What Is Identity Management?

Identity management (IM) is the practice of verifying a user’s credentials, determining their access based on those credentials and, in some cases, how to manage users within a given system.

Differences Between Identity Management and Identity and Access Management?

Sometimes IM is conflated with Identity and Access Management (IAM). In many cases, the way people use these terms are essentially identical. There is a difference between identify management and access management, however, and that difference relates to the differences between identity-based authentication and authorization:

  1. Identity closely relates to the practice of authentication, where a user must provide credentials to prove that they are who they say they are. Management, therefore, is a system of managing identities in an IT network or platform, including breaking down identities into groups, roles, and personal/professional details like biometric identifiers, document scans, and passwords.
  2. Access relates more readily to authorization, where an IT platform or network determines what users can access what resources based on their role, group, or other markers.

When it comes to implementing these features, administrators and platform developers often combine them together under the IAM umbrella. Likewise, you may often see IAM as a unified component of regulations for compliance. At the same time, understanding the difference is incredibly important.

On the one hand, a robust authentication system can help protect IT resources from unauthorized access. If access/authorization isn’t locked down, however, then it creates security issues when identities are stolen or compromised through phishing, and there aren’t appropriate access controls in place to contain the issue.

On the other hand, weakly defined authentication can make hacking much easier, necessitating password management and IT support that makes your employee’s lives miserable.

What Are Different IAM Technologies?

IAM functions over several potential protocols that help systems manage authentication and authorization securely and reliably. Some of the protocols used to support IAM, include:

  • Security Assertion Markup Language (SAML): SAML is a form of XML that allows systems to pass authentication assertions between one another to support federated identity and Single Sign-On (SSO) arrangements.
  • OpenID Connect (OIC): A federated identity system utilized by several major social platforms, like Google or Yahoo!, to facilitate standardized authentication across multiple platforms.
  • Lightweight Directory Access Protocol (LDAP): This open source protocol has been used since the 1990s, and supports distributed access to connected directors (including handling authentication and authorization to access these systems). This technology is the basis for Microsoft Active Directory.
  • Open Authentication (OAuth): OAuth is similar to OIC and SAML in that it can facilitate authentication across multiple systems. OAuth, however, includes robust controls for authorization for system resources as well.

Cloud vs. On-Premises Identity Management

Traditionally, IAM systems were hosted on servers on-premise. Furthermore, these solutions often bolted onto, or with, existing infrastructure and other systems. So, if you wanted biometrics, multi-factor authentication, strong authorization and access controls, and so on, you’d have to have several layers of disparate technologies in place.

Managed services hosted in the cloud have changed this to provide several advantages that you can leverage for your organization. With the development of hybrid on-prem and cloud environments, organizations now can leverage control over their own identity stores while also gaining key benefits from offloading development or services to cloud architecture.

Advantages of Hybrid IAM

Some of the key advantages of hybrid IM systems include the following:

  • Lower Maintenance Costs: Cloud implementations of IAM can reduce costs associated with in-house infrastructure. This means that you don’t have to pay for hardware or invest in a large IT team dedicated to IAM.
  • Readily Available to Small Businesses: Enterprise customers are often familiar with having to implement IAM on-premise through expensive hardware and software. Cloud IAM makes deploying identity-based authentication and simple, cost-effective, and accessible for businesses on a budget.
  • Leverage Dedicated Expertise: Cloud providers of specialty services will typically staff experts in that area for consulting, customer support, and management. This means that you don’t have to field a team of experts yourself and reinvent the wheel.
  • Dedicated Security and Compliance: Cloud providers will often tailor their offerings to meet the needs of specific compliance in industries like healthcare (HIPAA), federal cloud provision (FedRAMP, NIST 800-53, FISMA), or DoD contracting (NIST 800-171, CMMC). That’s including general regulations or frameworks like SOC 2 or GDPR. That means that you can plug in specific IAM cloud services trusting that they meet regulatory requirements.
  • Biometrics: Cloud platforms can additionally field more advanced features as services that you can add or remove as you see fit. Integrations with biometric capabilities can open higher levels of security through markets like fingerprints or facial scans, especially at endpoint devices like smartphones and tablets.
  • Multi-Factor Authentication: Like biometrics, MFA can increase IAM security while serving as a more secure identity-based authentication form. A cloud IAM solution can implement and roll out secure MFA capabilities for your system without requiring you to adopt expensive hardware and internal IT infrastructure.
  • Business Resiliency: Cloud infrastructure promotes business and operational resiliency. Because cloud computing and storage is managed, centralized, and (ideally) has automating practices like backups and disaster relief measures, it helps business leaders stay flexible in response to security problems. Furthermore, any loss of data or impact due to hacks can be nominally addressed through recovery efforts.

Challenges, Benefits, and Risks of Identity Management

IM plays a role in cybersecurity and compliance and brings several benefits to the table in relation to these areas. It has specific advantages that are above and beyond the benefits of cloud implementation:

  • Open Up Data for Collaboration: With a robust IAM, you can ensure that people across your organization can find data based on their role or projects they work on. While this seems like it would only put up walls, it can also make clear security boundaries that facilitate collaboration across your organization.
  • Simplified Use: IAMs can include a number of features, including MFA, Single Sign-On (SSO) features, and others to make authentication simple and reliable for your employees.
  • Holistic Security: IAMs aren’t just about passwords and permissions. They can make it much easier for your people to use devices and resources easily without compromising security. Distributed IAM can help you secure a myriad of devices like routers, IoT devices, and new smart devices.

Additionally, there are some costs and challenges associated with IAM:

  • Employees Are Your Weakest Link: This situation usually calls for continuous education and training. Reused passwords, unauthorized access, or passwords given up in a phishing attack are all weak points that exist only because of users.
  • Provisioning and Onboarding: Getting new employees onboarded calls for a rapid configuration of identities and roles, access around those characteristics, and ensuring the person has the resources to do their job. IAM is critical in managing this process at the level of code.

One way to mitigate some of the challenges of IM is to use zero-trust principles. Zero trust authorization (ZTA) always assumes that a user should be re-authorized to access system assets or features even if they provided identification at an earlier time.

Furthermore, ZTA, with the Principle of Least Privilege, can help contain problems from a hack. If a user can only access the minimal resources needed to do their job, and your system consistently re-authorizes users at strategic access points, then you can minimize breach fallout, if not prevent it altogether.

Identity Management Today is Broken: How to Future-Proof IAM

In the earliest days of computing, passwords were as close to a digital identity as we could get. But modern approaches to authentication must be much more than a password and the hope that it remains secret.

Think about it this way: when we discuss digital identity, we are potentially conflating two different things:

  • Claimed Identity, or who a user claims to be when accessing a system with a password or biometrics.
  • Actual Identity, or the data that proves that the person using credentials is the actual person who those credentials represent.

Identity-proofing ensures that hackers can’t offer credentials without having proof of their actual identity to back it up. By requiring proof documents from the user (like a driver’s license or a passport) and combining these with biometric verification like a facial scan, an identity-proof system can link claims with actual identity and avoid problems with stolen credentials.

Modern security breaches like the SolarWinds or Colonial Pipelines attacks, or insider threats like those from Edward Snowden, aren’t flukes of security but rather an example of how someone can steal credentials and use them without having to prove they are the owner of those credentials.

Currently, passwordless login using biometrics or MFA is becoming a popular alternative to traditional authentication. Eliminating passwords is a good first step, but it isn’t enough.

Even as innovations in biometric technology have introduced new ways to verify identity, they are not directly tied to that identity and as such can be spoofed through data theft, digital templates or physical recreations–hackers still break into databases, exploiting loopholes even in our most secure systems.

Incremental upgrades aren’t enough to solve our problems. They are just enough to delay their impact. It’s time to radically rethink digital identity, access and security around giving control back to CISOs and IT managers and investing in identity-proof logins.

1Kosmos: Advanced Identity Management and Authentication

Authentication is one of the more important functions in an IT system. 1Kosmos is taking that important function and revolutionizing it. The future is passwordless, and 1Kosmos’ platform, BlockID combines identity-proofing with passwordless authentication to bring together tight, compliant security with a streamlined and intuitive user experience.

BlockID includes features like the following:

  • KYC compliance: BlockID Verify is KYC compliant to support eKYC verification that meets the demands of the financial industry.
  • Strong compliance adherence: BlockID meets standards like NIST 800 63-3 for Identity Assurance Level 2 (IAL2) and Authentication Assurance Level 2 (AAL2).
  • Incorruptible Blockchain Technology: Store user data in protected blockchains with simple and secure API integration for your apps and IT infrastructure.
  • Zero-trust security: BlockID is a cornerstone for a zero-trust framework, so you can ensure user authentication happens at every potential access point.
  • Liveness Tests: BlockID includes liveness tests to improve verification and minimize potential fraud. With these tests, our application can provide proof that the user is physically present at the point of authentication.
  • Enhanced User Experience: With the BlockID app, authentication and login are simple, straightforward, and frictionless across systems, applications and devices. Logging in to a system isn’t difficult, and you don’t have to sacrifice usability in the name of security.

With these measures, you won’t have to worry about the common weaknesses of password systems like brute-force attacks or stolen passwords.

If you’re ready to learn about BlockID and how it can help you remain compliant and secure, read our whitepaper on how to Go Beyond Passwordless Solutions. Make sure you sign up for the 1Kosmos email newsletter for updates on products and events.