of data breaches
hitting the headlines, organisations should investigate what multifactor
The benefits of IAM can far
outweigh the costs

Page 13 of 47
 IAM: Managing identity remains key to cyber security

authentication methods would be best suited to their need to shut down a

In this e-guide vulnerability that is routinely exploited by attackers.

Mitigating social engineering

attacks with MFA Next Article

How to bolster IAM strategies

using automation

Passwordless enterprise
already possible, says RSA

Digital business is connected

business, says
KuppingerCole

New approach to risk

management needed, says
Gartner

IAM market evolves, but at a

cost

The benefits of IAM can far

outweigh the costs

Page 14 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
How to bolster IAM strategies using
Mitigating social engineering automation
attacks with MFA
Nicholas Fearn, guest contributor
How to bolster IAM strategies
using automation
Identity and access management (IAM) processes, policies and technologies
play an important role in the security operations of modern organisations,
allowing them to manage electronic and digital identities effectively.
Passwordless enterprise
already possible, says RSA
As technology continues to dominate the way businesses operate, and data
privacy becomes a crucial part of the corporate agenda, IAM systems are
Digital business is connected gaining importance because they enable IT managers to control the information
business, says
that users can access and the actions they can perform.
KuppingerCole
User actions, such as viewing or editing a file, are typically governed by the
New approach to risk person’s role or level responsibility within an organisation. Common IAM
management needed, says systems include single sign-on (SSO) multifactor authentication (MFA) and
Gartner privileged access management (PAM), which not only ensure that the most
relevant data is shared, but also that user data is stored securely.
IAM market evolves, but at a
cost While IAM systems are far from new, they are quickly evolving to help
organisations meet the demands of the interconnected economy and mitigate
The benefits of IAM can far
outweigh the costs

Page 15 of 47
 IAM: Managing identity remains key to cyber security

emerging security threats. Automation capabilities, in particular, are making it

In this e-guide easier for IT teams to create and manage identities and avoid human error.

Mitigating social engineering Eradicating manual tasks

attacks with MFA
In the past, IAM processes and technologies have been largely manual and
relied on input from humans. But automation promises to speed things up and
How to bolster IAM strategies
help organisations protect vital data in real time.
using automation

James Litton, CEO of IAM specialist Identity Automation, says: “Provisioning,

Passwordless enterprise deprovisioning and real-time updates to identity information occur in on-premise
already possible, says RSA
and cloud applications as changes are detected in the various authoritative
source systems used by an organisation. This eliminates repetitive physical
Digital business is connected tasks for IT staff, while creating valuable bandwidth for more strategic
business, says initiatives.”
KuppingerCole
Litton argues that automation is also important for protecting critical data assets.
New approach to risk “An example of this is when an employee leaves an organisation or a
management needed, says technology supplier relationship ends,” he says. “Automation can ensure that
Gartner their accounts do not remain in an active state, thus eliminating a potential
avenue through which bad actors can access data. When implemented
IAM market evolves, but at a properly, automated IAM solutions can also identify orphan accounts
cost automatically and alert system owners.”

The benefits of IAM can far

outweigh the costs

Page 16 of 47
 IAM: Managing identity remains key to cyber security

Identity management systems comprise users, applications and policies, all of

In this e-guide which govern how people are able to use software. Litton says automated IAM
systems can fully automate identity creation at scale; automatically manage
Mitigating social engineering user access; apply role- and attribute-driven policies; and completely remove
attacks with MFA the need for passwords, helping to improve the user experience, while
decreasing the helpdesk support burden.
How to bolster IAM strategies
using automation “Once an IAM solution has been deployed, the enforcement and management
of users and their access to data assets can be automated,” he says. “And if the
Passwordless enterprise application of an organisation’s policies is automated, you stand a much better
already possible, says RSA chance of mitigating risk from the negative consequences that result from poor
policy management practices, while increasing operational efficiency and
Digital business is connected improving the user experience.”
business, says
KuppingerCole Identity Automation has helped a number of organisations to modernise their
IAM strategies, including Saint Luke’s Health System in Kansas City, US. IT
manager Michael Marker says its clinicians are saving time each day. “For
New approach to risk
management needed, says example, we have had physicians say they are able to see two to three more
Gartner patients a day with the additional time it saves,” he tells Computer Weekly.

The firm has also been working with Charlotte County School District to
IAM market evolves, but at a
implement automated identity management. Executive director Christopher
cost
Bress says: “We did an analysis of our procedures and concluded that they
were ripe for automation. By having people do this work manually, we were
The benefits of IAM can far
basically building unnecessary delays into the process.
outweigh the costs

Page 17 of 47
 IAM: Managing identity remains key to cyber security

“Also, as the number of people using resources continues to go up, we were

In this e-guide finding ourselves spending an inordinate amount of time at the beginning of the
year creating and provisioning accounts.”
Mitigating social engineering
attacks with MFA Matt Lock, technical director at security firm Varonis, believes automation has
become a critical tool in a security team’s arsenal and agrees that it is
How to bolster IAM strategies particularly useful for managing IAM datasets.
using automation
“Organisations are great at generating huge amounts of information, but often
do a terrible job of keeping track of it and making sure it’s secure,” he says. “On
Passwordless enterprise
average, about one in five folders, some of them containing sensitive data, are
already possible, says RSA
open to every employee. When you are dealing with thousands of folders and
millions of files, automation is the only realistic alternative.
Digital business is connected
business, says
“The size and complexity of today’s networks make watching and securing your
KuppingerCole
most valuable digital assets far more than a full-time job. It is incredibly time-
consuming and it must be done right or you will remove access for those who
New approach to risk need it. And maintaining least privilege requires constant upkeep.
management needed, says
Gartner “Automation can take on the issue of overexposed access in days instead of
months or years, and removes the grunt work that skilled IT and security pros
IAM market evolves, but at a shouldn’t be spending time on.”
cost

The benefits of IAM can far

outweigh the costs

Page 18 of 47
 IAM: Managing identity remains key to cyber security

A changing threat landscape

In this e-guide
With technology evolving quickly and new threats always emerging, IT teams
Mitigating social engineering must stay one step ahead by developing and implementing robust security
attacks with MFA approaches. Phillimon Zongo, co-founder and director at learning provider
Cyber Resilience, says rapid cloud adoption, tightening regulations and soaring
How to bolster IAM strategies cyber threats are all putting pressure on traditional identity and access
using automation management processes.

“Managing IAM manually is now untenable,” he says. “It raises both costs and
Passwordless enterprise
business risk. When done correctly, IAM automation can materially enhance
already possible, says RSA
compliance, lower costs, reduce cyber risk exposure, and free up humans to
work on value-creating initiatives.”
Digital business is connected
business, says However, organisations need to consider what tools are needed to develop a
KuppingerCole
sophisticated automation-driven identity and access management system.
According to Zongo, IAM automation use cases are as varied as the
New approach to risk organisations putting them to use. “Through federation and cloud-based single
management needed, says
sign-on solutions, organisations are centralising IAM across several on-premise
Gartner
and cloud-based applications, eliminating dozens of unique passwords,
boosting user experience, reducing cyber risk and streamlining access
IAM market evolves, but at a
provisioning process,” he says.
cost
Many organisations are relying on traditional spreadsheet-based user access
The benefits of IAM can far reviews with automated workflows, says Zongo. “Businesses are aggregating
outweigh the costs

Page 19 of 47
 IAM: Managing identity remains key to cyber security

access rights from multiple heterogeneous applications, presenting simplified

In this e-guide dashboards for management review, automating escalations and enhancing
IAM governance through comprehensive reporting.”
Mitigating social engineering
attacks with MFA Facial recognition technology – perhaps more controversial – has also emerged
as a popular IAM method in recent times. “Airports are verifying travellers’
How to bolster IAM strategies identities on arrival, before issuing unique biometric tokens that travellers can
using automation use throughout the entire verification process,” says Zongo. “This removes the
need for passport and boarding pass checks. Notwithstanding the privacy
Passwordless enterprise concerns, automating passenger verification processes can significantly uplift
already possible, says RSA travel experience while lowering security risks.”

Digital business is connected But Kushal Puri, cyber security innovation lead at London-based innovation
business, says centre and co-working space Plexal, says there are no specific requirements or
KuppingerCole tools to aid the introduction of automated IAM. “This is very much dependent on
the complexity and the needs of the company,” he says.
New approach to risk
management needed, says However, organisations and technologists can make use of various solutions
Gartner aimed specifically at automating aspects of an IAM framework, says Puri.
“These include single sign-on, password management and helpdesk ticket
IAM market evolves, but at a
automation,” he says. “From a security perspective, the ideal situation would be
cost to use a single tool that automates as much of the IAM framework as possible.
This is something we would like to see developed in future years.”
The benefits of IAM can far
outweigh the costs

Page 20 of 47
 IAM: Managing identity remains key to cyber security

Puri says the first steps in the automation of IAM are automating processes
In this e-guide such as password management, identity lifecycle management and finding
orphan accounts, because doing these things will lead to significant benefits.
Mitigating social engineering “Not only this, but if implemented well, automating certain aspects of helpdesk
attacks with MFA ticket routing and app access management will also lead to huge cost and time
savings for IT staff,” he points out.
How to bolster IAM strategies
using automation However, Puri admits that the best way of introducing automation into a
company will vary based on individual circumstances. “Typically, a company
Passwordless enterprise should take a phased approach by automating low-risk processes first, such as
already possible, says RSA password management, before progressing gradually to processes that interact
with multiple systems, such as app access management,” he says.
Digital business is connected
The benefits of automated IAM
business, says
KuppingerCole
When it comes to implementing any new technology, return on investment is a
major consideration for organisations. “By eliminating human error, especially
New approach to risk de-provisioning processes, the effectiveness of the IAM system from a security
management needed, says
perspective will be greatly increased,” says Puri.
Gartner
Business output levels can also be significantly boosted, he adds. “For example,
IAM market evolves, but at a manual provisioning of a new user can take up to 30 minutes, while an
cost automated provisioning process can be executed in under five minutes,
including ‘human in the loop’ checks. Similar to output levels, by drastically
The benefits of IAM can far reducing the amount of time needed to gain access to apps, reset passwords,
outweigh the costs

Page 21 of 47
 IAM: Managing identity remains key to cyber security

and even logging into various apps on a daily basis, employee productivity can
In this e-guide also be improved by a huge margin.”

Mitigating social engineering There are also financial benefits, says Puri. “IT staff costs can be lowered by
attacks with MFA reducing the need for IT staff intervention on IAM-related helpdesks,” he says.
“Currently, each password reset request costs an estimated £20-30 in IT time.
How to bolster IAM strategies With automated IAM, this will no longer be the case.”
using automation
Neil Thacker, CISO of US security software company Netskope, says
automation not only improves access management, but has also become
Passwordless enterprise
essential to manage access in the cloud era. “The Netskope August 2019 Cloud
already possible, says RSA
Report identified that businesses now use, on average, 1,295 different cloud
services – a mix of sanctioned and unsanctioned apps,” he tells Computer
Digital business is connected
Weekly.
business, says
KuppingerCole
“IAM teams struggle to stay on top of a few dozen apps. The old model simply
doesn’t work. Automation is the only way to maintain and align with security
New approach to risk policies without impacting productivity and innovation within a business.”
management needed, says
Gartner Thacker believes that as well as making full use of automation, identity and
access management must be built on a zero-trust approach. “User, device,
IAM market evolves, but at a application, activity and location are all means of authenticating identity, so we
cost should no longer be completely dependent on two-factor authentication (2FA) or
basic policies relating to allowing access to services based on an IP address,”
The benefits of IAM can far he says.
outweigh the costs

Page 22 of 47
 IAM: Managing identity remains key to cyber security

Chris Pope, vice-president of innovation at digital workflows platform

In this e-guide ServiceNow, also claims there are countless benefits in managing access this
way. “Time to provision and deprovision access, consistency of provisioning,
Mitigating social engineering central source of truth and management of a single identity are all benefits that
attacks with MFA provide security with the added benefits of knowing who has access to what and
when and, more importantly, why,” he says.
How to bolster IAM strategies
using automation “Features include time base access lists and anomaly detection for outliers of
access. In addition, audits and controls can be managed easily and the revoking
Passwordless enterprise of over-entitled users is as simple as a click of a button, shutting off access as
already possible, says RSA required to prevent data loss or loss of sensitive information.”

IAM procedures and technologies already play an important role in modern

Digital business is connected
security strategies, but as new threats emerge, it will become even harder for
business, says
KuppingerCole organisations to manage the identities of all stakeholders.

Automation removes manual processes that could be stifling the effectiveness

New approach to risk of IAM strategies, but also allows security teams to handle growing datasets
management needed, says
and respond to more sophisticated security threats as they emerge.
Gartner

IAM market evolves, but at a Next Article

cost

The benefits of IAM can far

outweigh the costs

Page 23 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
Passwordless enterprise already possible,
Mitigating social engineering says RSA
attacks with MFA
Warwick Ashford, security editor
How to bolster IAM strategies
using automation
The security industry has long recognised the need to move away from
password-based authentication and is finally on the brink of achieving that, says
Jim Ducharme, vice-president of identity at RSA.
Passwordless enterprise
already possible, says RSA
“We are on the cusp of some things that can really change the game and make
passwordless security ubiquitous,” Ducharme told Computer Weekly, adding
Digital business is connected that it is already a reality for some organisations.
business, says
KuppingerCole Enterprise users and security professionals alike are frustrated by the
inefficiency and lax security of passwords for user authentication, a recent
New approach to risk survey by IDG and MobileIron showed, with 90% of security professionals
management needed, says reporting that they had seen unauthorised access attempts because of stolen
Gartner credentials, 86% saying they would get rid of password use as an authentication
method if they could, and 62% reporting extreme user irritation with password
IAM market evolves, but at a lockouts.
cost
“Most ‘passwordless’ options in the market today do not truly eliminate
The benefits of IAM can far passwords because, ultimately, they rely on a password for enrolment, account
outweigh the costs

Page 24 of 47
 IAM: Managing identity remains key to cyber security

resets or replacing lost credentials, with consumer market options such as the
In this e-guide Apple iPhone’s Touch ID and Face ID systems still requiring users to enter
passwords or passcodes from time to time,” said Ducharme.
Mitigating social engineering
attacks with MFA “These and other so-called ‘passwordless’ authentication methods are simply
proxies for a password that lives underneath it. The iPhone has done a good job
How to bolster IAM strategies of integrating a passwordless experience to unlocking your device, but there is
using automation still a password underneath.

“So although Touch ID and Face ID have reduced the number of times that a
Passwordless enterprise
password is needed, they have not really eliminated it or improved security
already possible, says RSA
because if I know your AppleID and password, I could establish a passwordless
biometric authenticator to unlock a device and pretend to be you.”
Digital business is connected
business, says
According to Ducharme, the way to test if an offering is truly “passwordless” is
KuppingerCole
to examine how it handles enrolment and account reset or credential recovery,
which RSA has invested in addressing.
New approach to risk
management needed, says “Most security suppliers are typically still lacking the credential enrolment and
Gartner credential recovery piece of it,” he said. “So while many suppliers have support
for passwordless authentication methods and even have them integrated into
IAM market evolves, but at a the back end, they are still rooted in an Active Directory password.”
cost
The key to enabling a passwordless enterprise is to solve these two challenges
The benefits of IAM can far and give organisations the ability to cope with a wide variety of authenticators,
outweigh the costs

Page 25 of 47
 IAM: Managing identity remains key to cyber security

including biometrics, hardware tokens and even mobile devices, said

In this e-guide Ducharme.

Mitigating social engineering To meet these challenges, RSA access management products use SAML
attacks with MFA (security assertion markup language) and other means to integrate a broad
spectrum of passwordless authenticators into applications on the back end, and
How to bolster IAM strategies enable passwordless enrolment and credential recovery either by using existing
using automation RSA SecureID or third-party hardware tokens that comply with Fido standards
or single-use QR codes that customer organisations can send to new
Passwordless enterprise employees.
already possible, says RSA
RSA is also working on a third option, which is based on the belief that there is
a lot of potential for enabling friends and family to vouch for each other in
Digital business is connected
building trust relationships, said Ducharme. “When you want to enrol in
business, says
KuppingerCole something, you should be able to establish cryptographic connections to other
people who are trusted to establish a new trusted relationship,” he added. “So if
you lose your credentials, your recovery mechanism is your cryptographic
New approach to risk
management needed, says connection to your circle of friends, colleagues and family.”
Gartner
Despite RSA’s successes in this area, Ducharme said that for the passwordless
enterprise to be an option for all organisations, standards such as the Fido
IAM market evolves, but at a
authentication standard and the OAuth standard need to be widely
cost
implemented.

The benefits of IAM can far

outweigh the costs

Page 26 of 47
 IAM: Managing identity remains key to cyber security

“For passwordless authentication to be ubiquitous, standards like Fido and

In this e-guide OAuth need to bridge that last mile to integrate with applications,” he said. This
would enable more suppliers in the security industry to deal with the credential
Mitigating social engineering enrolment and credential recovery challenges.
attacks with MFA
But, for the first time, a ubiquitous and truly passwordless future is within reach,
How to bolster IAM strategies said Ducharme. “Fido holds great promise and is gradually being supported by
using automation more browsers, Microsoft’s Windows Hello biometric authentication technology
will soon start to be rolled out in enterprises as the latest versions of Windows
Passwordless enterprise are deployed, and with each hardware refresh cycle, enterprises are increasing
already possible, says RSA the number of laptops with integrated fingerprint scanners and webcams,” he
said.
Digital business is connected
Looking to the future, Ducharme believes the security industry needs to be
business, says
KuppingerCole guided by the approach and successes of the anti-fraud industry to shift the
focus from the front end to the back end and move beyond conditional access
technologies.
New approach to risk
management needed, says
Gartner “Right now, the biggest area of VC [venture capital] investment in IT security is
in all new types of authentications,” he said. “The industry’s propensity is to look
IAM market evolves, but at a
at new things that the user has to do to prove that they are who they say they
cost are.

“But if you look at the anti-fraud market, the propensity is for new types of data
The benefits of IAM can far
to look at during that transaction to understand if an activity is anomalous.
outweigh the costs

Page 27 of 47
 IAM: Managing identity remains key to cyber security

“Anti-fraud looks to evolve the controls on the back end of the transaction, but in
In this e-guide the workplace, we are constantly looking for new ways to put controls on the
front end of the transaction.”
Mitigating social engineering
attacks with MFA Although there are some advancements in the market with the introduction of,
for example, conditional access based on device ID and location, Ducharme
How to bolster IAM strategies said that does not get rid of the password and typically leads to another policy
using automation management problem.

“Attackers can find holes in your policies and it is too easy to spoof a lot of the
Passwordless enterprise
conditional-based access, so while it is better than just a password on its own –
already possible, says RSA
and I am not saying don’t do that – it is not sufficient to go truly passwordless,”
he said.
Digital business is connected
business, says
By focusing on back-end security controls and processes, said Ducharme,
KuppingerCole
banking institutions have been able to protect the bank accounts of customers
that are otherwise protected only by a debit card and a four-digit PIN, which is
New approach to risk much easier to remember than a complex, frequently-changing password.
management needed, says
Gartner “The IT security industry should tackle the problem in the same way by
implementing security controls and adding intelligence on the back end to detect
IAM market evolves, but at a when there is strange behaviour, which is where artificial intelligence [AI] and
cost machine learning risk-based authentication technologies really come into play,
much like the anti-fraud industry has been doing for years,” he said, adding that
The benefits of IAM can far AI and machine learning can detect a lot of the same things as conditional
outweigh the costs

Page 28 of 47
 IAM: Managing identity remains key to cyber security

access, but they are not static, are not reliant on policy, and can identify
In this e-guide patterns that security teams are unaware they should be looking for.

Mitigating social engineering “There are are all sorts of methods that we are looking at that are largely
attacks with MFA workflow-based and process-based that remove the need for a password
altogether, including back-end processes to support enrolment and credential
How to bolster IAM strategies recovery using backup credentials that are not password- or knowledge-based,”
using automation said Ducharme.

“Achieving a passwordless enterprise will make it much easier to manage a

Passwordless enterprise
dynamic workforce because organisations will be able to provide different
already possible, says RSA
credentials for different user populations that are best suited to the way they
work and their security requirements.”
Digital business is connected
business, says
KuppingerCole
Next Article

New approach to risk

management needed, says
Gartner

IAM market evolves, but at a

cost

The benefits of IAM can far

outweigh the costs

Page 29 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
Digital business is connected business,
Mitigating social engineering says KuppingerCole
attacks with MFA
Warwick Ashford, security editor
How to bolster IAM strategies
using automation
Digital business is connected business, according to Martin Kuppinger, principal
analyst at KuppingerCole.

Passwordless enterprise “Businesses need to build the capability to orchestrate data, identities, artificial
already possible, says RSA
intelligence (AI) and services to enable new applications and services for digital
business,” he told the European Identity & Cloud Conference 2019 in Munich.
Digital business is connected
business, says “Aim to connect to identities – not manage them yourself, orchestrate services
KuppingerCole and don’t invent what already exists, segregate data from applications so that it
can be used and is not locked, and use AI as a service to augment your use of
New approach to risk data to create new services to drive digital business,” he said.
management needed, says
Gartner These were Kuppinger’s top recommendations in his opening keynote
presentation on navigating identity and access management (IAM) in the digital
IAM market evolves, but at a age, where consumers, business, data and AI are all connected.
cost
From the consumer perspective, he said, it is important to understand that
consumers want to have a few reusable identities over which they have control,
The benefits of IAM can far
outweigh the costs

Page 30 of 47
 IAM: Managing identity remains key to cyber security

that work for every device, that are secure and do not have cumbersome “know
In this e-guide your customer” processes attached.

Mitigating social engineering From a business perspective, Kuppinger said two big trends were towards
attacks with MFA sharing data and AI.

“This is a fundamental change because it is about a totally different supply

How to bolster IAM strategies
using automation
chain,” he said. “Data and IT services are increasingly becoming part of the
supply chain, where businesses are consuming services based on data, which
is changing the way we are dealing with data.
Passwordless enterprise
already possible, says RSA
“As a result, we need to be thinking more about sharing data and shared APIs
[application programming interfaces] because data is the fuel of what is
Digital business is connected happening in the transformation of businesses.”
business, says
KuppingerCole In the digital era, said Kuppinger, businesses need to ensure that data becomes
consumable as a service that can be monetised, shared and used for various
New approach to risk business purposes. “And this requires us to unlock the data,” he said, so that it
management needed, says becomes accessible to services and AI-based technologies that run on data.
Gartner
In this light of the digital transformation of business, Kuppinger said, identity has
IAM market evolves, but at a to change or evolve even further. In the past, identity has evolved from user
cost management through identity management, identity federation and consumer
identity management.
The benefits of IAM can far
outweigh the costs

Page 31 of 47
 IAM: Managing identity remains key to cyber security

“The next step we need to do in the context of sharing data and services is to
In this e-guide move to public, shared, universal identity,” he said, adding that in this new
ecosystem, it was essential to segregate identities, applications and data.
Mitigating social engineering
attacks with MFA “If we segregate data, we make it reusable in a variety of different business
contexts in a far more flexible manner, and what you need for that is
How to bolster IAM strategies microservices, which deliver from an architectural perspective the required
using automation agility and can be used in a variety of ways and orchestrated to react to
business demand.”
Passwordless enterprise
From an enterprise IT perspective, Kuppinger said business in the digital era is
already possible, says RSA
about connecting everyone to every service. “It’s about having one consistent
identity service that helps us connect everyone (employees, partners and
Digital business is connected
customers) to all these services (cloud, federated or legacy).”
business, says
KuppingerCole
For this reason, he said, businesses need to consider rethinking their identity
and access management architectures. “We need to think about what I call an
New approach to risk ‘identity fabric’ – something that helps us in a consistent way allows us to
management needed, says
connect everyone to all the services.”
Gartner

Creating revenue-generating applications and services for the business, said

IAM market evolves, but at a Kuppinger, is about bringing together the necessary data, identities and
cost AI. “Digital business is connected business,” he concluded.

The benefits of IAM can far

outweigh the costs

Page 32 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
New approach to risk management
Mitigating social engineering needed, says Gartner
attacks with MFA
Warwick Ashford, security editor
How to bolster IAM strategies
using automation
The majority (83%) of organisations that engage third parties to provide
business services identified third-party risks after conducting due diligence, a
Gartner study has revealed.
Passwordless enterprise
already possible, says RSA
The survey of more than 250 legal and compliance leaders reveals that the
standard point-in-time approach to risk management is no longer effective in the
Digital business is connected light of today’s fast-paced, rapidly changing business relationships.
business, says
KuppingerCole With an increasing number of third parties performing “new-in-kind” and non-
core services for organisations, the Gartner report said material risks cannot
New approach to risk always be identified prior to the start of a business relationship.
management needed, says
Gartner The report’s finding is significant in light of the fact that a growing number of
cyber attacks are related to vulnerabilities in suppliers that are exploited to
IAM market evolves, but at a target partners, highlighting the need for greater emphasis on supply chain
cost security.

The benefits of IAM can far

outweigh the costs

Page 33 of 47
 IAM: Managing identity remains key to cyber security

Only 29% of business and IT executives globally know how diligently their
In this e-guide partners are working regarding security, with 56% relying on trust alone, a
recent survey revealed.
Mitigating social engineering
attacks with MFA Modern risk management, the Gartner report said, must account for ongoing
changes in third-party relationships and mitigate risks in an “iterative way” or on
How to bolster IAM strategies a continual basis, rather than at specified intervals.
using automation
“Legal and compliance leaders have relied on a point-in-time approach to third-
party risk management, which emphasises exhaustive upfront due diligence and
Passwordless enterprise
recertification for risk mitigation,” said Chris Audet, research director for
already possible, says RSA
Gartner’s legal and compliance practice.

Digital business is connected “Our research shows an iterative approach to third-party risk management is the
business, says
new imperative for meeting business demands for speed and stakeholder
KuppingerCole
demands for risk mitigation.”

New approach to risk According to Gartner, a number of factors have contributed to the shift in the
management needed, says nature of third-party risk, including that fact that:
Gartner
 Third parties provide new-in-kind technology services for 80% of
organisations polled, including startups and business model innovators;
IAM market evolves, but at a
cost
 Two-thirds of legal and compliance leaders find third parties are providing
services outside of the company’s core business model;
The benefits of IAM can far
outweigh the costs

Page 34 of 47
 IAM: Managing identity remains key to cyber security

 Third parties now have greater access to organisational data;

In this e-guide
 There is increasing variability in the maturity of organisations’ third-party
networks;
Mitigating social engineering
attacks with MFA  Third parties are working with an increasing number of their own third
parties.
How to bolster IAM strategies
using automation With a point-in-time risk management approach, compliance leaders attempt to
identify potential third-party risks upfront with extensive due diligence before
contracting and again at recertification, but this fails to capture any risks that
Passwordless enterprise
already possible, says RSA may arise due to ongoing changes throughout the relationship.
Among survey respondents who identified risks post-due diligence, 31% of
those risks had a material impact on the business.
Digital business is connected
business, says
“Ninety-two percent of legal and compliance leaders told us that those material
KuppingerCole
risks could not have been identified through due diligence,” said Audet. “The
only way to surface those risks was through actual engagement with the third
New approach to risk
party and through ongoing risk identification over the course of the third-party
management needed, says
relationship.”
Gartner

The Gartner report said the survey data shows that an iterative approach to risk
IAM market evolves, but at a management allows legal and compliance leaders to improve risk and business
cost
outcomes in terms of speed to engage, and by remediating and identifying third-
party risks before their impacts materialise.
The benefits of IAM can far
outweigh the costs

Page 35 of 47
 IAM: Managing identity remains key to cyber security

Organisations that applied an iterative approach experienced a doubling in

In this e-guide capacity to remediate risks prior to impact and 1.5 times greater ability to
identify risks prior to impact.
Mitigating social engineering
attacks with MFA “An iterative approach will enable legal and compliance leaders to manage their
changing and expanding third-party networks, while also satisfying business
How to bolster IAM strategies demands for quicker onboarding,” said Audet.
using automation
“To effectively mitigate third-party risks, compliance leaders must streamline
their current due diligence processes to focus on critical risks to eliminate
Passwordless enterprise
burdensome duplicative process and focus attention on the risks that have the
already possible, says RSA
biggest impact on the organisation,” he said.

Digital business is connected Nigel Ng, vice-president of international at digital risk management firm RSA
business, says
Security, said that part of the problem with gaining full visibility is the “sheer
KuppingerCole
intricacy” of today’s digital ecosystems.

New approach to risk “Companies are increasingly reliant on third parties to deliver core services, and
management needed, says while these partners create a lot of value for businesses, they also introduce
Gartner digital risks that need to be managed and can significantly add to the complexity
of the security protocols required.
IAM market evolves, but at a
cost “Third parties – such as systems integrators or contractors – often need direct
access to your systems. In these instances, firms need a clear understanding of
The benefits of IAM can far
outweigh the costs

Page 36 of 47
 IAM: Managing identity remains key to cyber security

their security protocols to determine how much trust to place in them and how
In this e-guide much access to grant.

Mitigating social engineering “Businesses also need even stronger identity and access management [IAM]
attacks with MFA processes to authenticate third-party users, ensure they are who they say they
are, can only access what they’re allowed to access, and that their credentials
How to bolster IAM strategies have not been compromised.”
using automation
John Sheehy, director of strategic security services at security services and
research firm IOActive, said any organisation not protecting is own own network
Passwordless enterprise
against basic threat actors, doing due diligence to properly patch, and holding
already possible, says RSA
suppliers accountable for securing their own networks has no hope of protecting
against threat actors.
Digital business is connected
business, says
“This is where third-party testing comes in handy to trust and verify your
KuppingerCole
suppliers,” he said.

New approach to risk To build a supply chain security programme, Sheehy recommends that
management needed, says organisations:
Gartner
 Ensure they know all suppliers and take a full inventory of who they do
business with so they can identify any weak links;
IAM market evolves, but at a
cost
 Conduct a risk assessment of each supplier’s cyber security posture,
including software and hardware components, to identify the risks they
The benefits of IAM can far may pose;
outweigh the costs

Page 37 of 47
 IAM: Managing identity remains key to cyber security

 Use third-party testing to test internal security systems and those of

In this e-guide suppliers to identify and prioritise what needs to be fixed;

 Regularly scan and patch all vulnerable systems;

Mitigating social engineering
attacks with MFA  Teach employees about the importance of using strong passwords and
not recycling them across accounts;
How to bolster IAM strategies
 Ensure staff has set up multifactor authentication everywhere possible;
using automation

 Conduct regular security awareness training to teach employees how to

Passwordless enterprise identify phishing scams, update software and become more security-
already possible, says RSA conscious;

 Harden the security of the devices connected to your networks.

Digital business is connected
business, says
KuppingerCole Next Article

New approach to risk

management needed, says
Gartner

IAM market evolves, but at a

cost

The benefits of IAM can far

outweigh the costs

Page 38 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
IAM market evolves, but at a cost
Mitigating social engineering
Jesse Scardina, guest contributor
attacks with MFA

The identity and access management market is rapidly changing.

How to bolster IAM strategies
using automation Technological disruptions such as artificial intelligence are advancing the
capabilities of identity and access management (IAM) software, while
Passwordless enterprise organizations struggle to modernize systems and manage employee identities
already possible, says RSA both in the cloud and on premises.

Attendees at Identiverse, an identity and security conference that recently took

Digital business is connected
place in Washington, D.C., were there for strategic as well as practical reasons.
business, says
KuppingerCole They wanted to learn about what's coming to the IAM market, how to combine
identity management with the corporate security strategy, and how to deliver the
best service to employees and customers on a tight budget.
New approach to risk
management needed, says
"We've been moving our identity management within our security focus," said
Gartner
Jon Fondrie, senior information security analyst at TIAA, a New York-based
financial services company. "I think the industry is moving that way. Once you
IAM market evolves, but at a
start moving into this hybrid world and your network can no longer be your first
cost
line of defense, identity becomes more of a source of security."

The benefits of IAM can far

outweigh the costs

Page 39 of 47
 IAM: Managing identity remains key to cyber security

Maintaining ROI with IAM

In this e-guide
Fondrie's sentiment echoed that of many conference attendees. Some were
Mitigating social engineering searching for validation that what they're organization was doing was correct,
attacks with MFA while others wanted to learn how best to implement IAM while also maintaining
a good ROI.
How to bolster IAM strategies
"A lot of [these capabilities] are cool, and the more you automate and the more
using automation
you move to the cloud, the more you simplify things," said Michael Daum, tech
lead for identity and access management at State Auto, an insurance company
Passwordless enterprise
based in Columbus, Ohio.
already possible, says RSA

Daum said that his organization is working to upgrade its IAM systems, while
Digital business is connected also not breaking the bank.
business, says
KuppingerCole "We're in this spot with a lot of technical debt," Daum said, adding that State
Auto is a G Suite customer and is in the cloud with AWS, but is hesitant to add
New approach to risk on another vendor just for identity management. "We're paying a lot of money to
management needed, says a lot of different companies and we're trying to find a way to see which of those
Gartner companies can be used for identity services. No offense to Ping Identity or
Okta, but why pay them however much money if we can limit the amount of
IAM market evolves, but at a cooks in the kitchen."
cost
Emerging capabilities within IAM products intrigued Daum, but never bested
The benefits of IAM can far ROI.
outweigh the costs

Page 40 of 47
 IAM: Managing identity remains key to cyber security

"Where's the value added?" Daum said. "Everyone is talking about cloud and
In this e-guide password-less and zero trust. Those buzzwords sound nice, but the cost to
implement is still huge."
Mitigating social engineering
attacks with MFA Zero trust is a security architecture introduced by Forrester Research that is
designed to assess threats not just from outside the network, but from within it.
How to bolster IAM strategies It uses the principle "never trust, always verify" anything trying to connect to the
using automation network to ensure it remains secure.

Easing ID management for customers

Passwordless enterprise
already possible, says RSA
New capabilities like zero trust and passwordless sign-in, which uses other
unique identifiers, including biometric or text-based verification, can be useful
Digital business is connected for IAM, but they can also be difficult for IT admins to implement, especially if
business, says they're trying to improve identity management for customers rather than internal
KuppingerCole
end users.

New approach to risk Stephanie Kesler, senior technologist at General Communication Inc. (GCI), an
management needed, says Alaska-based telecomm company, came away from conference sessions
Gartner feeling validated about how her company's implementation of IAM has gone,
especially with internal identification of GCI employees. She also wanted to find
IAM market evolves, but at a ways to ease identity management for GCI customers. That's something easier
cost said than done, as customers have different preferences and tend to have less
patience than employees.
The benefits of IAM can far
outweigh the costs

Page 41 of 47
 IAM: Managing identity remains key to cyber security

"One thing I've been looking at is how other people and organizations are
In this e-guide solving these problems," Kesler said. "It's much easier to implement some of
these things on the enterprise side first. And once you've gained that
Mitigating social engineering knowledge, you can start looking at the consumer-facing side of things."
attacks with MFA
Kesler said she had been researching trends like multifactor authentication
How to bolster IAM strategies (MFA) and zero trust, but wanted to be sure to balance those IAM features with
using automation customer experience.

"MFA is difficult to implement for customers. We don't want to be that annoying

Passwordless enterprise
company that makes you do multiple things to log on," she said. "Internally, you
already possible, says RSA
have a captive audience where it's easier to implement things like MFA or zero
trust. But on the customer side, it's a larger base where you don't have as much
Digital business is connected
control."
business, says
KuppingerCole

Next Article
New approach to risk
management needed, says
Gartner

IAM market evolves, but at a

cost

The benefits of IAM can far

outweigh the costs

Page 42 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
The benefits of IAM can far outweigh the
Mitigating social engineering costs
attacks with MFA
Kevin Beaver, guest contributor
How to bolster IAM strategies
using automation
Information security is really about IT governance, which is a multifaceted
practice involving policy creation, enforcement and ongoing risk mitigation. A
critical component of a security/governance program is identity and access
Passwordless enterprise
management. is more than a decade old -- several decades if you look at the
already possible, says RSA
basis of what it's trying to accomplish. Yet, given the benefits of IAM, it's not
quite as pervasive in the enterprise as one would expect.
Digital business is connected
business, says
One of the most important identity and access management benefits is the
KuppingerCole
ability to simplify the complicated. Enterprise identities have evolved beyond
standard user accounts. Take a holistic view of identities across the typical
New approach to risk organization and you'll find there are many types of identities to be managed.
management needed, says
Among them:
Gartner

 Internal employees
IAM market evolves, but at a
cost  Customers

 External partners
The benefits of IAM can far
outweigh the costs

Page 43 of 47
 IAM: Managing identity remains key to cyber security

 Contractors
In this e-guide
 Applications and services
Mitigating social engineering  IoT systems
attacks with MFA
 Mobile devices
How to bolster IAM strategies
using automation Where IAM can fill in the gaps

Many IT and security shops are so busy with their day-to-day work they haven't
Passwordless enterprise yet realized what's needed to manage these identities -- both periodically and in
already possible, says RSA
real time. This is one area where IAM can help fill the gaps.

Digital business is connected Additionally, today's security requires more adaptive identity governance
business, says beyond traditional spot-check audits to eliminate blind spots. For example,
KuppingerCole consider user accounts that are either added or removed at a certain point in
time. Traditional identity access audits that only take place every few months
New approach to risk can overlook the fact that these accounts should have been modified or
management needed, says disabled, thus making their mapping inaccurate. This leads to the situation
Gartner where ongoing audits are "passed" and checkboxes are checked. In this
hypothetical case, the organization is not in compliance with its own policies or
IAM market evolves, but at a the requirements of government or industry regulations that may apply. In fact, it
cost could be more at risk due to this lack of visibility in the IAM process.

The benefits of IAM can far

outweigh the costs

Page 44 of 47
 IAM: Managing identity remains key to cyber security

Another benefit of IAM is how it highlights the identity and access approval
In this e-guide process. Infosec professionals are familiar with the generic requests of so-and-
so new employee or contractor needing access to the network, the ERP system
Mitigating social engineering and all doors within the building. This is appropriate in smaller organizations, but
attacks with MFA for larger businesses, this request fails to illuminate a number of important
areas. Among them:
How to bolster IAM strategies
using automation  The actual rights that are needed on the network or enterprise
applications
Passwordless enterprise  Whether or not the request is unusual
already possible, says RSA
 Similar access levels that other employees currently have
Digital business is connected
 The most common role(s) accessing such requests
business, says
KuppingerCole
To have true IT governance, especially across various business units, all the
right people need details. It's critical to ensure that identity and access decisions
New approach to risk
are made not only based on generic policies or workflows, but also because
management needed, says
they include detailed contextual information outlining specific business needs
Gartner
and potential risks.

IAM market evolves, but at a IAM might be complicated to oversee, but it's worth it
cost
It's clear that IAM is worth the fuss. A modern IAM system is flexible and
The benefits of IAM can far extensible enough to adapt to how an organization works, rather than forcing
outweigh the costs

Page 45 of 47
 IAM: Managing identity remains key to cyber security

the business to adapt to IAM. IAM products have evolved and improved in
In this e-guide recent years; however, the essence of IAM and how it can help enterprise
security/governance programs has not changed and it can be well worth the
Mitigating social engineering investment.
attacks with MFA
If an information security program is to remain healthy and effective over the
How to bolster IAM strategies long term, everyone must work toward the same goal to reduce business risk.
using automation The only reasonable way to implement, manage and enforce identity- and
access-related policies is to utilize an IAM system. Be it in-house or cloud-
Passwordless enterprise based, the more complex the network, the greater the need.
already possible, says RSA
Don't yet have an IAM system or feel it is underimplemented? Take a step back
and see how things can be improved. Consider whether your current processes
Digital business is connected
work for or against the security goals. Think about what can be improved, which
business, says
KuppingerCole steps can be simplified and which can be eliminated altogether.

Make sure that everyone's time is used wisely -- from the business unit
New approach to risk manager making an initial request to the IT or security team charged with
management needed, says
approving and managing network addresses. The benefits of IAM will give the
Gartner
enterprise the necessary visibility and control needed to oversee network
accounts as well as satisfy ongoing governance. Anything less will likely
IAM market evolves, but at a
facilitate -- if not create -- risks the business can't afford to contend with.
cost

The benefits of IAM can far

outweigh the costs

Page 46 of 47
 IAM: Managing identity remains key to cyber security

In this e-guide
Getting more CW+ exclusive content
Mitigating social engineering
As a CW+ member, you have access to TechTarget’s entire portfolio of 140+
attacks with MFA
websites. CW+ access directs you to previously unavailable “platinum members-
only resources” that are guaranteed to save you the time and effort of having to
How to bolster IAM strategies
track such premium content down on your own, ultimately helping you to solve
using automation
your toughest IT challenges more effectively—and faster—than ever before.

Passwordless enterprise
already possible, says RSA
Take full advantage of your membership by visiting
Digital business is connected
www.computerweekly.com/eproducts
business, says Images; stock.adobe.com
KuppingerCole
© 2019 TechTarget. No part of this publication may be transmitted or reproduced in any form or by any means without
written permission from the publisher.
New approach to risk
management needed, says
Gartner

IAM market evolves, but at a

cost

The benefits of IAM can far

outweigh the costs

Page 47 of 47