IAM Security: What It Is and What You Need to Know

Jul 8, 2021

-minute read

The FBI's latest report on Internet crime reveals an alarming increase in phishing, ransomware and malware attacks on U.S. companies. The FBI's Internet Crime Complaint Center (IC3) received nearly 20,000 reports last year of business email compromise/email account compromise (BEC/EAC) events—hackers compromising organization email accounts using intrusion and/or social engineering techniques—that caused companies to suffer almost $2 billion in losses. And the number of total complaints the IC3 receives has skyrocketed, up from roughly 300,000 complaints in 2016 to 790,000 in 2020.

Preventing hackers from infiltrating a company and jeopardizing its integrity is a full-time job for today's IT departments. Cybercriminals have access to a limitless amount of knowledge, tools and technology via the Dark Web. The sophistication and speed with which they use to compromise organizations continues to grow rapidly, with no end in sight.

One of the most important tools for fighting cyberattacks is identity and access management, which ensures only the right people are accessing company resources. By providing authorized users with secure, seamless access to all their applications and resources from anywhere, companies unlock value while delivering better security.

What is identity and access management (IAM)?

Identity and access management is the set of solutions that help your organization attain the right level of assurance for a specific situation through the collection, analysis and management of identity attributes and information. IAM evaluates context, device and risk signals for smarter authentication and authorization decisions, optimizing security and convenience so you can simultaneously protect your organization and make interactions easy for your workforce and customers.

Although IAM typically refers to authentication and authorization, the identity and access management field as a whole may encompass a full range of identity security capabilities, such as:

Directory
Identity verification
Consent collection and data privacy management
Risk management
Personal identity
API security
Self-service for users and developers

What are some features of IAM security?

Precisely managing the digital identities of employees, partners and customers while safely controlling access to corporate resources is the core definition of IAM security. Methods for ensuring these protocols include:

Authenticating and verifying users in real time, based on factors that include the user’s device, behavior and other contexts (time of day, geographical location, etc.)
Using dynamic authorization to grant or restrict access to resources, share specific pieces of data or authorize sensitive actions
Seamlessly managing access privileges (assigning, removing and/or suspending user privileges)

Increasingly the first choice among enterprises, cloud IAM, or identity as a service (IDaaS), is a group of IAM solutions deployed in hosted environments. In addition to providing powerful security against hackers, IAM in the cloud frees up IT teams from the operational nuts and bolts of hosting and managing a solution themselves. Consequently, employees can devote more time to developing IT enhancements intended to contribute to the success of the company.

Best practices for IAM security: What makes IAM so effective?

In today’s hyper-connected world, remote access is essential. Customers and employees are mobile, and business applications are in the cloud. But the traditional, network-based security perimeter leaves sensitive digital assets vulnerable and hampers employee productivity due to lack of access. As digital enterprises open up unprecedented access to resources, it is imperative that they move to dynamic and continuous authentication and authorization to protect their apps and data.

An identity-centric approach allows security teams to focus on the secure processes and technologies that can be applied directly to corporate resources, irrespective of where they’re located. A popular strategy for modern enterprises is the Zero Trust security model, which is built on authentication and authorization controls rather than network perimeters.

[MUSIC] Hey, welcome to this fast chat exploring why zero trust starts with identity.
I'm Black Hat contributing editor Alex Wawro and with us today is Baber Amin, CTO west for Ping Identity.
Baber, thanks for joining us.
>> Thank you, Alex.
>> All right, let's get right into it.
I think first let's ask like what are the essential components of zero trust?
And why is identity key?
>> So, well the one essential component of zero trust is identification right?
If you don't know who somebody else is, then, you're you're starting off on the wrong foot.
And that's one of the reasons why identity is key.
Because you're not relying on any discrete events anymore.
You're not relying on any discrete mechanisms, but it's more of continuously verifying and and evaluating trust in the person or the device or the process.
>> So what are some easy wins for people who are looking to get started with zero trust?
>> So we get asked that a lot, right and I always tell people look, again start with proofing, so making sure that who it is from before you give somebody a credential and then move to authentication.
Then move to access and then move to consolidating your data stores.
Like a lot of people think, let me just consolidate my data stores.
And you know that project takes forever and it never succeeds because it never finishes.
>> Yeah.
So what type of companies do you think would benefit most from a zero trust approach?
>> Well, I used to say that you know, if you have a lot of people that are remote workers, they would benefit the most.
But given that everybody is remote now, I say everybody can benefit, because without zero trust, which is really a bad name for this, right?
Because it's not like you don't trust anything it's that you don't trust anything by default, right in a static manner, so a better name would be maybe ephemeral trust or something like that.
But everybody benefits from that, especially nowadays when you have all folks working remotely in giving things like telehealth or even the proofing that a doctor can prescribe you medicine they have to go through a certain amount of proofing.
That they are credentialed and everything else so that that used to be all in person, new employees.
Right?
>> Right.
>> When you get a new employee on board, you check their authorization to work the I9 form all of that, that used to be in person.
So all of that has to be remote now too, so pretty much everybody benefits from implementing zero trust principles.
>> So, besides technologies like what are the key things people need to know about the people and processes required for zero trust?
>> Yes.
So that's another place where people think that zero trust is some silver bullet and if I implement these four things, and yay, I'm good to go.
[LAUGH] But security is a people problem and a people solution.
The worst thing in security and the biggest hole in security is the combination of the person, email and clicking on links.
Because that violates no matter what kind of firewalls you put up no matter what kind of gates you put up.
It's that one person who didn't think about it or just clicked on it, right?
So that's the weakest link.
So processes become very important because it's educating your folks.
Look, don't do this or, don't connect to systems, don't download information to your machine that is not a possibly have the same level of security or patches on it right?
Don't download super secret documents to grandma's PC that has never been patched for the last 10 years.
And just because you need to work on something right after Thanksgiving dinner.
That is if we get to go to grandma's house this year.
So, yeah, people, processes, education and in really getting that buy in from your organization is very, very important.
>> Yeah, that makes a lot of sense.
Well Baber, thank you so much for joining us today and thanks everyone for taking part.
>> Thank you, Alex.
[MUSIC]

IAM delivers identity-driven security through tools such as contextual multi-factor authentication (MFA), federated single sign-on (SSO), standards-based access control that dynamically adapts to users and devices, an encrypted data store of consolidated user data, and data governance with a single set of policies for streamlined compliance. Identity at the core of enterprise security gives organizations centralized, policy-driven control that enables strong protection of enterprise apps, services and APIs.

Common IAM Security Tools

The following tools are crucial to upholding IAM security. They include but are not limited to:

Single Sign-on (SSO)

Single sign-on is a type of IAM control that enables users to authenticate their identity across numerous resources via one set of credentials. The first time a user signs on, the username and password are directed to the identity provider for verification. The authentication server checks the credentials against the directory where user data is stored and initiates an SSO session on the user’s browser. When the user requests access to an application within the trusted group, instead of requesting a password, the service provider requests that the identity provider authenticates the user’s identity.

Advantages of SSO include:

Attack surface reduced from many credentials down to one
A streamlined user experience and minimized password fatigue
Lowered security risks involving partners, customers and other entities associated with the organization

Multi-factor Authentication (MFA)

When a hacker finds an account supported by only one password and one username, they know they've hit pay dirt. Cybercriminals have access to software purchased on the Dark Web that can send hundreds of thousands of passwords and usernames to this account in less than a minute. Once the account recognizes the right combination of letters, numbers and symbols, the hacker can access the account and potentially get ahold of sensitive company information.

Multi-factor authentication ensures that digital users are who they say they are by requiring that they provide at least two pieces of evidence to prove their identity. Each piece of evidence must come from a different category: something they know, something they have or something they are. If one of the factors has been compromised, the chances of another factor also being compromised are low, so requiring multiple authentication factors thereby provides a higher level of assurance about the user’s identity. These additional factors might take the form of numerical codes sent to a mobile phone, key fobs, smart cards, location checks, biometric information or other factors.

See how an access request works with MFA:

Flow chart showing an example of how twofactor authentication works

Self-service Password Resets

One important but often overlooked feature of an IAM security solution is the ability to implement self-service password resets instead of requiring users to send requests to IT department help desks. By enabling employees to use MFA to authenticate their identity and reset passwords, not only do you reduce the number of costly password resets, but the security risk of password hijacking by hackers monitoring system "chatter" is significantly reduced.

Hi, I'd like to talk to you today about identity defined security.
Many leading global companies have unlocked huge value in identity and access management solutions.
But putting identity at the core of your security architecture, you can reduce the risk of stolen credentials, eliminating the number one threat of breach in the enterprise.
Centralized access control to remove security holes and improve compliance.
Protect your customers and employee identity data from end to end.
And enforce both corporate data access policy and user preferences for data privacy.
Most organizations today still rely on a perimeter based approach to security.
This is made up of both the physical walls of their office and a network firewall.
This made sense when all the users applications and identities were inside this perimeter and the bad guys were on the outside.
But today, users and their devices are mobile.
And many SaaS enterprise applications and services are in the cloud, making a perimeter based approach to security ineffective in securing the enterprise.
To make matters even worse, users authenticate with many passwords giving hackers a much larger surface area for attack.
Well there's a better way, the Ping Identity platform makes identity a security cornerstone with five key capabilities.
First, single sign-on gives all of your users, your employees, customers and partners single-click access to SaaS, cloud, and legacy apps.
SSO from Ping lets you authenticate your users once, no matter where they are with a single set of corporate credentials, eliminating all of those insecure passwords and giving your organization a single authentication authority.
But since most organizations still rely on passwords for their corporate credentials, they're still susceptible to breach.
Multi-factor authentication or MFA allows your enterprise to move beyond passwords with a great user experience.
As users sign on, policy is evaluated using contextual data to determine if step up authentication beyond a password is necessary.
If so, they're prompted for another factor.
This is highly configurable, including one time pass codes via SMS, email or voice or maybe a user is prompted for a fingerprint on their device.
With MFA, hackers are denied access even with a stolen password.
Okay, so now your users are securely authenticated, but not every user should have access to all applications.
The access security capability will give your organization a central policy driven access control layer for all enterprise apps, whether they're in the cloud or on premises.
As users make requests to applications or to API's through a mobile application for instance, contextual data and attributes such as the application page requested, time of the day, network, session status, group, etc.
are used to evaluate authorization policy at the application page or API level and determine whether access is granted or denied.
Another challenge that many organizations face is keeping their customer and employee identity data safe and secure.
Many times identity data is scattered across many unsecure data stores and directories.
The Ping directory consolidates and secures your sensitive identity data at all phases during capture, and transit, at rest, or during reporting and logging.
It does this without sacrificing performance or scale.
In addition, most organizations are required to govern who has access to what data.
For instance, when a partner requests customer data maybe to fill an order, you may need to protect social security numbers or credit card data.
The Ping data governance capability enforces both corporate policy and user privacy preferences for all requested data from partners, various corporate groups or other applications.
Ensuring your organization complies with all relevant industry, geographic, or corporate policies.
The Ping Identity platform makes identity the new perimeter, strengthening corporate security, and ensuring regulatory compliance without sacrificing user experience.
Thank you.

Protecting Your Organization with IAM Security

Here at Ping, we believe that modern identity is the thread that ties the digital world together, and is critical to achieving digital transformation. Customer demand for privacy and protection has never been greater, and the global health crisis shone a spotlight on the need to secure remote access so work can get done anywhere. This means getting IAM security right is your number one digital transformation priority today.

To learn more about why the world's largest enterprises choose IAM solutions from Ping Identity to protect their most critical assets and enable secure access for employees, customers and partners, we invite you to watch this video.

Share this Article: