IAM, MFA, PAM - Where to start?

Security hacking intensity in today’s world has increased to such a point now to reduce the effectiveness of typical approaches to Identity and Access Management (IAM) prioritization. IAM is no longer simply about compliance or IT automation. Attacks can be prevented or minimized with the correct application of IAM, carefully considered in the correct context, with the correct tools (such as Provisioning, Governance, Multi-Factor Authentication, Privileged Account Management, and others).

Access control is a cornerstone of a solid security program, and when done right contributes significantly to the security of your information. The IAM market continues to grow and evolve to solve the challenges of compliance, governance, audit, and IT efficiency. There are great technology options in the IAM space today. Even though they continue to improve, fundamental challenges to effective IAM remain. One of the often overlooked challenges is the management of an IAM program.

IAM is most effective when the organization achieves and maintains a balance between technology, automation, and practicality. IAM technology does a pretty good job securing resources, however, knowing which resources to secure and to what extent is the greater ongoing challenge.

For many years, IAM programs and professionals have relied on a number of methods to determine scope and focus for their solutions. A common approach is to reference regulatory requirements. An organization might consult a Sarbanes-Oxley (SOX) compliance checklist to build a list of IAM targets. The resulting list of systems and business scenarios is very long, so the IAM program uses the 80/20 rule to implement provisioning and other IAM concepts to target “the important ones.”

Systems that don't make the SOX list, or don't have enough users to make the positive ROI justification could be weak links from a hacking point of view due to the data they manage in critical business processes. Applying IAM controls (i.e. enforcement of policies or controls to limit access or monitor usage) to those systems is very important from a risk point of view.

How will organizations best determine where to start?

IOR Insight supports organizations with these kinds of challenges. IOR builds and maintains the details of your business processes and the context of the use of your data, systems, and vendors. We give you the knowledge to make better decisions about securing your information and the justifications for the hard decisions related to funding and resource allocation that your organization will understand and support.

IOR Team