Making updates to your IAM framework
This Security School is a free multimedia learning guide designed to help you understand and address the strategic and tactical implications of this topic.
Your IAM infrastructure helps provide the secure integration of one or more canonical directories with all your company's resources. But with resources becoming increasingly cloud-based and mobile, and user identities and their corresponding permissions clashing across different directories, how do companies keep track of user roles and access?
"Most companies don't know what access their users have or whether it's appropriate for what they're trying to do," says Johna Till Johnson in this video. Johnson is CEO and founder of Nemertes Research, a research and consulting firm specializing in evaluating the business impact of emerging technologies. She cites this "access excess" as a major security problem companies are facing, one which makes it difficult to pinpoint and stop deliberate insider threats and APT attacks that exploit user access. This is why it is important to revisit your company's IAM infrastructure as part of its larger risk management program.
Johnson explains what IAM does specifically to provide and regulate user access, and outlines three emerging challenges companies are facing with their IAM infrastructure -- namely migration to the cloud, software-defined everything and mobility. "Generally, cloud and mobile exist entirely out of the IAM infrastructure, which means the most important and most emerging technologies are the least protected," she cautions.
Knowing the issues at hand, who can assist your company in making decisions about its IAM infrastructure? Johnson covers some of the directory providers, cloud, system and application vendors and third-party security vendors to turn to for tools that can sieve out users with excess access, to improve your IAM as a whole. She also provides some recommendations about the steps to take when implementing changes to your IAM strategy.
Watch this video to learn more about the emerging challenges your existing IAM infrastructure is facing, and how to deal with them.