Access Governance and Identity Management Continue to Shine

Featured article by Dean Wiech, Tools4ever

According to new research by Forrester and IDC, the identity and access management market is a bright post in the slumping IT market. The vast majority (77 percent) of respondents to the survey of 239 security decision-makers in the U.S. and the U.K. indicated that plans are underway in their organization for new investment in IAM of externally focused website and applications.

While this is certainly exciting news, especially for purveyors of IAM applications and consulting services, what is driving companies to invest in these solutions while budgets are being slashed or held constant in many other areas of IT? Let’s take a deeper look into two of the reasons.

The Cloud

As organizations migrate from applications and servers on premise to the cloud, the benefits they will reap are well defined — guaranteed uptime, painless upgrades and availability from anywhere on almost any device. One thing they may not realize is that provisioning users in cloud applications can be considerably more difficult and time consuming than the same tasks on in-house applications. Instead of a simple script or file load, they are now confronted with complex web services and in some cases, restrictions on what can be accomplished automatically.

IAM solutions have tackled this problem and commonly have built-in connectors for the most popular of cloud applications. Instead of utilizing internal resources to build these connections, commercially available products are a relatively inexpensive way to manage users in the cloud. This also means that if a cloud vendor changes their API for the interface, the vendor is on the hook to modify their connector to insure it will continue to function after the old interface methodology is depreciated.

Often overlooked is the important task of de-provisioning users. When the company is paying a monthly fee per user, it is critical to get them deactivated immediately upon departure from the company to ensure costs are kept in check. The other side of this is data security. By disabling users immediately, they no longer have access to potentially sensitive company information.

Access Governance

Once only looked at by large organizations because of cost and time consuming implementations, access governance has made significant advances in being readily available to organizations of all sizes. The concept behind access governance is quite simple – assign access for applications and data to employees based on what they need to perform their job – no more and no less. While conceptually simplistic, the implementation can be anything but.

While the initial set up of access rights can be determined by a basic role-based access control matrix, nothing remains constant over time. Employees need access to additional items for special projects, their position may change within the organization or they are given special rights as the result of human error.

Access governance allows managers and system owners to review and, if necessary, make corrects to an individual’s access rights through a process called attestation. This process can occur on a regularly scheduled basis – quarterly, for example – and handled entirely electronically via web portal. Taking this one step further, the portal can be opened up to employees to request additional access rights and then a single or multi-step approval routing process occurs before the access is granted.

Summary

Based on these two factors alone, it is easy to comprehend why organizations are planning on investing in IAM solutions, even as overall IT spending remains stagnant. Other technologies, such as the cloud and the functional enhancement of IAM solutions, even as pricing drops, make these solutions more appealing to all companies looking for better security, and relieving their IT departments of time consuming, repetitive tasks.

Dean Wiech is managing director of Tools4ever, a global provider of identity and access management solutions. Dean has worked with businesses for more than 20 years, helping them identify solutions that make their businesses more secure, efficient and easier to manage. He is responsible for Tools4ever’s U.S. operations and has written dozens of articles about identity and access management, security, IT audits, BYOD, the cloud and managing IT for small businesses to enterprise systems. Follow him on Twitter.