Introduction

Disclaimer: The views expressed in the content below are solely those of the author and do not necessarily reflect the views of the IDPro organization.

Both the identity and the data security world can be vast and complex these days. It’s sometimes common to see that people (organizations) consider these completely disconnected, and that couldn’t be more wrong.

One of the key responsibilities of an IAM practitioner is to ensure that the right people have the right access at the right time. This article aims to shed light on the crucial role of IAM practitioners in data security, providing an insider’s perspective on the challenges, triumphs, and the evolving landscape of this vital field. Whether you are an IAM professional seeking insights from peers or a cybersecurity enthusiast looking to understand the intricacies of IAM, this article offers a comprehensive overview of data security through the lens of an IAM practitioner. So, let’s dive in and explore the fascinating world of IAM and its impact on data security.

The role of IAM in data security

We can say that IAM can be considered as a framework for business processes related to the management of digital identities. At a minimum, this should cover key aspects related to the first steps of an identity, like onboarding (HR-driven or other methods depending on the type of identity (employees, guests, non-human)), entitlements, activity recording, management in general, monitoring and automations.

Next, it is time to start talking about the role of IAM in data security. Considering the above paragraph, it is crucial to ensure that only authorized individuals have access to resources and data. It is time to think about how crucial IAM is in ensuring that only authorized users have access to resources, devices, data, etc. Here is where we should think about everything related to the design, creation, and management of roles and access privileges, as well as granting, or not, those privileges.

The role of IAM in ensuring compliance with different regulations is crucial. As IAM practitioners we must help organizations to meet regulatory requirements related to access to data and privacy, through the implementation of policies and procedures.

Identity lifecycle management and data security

Managing the lifecycle of identities is a task where we must ensure that access rights are granted when needed and revoked when no longer necessary, all while maintaining compliance with various regulations like GDPR, HIPAA, SOX, etc. We need to make sure that we are also capable of revoking access in real-time if needed, and that use to be in general related to the integration between data security and IAM solutions, and through events, signals and triggers.

If we think about Open ID Connect providers, we can talk about the Continuous Access Evaluation protocol, or CAEP (OpenID Continuous Access Evaluation Profile 1.0 – draft 02). This protocol allows for real-time evaluation of user access, enhancing the security posture of organizations. It enables a dynamic exchange between the token issuer and the relying party, allowing for immediate response to critical events such as user termination network location change, and others. This ensures that only authorized individuals have access to sensitive data, thereby significantly reducing the risk of data breaches. In an ideal world, all the solutions can potentially provide access to sensitive data, should take advantage of CAEP and policy-based access controls (PBAC).

IAM, data security, and the user experience

Finding the right balance between security and the user experience is key if we don’t want to create frustration. Some of the key aspects to consider are:

• Seamless access to resources. This could be translated into users not needing to enter multiple passwords to access multiple systems.
• Secure access to resources. This is about controlling what users can and can’t access, so sensitive data and functions are restricted to those who really should have access. This enhances security and builds user trust.
• Role-based access. To ensure that users have the right level of access to corporate resources. Think about this as a clear benefit these days with the increasing adoption of remote working and cloud adoption.
• Minimizing disruptions when redirecting users from the service provider to other applications or services.

In summary, this is all about designing and implementing processes and controls aligned to the security policies and regulatory requirements. It is also about continuously monitoring and updating these processes and controls to respond to evolving security threats and business needs.

The role of IAM practitioners in preventing data exfiltration

IAM practitioners can contribute to preventing the unauthorized transfer of data in many ways:

• Applying access controls to manage the access from non-corporate networks or devices, as well as risky IP addresses and others.
• Adopting Data Loss Prevention (DLP) strategies. This is something that in general is more associated to data security practitioners, however we have to make sure that it is possible to integrate our DLP policies together with our IAM policies. For example, our policy engine could offer the possibility to create more granular controls that allow us to associate DLP policies created in our data security solutions.
• Making permissions to very sensitive data temporary and subject to frequent review and revocation, in order to prevent long-term access to sensitive data.

How can IAM and data security practitioners contribute to reducing costs

IAM and data security practitioners can contribute to reducing costs in several ways:

• Reducing data breaches through the implementation of strong IAM practices.
• Ensuring compliance with regulations such as GDPR, HIPAA, PCI and others. Being non-compliant can result in hefty fines.
• Improving operational efficiency by automating processes related to the management of digital identities.
• Reducing the impact of employee turnover by implementing processes to deprovisioning access rights once a user leaves the company or as their role within the organization changes. This contributes to preventing gaps that could be potentially exploited by bad actors.

Conclusion

IAM practitioners play an indispensable role in ensuring that the right individuals have the right access at the right time, thereby significantly enhancing an organization’s security posture.

From managing the lifecycle of identities and preventing data exfiltration to ensuring compliance with various regulations, IAM practitioners are key on everything related to the safeguarding of sensitive data. IAM and data security practitioners must find a balance between security and user experience, ensuring seamless and secure access to resources while minimizing disruptions.

Moreover, IAM and data security practitioners contribute significantly to cost reduction. By implementing robust IAM practices, ensuring regulatory compliance, improving operational efficiency, and mitigating the impact of employee turnover, they help organizations avoid the hefty costs associated with data breaches and non-compliance.

In conclusion, the role of IAM practitioners in data security is crucial. As the digital landscape continues to evolve, these roles will become even more critical in safeguarding our digital assets and navigating the complexities of data security.

Author: Marcelo Di Iorio

Marcelo is a seasoned expert with over 20 years of experience in Identity and Access Management (both IAM and CIAM), Identity Governance (IGA), Identity Protection, Privileged Access Management (PAM) and Cloud Infrastructure Entitlement Management (CIEM). He has been working at Microsoft since 2008, first in Argentina and now in Spain, currently as a Global Black Belt (GBB) for Advanced Identity and covering EMEA. Before Microsoft, he worked for some Microsoft and Citrix partners as a consultant.He actively participates in conferences and writes articles where he shares his view on different topics related to identity and security, as well as current and future trends, and he also records a monthly podcast with other colleagues where he talks about Microsoft identity and what’s new in that space.