IAM

Identity management. GIA. IAM. IDM. A little festival of acronyms for the thorny business of identity management. Identity is one of the key pillars of security, since every decision made by systems depends on the identity being presented. Despite its importance, it is the least loved of the security domains, maybe because it doesn’t seem as sexy as intrusions.

And yet, the question raised by identity management (who we are) is fundamental to most of the systems we use. We need to identify ourselves to our financial institution before accessing the contents of our account. This identification is done through an authentication process (a password, for example), which serves to determine that the person really is who they claim to be. In the classic password case, it is a secret shared between the user and the system. This secret is the basis for verifying identity, i.e. authentication (there are three factors: something you know, something you have, something you are).

I have already started tackling the subject from the password angle. That is, by the way, the most visible part of identity management that users face and the one they hate the most. It is often where organizations stop their identity and access management efforts.

I’m going to continue my series on passwords (Fraud, damn fraud! brought the subject back to the forefront), this time taking a broader view than just passwords. Passwords are part of a larger identity and access management approach.

IAM is crucial for organizations, because how can you claim to control your systems when you have no control over the people and systems that use them?