Why Identity Access Management Sits at the Core of Cybersecurity

The old advice says to keep your friends close and your enemies closer. For companies running their operations online, where any person or device can end up threatening the IT infrastructure, the saying may need turning round: the most dangerous adversary could be a "friend", someone who already works inside the organisation.

Remote work makes the problem harder. A workforce spread across many locations hands cybercriminals a larger attack surface and more back doors through which to get into a company's network and cause damage. That is the reason identity access management has quickly moved from a nice-to-have to a requirement for modern businesses.

What identity access management does

Identity access management (IAM) is a set of policies and technologies meant to make sure the right people reach the right resources, with the right level of access, at the right moment. It draws on several kinds of technology: authentication, such as passwords and biometric data, and authorisation, such as role-based access control.

A working IAM system keeps sensitive data and resources out of the hands of anyone who should not have them, and it helps a company meet regulatory requirements. Nick McKenzie, chief information security officer at Bugcrowd, calls IAM "a cornerstone of security".

McKenzie links its importance to the distributed way people now work. Remote working has sharply raised demand for SaaS applications, virtual private networks and data-sharing tools, he says, and those applications need to be managed centrally and automatically. An identity provider (IdP), in his view, is usually a good place to begin.

David Hope, senior vice president for Asia Pacific and Japan at ForgeRock, takes a similar line and describes IAM as mission-critical to how an organisation handles cybersecurity. Every person and thing connected to the Internet carries an identity, he notes, and that identity has to be confirmed, and its permissions checked, before it is allowed near any resource. With identities potentially numbering in the millions, Hope says the verification work suits a comprehensive IAM platform fast and scalable enough to keep making sound access decisions when traffic spikes.

Sherif El-Nabawi, vice president of sales engineering for Asia Pacific and Japan at CrowdStrike, agrees. Organisations, he says, need to give every user the correct level of access smoothly and efficiently, so that infrastructure and assets, data included, remain safe, secure and compliant with regulations.

Why identity has become the main target

Attackers are numerous and their methods keep getting more sophisticated, so layered, holistic security is now essential. IAM is one of those layers.

Edwardcher Monreal, principal solutions architect for IAM consumer authentication solutions at HID, points out that staff may be opening sensitive information from many places and on many devices. That gives attackers fresh chances to get into systems and data they should not reach. IAM answers this, he says, by putting access to resources under central control so that only authorised users see sensitive material, which helps stop breaches and other incidents.

Stopping breaches is what IAM is ultimately for, and going without it leaves a company exposed for no good reason. CrowdStrike's Overwatch threat hunting team reports that 80% of breaches are driven by identity. Attackers tend to skip the traditional cyber kill chain and go straight for compromised credentials, which lets them move sideways through a network far more quickly and cause more serious damage.

A recent report from the Identity Defined Security Alliance (IDSA) backs up CrowdStrike's figures. Shared with Disruptive Tech Asia by Chern-Yue Boey, SailPoint's senior vice president for Asia Pacific, it found that 84% of organisations suffered an identity-related breach in 2021 and that 78% saw a direct effect on their business.

What a breach costs

The effect takes different forms, but the heaviest is usually the cost. Egnyte puts the global cost of a data breach at more than US$4 million. In Southeast Asia, a breach costs a business around US$2.62 million, with an average of close to 22,500 records exposed. That is below the global average of about US$3.92 million for 25,575 compromised records, yet still a large sum. Breaches are also becoming more expensive: Egnyte estimates the cost rises by roughly 10% a year, which makes security matter even more.

Money is only part of it. A cyber attack can also bring regulatory fines, damage to reputation, long interruptions to work, close attention from the media and the authorities, and lower staff morale. Every business is a target, and the chance of being attacked is higher than it has ever been, as the figures below show.

IAM will not shield an organisation completely from a damaging attack. It can, however, help a great deal.

How the experts suggest putting IAM in place

Start from the big picture

SailPoint's Boey advises a strategic approach that keeps the wider picture in view. Companies, he says, should think about how they manage identities and build cyber resilience as a whole. An identity programme covers far more than access: it supports smarter identity management by sharing information with other key IT and security resources. Organisations that take this route soon find it goes beyond governing and provisioning applications, Boey says, and becomes "the connective fabric that weaves all security and compliance efforts together".

Ian Lim, field chief security officer for Asia Pacific and Japan at Palo Alto Networks, argues for much the same broad, strategic view. He would begin by enforcing the principle of least privilege, so that users get only the minimum access they need and the attack surface shrinks.

Lim also recommends strong multi-factor authentication (MFA) to keep unauthorised users out of systems and applications, since it asks for more than one form of proof. He cautions that MFA delivered by SMS is easy to exploit, and says organisations should pick a reputable authenticator app. For sensitive data and critical systems, hardware security keys such as FIDO2 may be the strongest choice.

Define the workflows first

Grant Orchard, field CTO for Asia Pacific and Japan at HashiCorp, proposes something close to trial and error, only more methodical and aimed at clear targets. His first rule is to concentrate on workflows before technology, and he strongly suggests writing down each workflow the organisation wants to support. He compares this with test-driven development (TDD), in which developers write a set of tests that functions must pass or fail and then adjust the code until every test succeeds. Listing all the workflows and situations in which users ought to reach systems, Orchard says, gives a solid base for writing IAM policies.

He illustrates this with the access a company would typically give its site reliability engineering team for an application. For day-to-day work, the team probably does not need read and write access to the production database. Suppose, though, that an engineer is on call, an incident is logged and the engineer is connecting from a company device. In that case a set of credentials with suitable permissions could be generated so the engineer can connect dynamically to the systems involved. When the incident is closed, both the credentials and the connections should be revoked.

Pair IAM with zero trust

IAM is closely tied to zero trust, a model in which every person and every device is treated as a possible threat. Nothing and nobody is trusted until their identity has been established and verified. Deployed this way, zero-trust tools authenticate each user or device on the way into the network and again as it moves around inside it or tries to open files and documents.

Adding zero trust to an IAM framework makes the framework stronger, because identity is checked at a finer level. Working together, IAM can assign predefined access to a particular user, and the zero-trust architecture then makes that user prove who they are before the access is actually granted.

This extra identity check matters: as much as 73% of data breaches involve credentials that were mismanaged or stolen. Under zero trust, an intruder holding someone's credentials still has to pass a verification step confirming the identity.

A six-step plan

CrowdStrike's El-Nabawi gives more specific guidance and sets out these steps for implementation:

1. Set the core objectives the IAM solution has to meet.
2. Audit current and legacy systems to find the gaps in the existing architecture.
3. Name the key stakeholders who will help map identities and define rules for user access.
4. Record every user group, with as much granularity as needed.
5. List every scenario in which users need access and define matching rules, considering cloud assets and how access in the cloud differs from access on premises.
6. Look at where the system must integrate with other security tools or protocols, including zero-trust or identity security systems.

Keep validating and keep training

IAM is not something an organisation sets up once and leaves alone. It has to be improved continually and given new capabilities over time.

Palo Alto Networks' Lim recommends validating it on an ongoing basis. One method he describes is to keep establishing a baseline of normal user behaviour and to investigate anything unusual. Another is to review and update access rights regularly, so employees can only reach the resources their jobs require. Reviews also bring dormant or unused accounts to light so they can be removed, cutting the attack surface further.

Lim also counts education as an essential part of good IAM. Staff need to learn, among other things, how to build strong passwords, how to steer clear of phishing scams and how to report suspicious behaviour by insiders. Training employees to spot potential threats and respond to them gives the business one more layer of protection.

Business conditions keep shifting, and companies have to let staff reach work applications and systems easily from any location without weakening security. IAM can help with that. According to ForgeRock's Hope, though, success also depends on picking the right platform, ideally one that orchestrates user access in real time and integrates with everything from legacy applications to modern ones.