Governance & Risk Management
,
Identity & Access Management
,
Security Operations
Improving Security by Integrating IAM Infrastructure, Applications and Services
As we become more and more connected in the digital world, protecting our identities and the information associated with them is extremely important. The first data attackers focus on is personal information, which they use to gain a foothold in the targeted entities. We need to adopt a more robust control framework – the identity fabric.
See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government
What Is the Identity Fabric?
According to Gartner, identity fabric is an architectural approach that aims to integrate identity and access management infrastructure, applications and services. This integration allows employees, partners and customers to have consistent and seamless access to both digital and physical resources. Identity fabric is the foundation of an organization’s security infrastructure – seamlessly stitching together various IAM components and systems to create a unified user experience across different platforms and environments.
The identity fabric contains many of the same features defined by traditional IAM methodologies, but it is heavily focused on the following ones:
- Centralized management: Centralizing the IAM processes results in improved efficiency, reduced complexity and enhanced control over user identities, access rights and entitlements.
- Seamless user experience: Enable single sign-on capabilities to eliminate the need for multiple usernames and passwords and allow users to access applications, platforms and devices with just one set of credentials.
- Adaptive security: This is also called user and entity behavior analytics. The identity fabric leverages contextual information and adaptive intelligence to assess the risk associated with user access requests. By analyzing such factors as user behavior, device information, and location, the system can dynamically adjust security measures and grant or deny access accordingly.
- Integration and interoperability: Integrating various IAM systems, applications and services within an organization promotes interoperability. Interoperability ensures compatibility and enables a smooth flow of data between different systems. And compatibility fosters efficiency and reduces integration challenges.
- Future-proofing: As organizations continue to expand their digital footprint and embrace cloud technologies, future-proofing into IAM will allow them to adopt and integrate new solutions more quickly.
The identity fabric will quickly become a must-have for organizations. Gartner predicts that by the end of 2024, identity fabric will be the foundation for secure access management in 70% of companies. Gartner also predicted that by the end of 2023, 40% of organizations would be using identity fabric to enable secure access to multi-cloud ecosystems.
Identity fabric is not a silver bullet solution that will magically sort out your risks. As with any architecture, if you get it wrong and don’t heed the advice of experts you may end up with a design that doesn’t work or that will cause problems in the future. Before you can roll out an identify fabric, you need to understand all aspects of the IAM life cycle, assess all the areas of risk and make sure that remediation controls are in place.
Your risk assessment must consider all risks that an identity fabric poses to an organization and how to reduce those risk to acceptable levels. Here are the risks that are directly affected by the use of the fabric:
- Single sign-on: SSO is great, but in the world of hyper interconnectivity, it can lead to hyper breaches of infrastructure and systems – for both the organization and the people involved. This is largely due to password fatigue and the use of one password across corporate and personal resources, so a breach in one can be a breach in all. To avoid this, add multifactor authentication to the mix. For sensitive systems, challenge again for the passwords or disable SSO.
- Entitlement management: When using an identity fabric, it is extremely easy to wind up with entities that contain toxic combinations on both local and cloud-based resources. Check entitlements across the entire estate for the existence of these combinations.
- Identity governance: The IAM life cycle must be applied uniformly across the estate and be able to execute in near real time. The SOC needs to have a view of the changes to identities and their associated entitlement throughout the life cycle, especially if those changes are done outside of the approval flow. These exceptions must be matched to UEBA, and the SOC must have an updated playbook so that it can corrective action before an exception becomes an active incident.
CyberEdBoard is ISMG’s premier members-only community of senior-most executives and thought leaders in the fields of security, risk, privacy and IT. CyberEdBoard provides executives with a powerful, peer-driven collaborative ecosystem, private meetings and a library of resources to address complex challenges shared by thousands of CISOs and senior security leaders located in 65 different countries worldwide.
Join the Community – CyberEdBoard.io.
Ian Keller has over three decades of experience in information security. Currently, he leverages his extensive knowledge and expertise to bridge the gap between corporate telecommunications intelligence and business communication, providing data-driven solutions for informed decision-making and enhancing product quality in line with ISO and best practices. Keller is a chief information security officer whose career has encompassed sectors including telecommunications, network security, financial services, consulting and healthcare. His expertise in customer security, identity and access management, information security, and security awareness has made him a sought-after speaker at international events.