The Evolution of Customer Identity and Access Management (CIAM)

The rise of customer identity and access management (CIAM) is tied to changing customer behavior and expectations. The pandemic accelerated the move from face-to-face customer interactions to new digital channels, with customers shopping, banking, receiving telehealth services and socializing online. Having digital channels and online services that can be securely accessed from any device at any time shifted from "nice to have" to "must have" for many organizations. A solution dedicated to customer identity management (a CIAM solution) became a better option from a technology and value perspective to deliver frictionless user experiences than leveraging traditional identity and access management (IAM) solutions or building out customer data-focused functionality in-house.

As with identity and access management (IAM), CIAM is designed to help organizations manage user identities as they access data and applications, however, it is important to note that the two are fundamentally different. An IAM solution is typically used to secure employee, partner, and contractor identities, as well as IoT devices, APIs, and other IoT devices, while a CIAM solution is specifically designed to provide frictionless access to online services for consumers, which means it must address a range of challenges beyond those associated with managing "known" entities for which organizations control user access privileges.

Traditional identity and access management (IAM) solutions are used by organizations to protect access to resources for their employees. These solutions are not sufficient to meet the scale, performance and security requirements associated with customer identity. CIAM solutions on the other hand, are massively scalable and highly available across a variety of data centers, hosting platforms, and geographic regions.

Performance & Scalability

Large employers may have to store, secure and manage and protect customer data and identities alone for hundreds of thousands of employees with their workforce IAM solutions. These workforce IAM solutions are not architected to handle the data of millions of online consumers and the demand spikes associated with events or sales that drive thousands or millions of customers to sign up or log on to an app in a short period of time. For example, an e-commerce site without a CIAM solution in place would probably not be prepared for Cyber Monday traffic spikes from both new and existing customers, and would open itself up to fraudulent activity, while also missing out on legitimate sales.

Functionality

Traditional IAM solutions have been proven to not have key functionality required for a customer experience because the use cases are different. The customer use case includes account registration, privacy regulations, secure access, consistent multi-channel experiences, and the ability to use their profile data from social media accounts as a social login.

Employees don't expect self-service registration to create their enterprise account, nor do they expect to use their profile data from Facebook/LinkedIn/Twitter account as a means of login for their work applications.

Frictionless Security

Consumers around the world are shifting more of their activity online as COVID-19 changes the way people interact with brands. As more consumers become accustomed to doing everything online, privacy has undoubtedly become a greater source of concern and customer trust in organizations has changed.

It is essential that customer identity solutions are easy-to-use; from a seamless customer registration process through to the customer journey in order to keep customer loyalty and satisfaction and prevent customers from switching to competitors.

Some organizations looked internally to build their own CIAM solution with the necessary customer identity functionality for their first project, such as an app or a website, however, building and maintaining an in-house centralized customer profile solution was time consuming and resource intensive. It also relied on employee knowledge, which may have been lacking. Let's examine the options.

The Challenges with Building CIAM Solutions Internally

There were numerous problems with the DIY approach to CIAM solution:

• Limited scope. As much as it is desirable to build software ourselves, the limited scope of constructing an in-house solution may make it difficult. It requires a dedicated team of developers. The constraints of resources and business priorities mean developers must prioritize their time, and often enough, this means that building an in-house solution won't allow the team to address all software requirements, resulting in the team focusing on one app while having difficulty meeting requirements for other apps.
  

   

• Lack of expertise. Brands and developers aren't CIAM solution or identity experts. On-ramping takes time and keeping up-to-date on identity trends, standards and best practices can be challenging when combined with day-to-day responsibilities.
  

   

• Incompatible solutions and security gaps. Development teams might end up building different solutions for each app, which leads to disconnected experiences, lack of coherence across different applications and potential gaps in security as each app might have different vulnerabilities, audit trails, and compliance requirements.
  

The Benefits of Buying CIAM Solutions from Experts

Experts are able to create holistic CIAM solutions that work across your apps, APIs, and websites along with partner apps, APIs, and websites. In addition they also provide:

• Improved Customer Experience. Organizations that have customers interact with their own apps and websites along with those of their partners reduce friction with CIAM solutions. Single sign-on (SSO) allows customers to login with one set of credentials and access multiple apps or websites. The solution also allows for progressive profiling and streamlines account updates, all while securing the customer data. When a customer updates their address or other information in one app, the shared customer profile in the directory updates the information for all the apps in turn providing a seamless customer experience. For example, a bank customer who updates their address in a bank's app can order checks from a connected app without having to update their address on that app too.

• Fewer Password Resets for IT Help Desks. In terms of employee identities, passwords are very expensive for organizations. According to a survey conducted by security firm Yubico, organizations spend an average of 11 hours per year on password resets, while individuals spend slightly over 12 minutes per week entering and resetting passwords. Moreover, a company employing 15,000 workers experiences an average annual cost of $5.2 million in productivity loss.

   

  Furthermore, a more recent survey conducted by Wakefield Research on behalf of Ping Identity and Yubico, which included 600 IT leaders from five markets, discovered that 33% of them reported that employees at their organization either make minimal changes to passwords or reuse old ones. This could explain why 50% of them consider password security to be a major concern. Passwords account for 33% of IT department tickets on average, and for 21% of them, half or more of their tickets are password-related.

   

  Source: "One Passwordless Future: A New Era Of Security," Ping Identity, 2022

   

• Reduce Account Takeover (ATO) Fraud. Multi-factor authentication (MFA) requires customers to prove their identities using two or more authentication categories:

   

  • Knowledge - Something you know. This includes customer data such as passwords, PINs, answers to security questions and other types of information that customers share with enterprises.
    

     

  • Possession - Something you have. A device in the customer's possession is sent a soft token, often a one-time password, generated by a transaction or an application. Alternatively, a customer may possess a hard token, like a USB-based device or separate code generator.

     

  • Biometric - Something you are. This is an inherited trait and confirmed with a scan, such as a fingerprint scan, facial recognition or a retinal scan. Biometrics require some sort of scanning device, like a smartphone.

     

• If a fraudster is trying to use compromised credentials to access a customer's account, they will also need to provide proof from the Possession category and/or the Biometric category before being granted access, which is unlikely. Preventing a data breach while keeping fraudsters from taking over customer accounts reduces theft, customer frustration and brand reputation damage.

   

• Consumer Privacy and Regulatory Compliance. Data privacy policies and regulations require enterprises to have adequate solutions in place to ensure compliance and avoid penalties. A CIAM solution helps enterprises comply with open banking requirements like the Payment Service Directive 2 (PSD2), and data privacy regulations like the General Data Protection Regulation (GDPR) and the California Consumer Protection Act (CCPA). When regulations are updated or new regulations are introduced, CIAM allows you to move quickly and stay in compliance.
  

Imagine a world where drag-and-drop replaces coding. That's where CIAM is headed.

Right now, securing digital identities is a challenge because legacy identity and authentication solutions were not designed for today's use cases. Most current user identity management and authentication solutions are a patchwork of software and API services that are overly complicated, insufficient and expensive.

The future of CIAM involves a no-code orchestration engine that allows organizations to rapidly create, test and optimize customer digital experiences across multiple data centers and the entire identity lifecycle. The integration works with legacy and current systems. Designing automated workflows for different identity use cases like fraud detection, identity and data breach proofing, authentication and authorization just became easier.

To learn more about customer identity and access management (CIAM), please read our Ultimate Guide to Customer IAM.