Transforming IAM – not Panicking

Organizations need to transform Identity and Access Management (IAM) so it becomes both a core enabler of digital business and the central mechanism for mitigating digital risk. IAM’s scope and priorities have shifted: it now must handle not only employees, but also the identities of things such as devices, services, and apps. At the same time, identities are increasingly managed across multiple Identity Providers with varying levels of trust, and identity data is distributed across multiple Attribute Providers rather than residing in a single authoritative source. Users also operate with multiple personas, switching identities depending on context, which increases the need for IAM to unify and interpret identity signals accurately.

IAM 3.0 emphasizes aligning IAM strategy and architecture with changing business needs instead of reacting to incidents and audits by purchasing disconnected point solutions or merely renovating existing technology. A key pillar is “Know and Serve Your Customer,” where connected businesses must recognize individuals across multiple devices and identities to improve interaction quality, customer experience, and responsiveness. CRM should be treated as a central identity store because it often contains the richest customer history, requiring a cross-system approach that reduces silos and supports faster time to market. Authentication must be context-appropriate, with adaptive security controls that reflect the risk and conditions of access, including how a user authenticated.

The second pillar positions IAM in the frontline of cybersecurity: preventing illegitimate access through proper assignment and management of permissions, detecting abnormal usage patterns by correlating “apparently legitimate” behavior with other factors (including insider misuse), and responding quickly by disrupting threats through rapid removal of exploited access permissions.

• Identity management includes identities of things such as devices, services, and apps, not just human beings.
• Identities are no longer all managed internally because multiple Identity Providers are involved.
• Multiple Attribute Providers supply identity information rather than a single source providing all identity data.
• Most users have multiple personas and can switch between them at will.
• There is no single best method to authenticate users; authentication should match the context and risk.
• Cyber risks cannot be managed only at the firewall; understanding normal individual behavior is essential.
• Many organizations react to incidents and audit failures by buying point solutions.
• CRM is the biggest identity store in most companies and contains the history of each customer.
• Cyber-attacks often focus on stealing legitimate credentials or using social engineering to introduce malware.
• IAM can disrupt illegitimate activity by removing the access permission being used.

• “Organizations need to transform their Identity and Access Management (IAM) to become the central element in digital risk mitigation and to enable their digital business.”
• “Organizations must take a strategic approach to match IAM to the way in which their business needs are changing.”
• “Know and Serve Your Customer through mastery of the multiple identity sources.”
• “Take a more risk driven approach to IAM including adaptive authentication.”
• “Exploit IAM capabilities to Prevent, Detect and Respond to cyber-threats.”
• “Many organizations are panicking at, and simply reacting to, incidents and audit failures by buying point solutions.”
• “People connect to digital services using multiple different devices and identities.”
• “Being able to identify the individual behind these is vital to successfully managing their interactions.”
• “Rather than information silos, a cross-system approach to IAM is needed.”
• “IAM processes, data and technologies provide an essential foundation for responding to threats by providing the capability to quickly disrupt illegitimate activity by removing the access permission being used.”