IDM Engineer at a tech services company with 51-200 employees
Real User
Top 5
2022-02-23T09:32:11Z
Feb 23, 2022
Identity and access management in the cloud - there are more interpretations of this question - like where are the identities stored (on-premise/in cloud/ both with sync between them already)?
where is the service with managed access located? what is the access based on?
what kind of SSO service API is supported by the user store/ application if any?
what authentication methods are supported by applications/services?
what technology is preferred by customers consuming/planed to consume those services?
What authorizations are possible/requested and based on what?
Too many possibilities, too many options to answer it in short.
To be honest, universal best practices in this area, as I am aware of, don't exist yet.
Case by case, the best practices will be different based on answers to the questions above.
Search for a product comparison in Identity Management (IM)
Cloud IAM is a different beast from traditional on-premises IAM.
There are very many web pages and posts on Q&A sites that deal with common best practices for cloud-based IAM. Many of the points suggested in these web pages and posts are very general in nature and could apply to on-premises IAM installations too.
So, I am going to offer up some unique advice. Here are some best practices for IAM in the cloud:
Look for a vendor who offers a large range of app integrations. Even more preferable is a vendor who integrates apps on request from customers. This is because there are so many apps out there today, and no vendor offers ready integration with ALL possible apps. Even one app left out of your IAM environment is a significant security threat. So, you want easy integration for every possible cloud-based app.
Look for a vendor who offers thick-client Single Sign-On. Let’s face it, not all your apps are cloud-based. While cloud-based apps are now the norm, the IT world hasn’t completed the shift completely. And for security reasons, some critical apps and resources like banking data, are better off stored on-premises. So, you are setting yourself up for a security breach if your thick-client and homebrewed apps are not contained within your organization’s IAM environment.
Choose per-user subscriptions over perpetual licenses and pay-per-use models over per-user subscriptions. Per-user subscriptions offer lower total costs and put the onus for maintenance, upgrades, and repairs on the vendor. But they also have drawbacks. Your organization must buy extra licenses to future-proof itself. And there is a large gap in utilization between departments. Engineering departments use about 90%+ of IAM features on a regular basis. But sales departments only use about 20%. Why pay the same for occasional and regular users? Pay-per-use also allows your organization to debit IAM expenses to different departments which frees up budget from IT departments.
Choose a Converged IAM software. Gartner says that over 70% of new IAM implementations will be Converged IAM by 2025. This is because integration between IAM modules like Access Management and Access Governance offers superior features to standalone products with limited modules. The MSSP model is also going to be the preferred choice of customers, and MSSPs will choose Converged IAM products for high ROI and integration between modules.
It is worth noting that Compact Identity from IlantusProducts is the only true Converged IAM product on the market, and is offered as pay-per-use as well.
Search Engine Optimization Specialist at LoginRadius
Vendor
Top 10
2022-05-19T04:38:12Z
May 19, 2022
Understanding who may access your sensitive data and under what circumstances they can access it is necessary for enforcing identity and access management best practices.
You'll also need a full picture of your company's IT architecture to keep an eye on all of your components for future and existing dangers. Staying current with industry developments will help you better your existing IAM situation.
Keep these identity management best practices in mind as you develop your Identity and Access Management (IAM) strategy:
Case by case, that will be the very first thing I am going to tell.
In general, you will definitely need a team to start, IT professionals, application owners, and a trustworthy partner who has the skills.
IAM product-wise, the top-ranking list on the market is always the resort, so go and find someone （architecturally, not sales) from e.g., One Identity, AAD, and have them carve your way out.
- at a tech services company with 51-200 employees
User
2022-03-09T08:15:15Z
Mar 9, 2022
Among many relevant responses from other peerposters, I can provide you with the following recommendation: "Always stay in control of your identity data".
That means:
- know where your data are (in the normal situation and after a breach).
- be prepared to restore a degraded service on another provider (or on prems) backing up user data, application config, business rules and compliance reports.
It is usually simple and cheap to achieve this with some Curl commands to get JSON from your IAM cloud provider instance. It is more complex and expensive to have a B plan ready for deployment and to transform those JSON extracts into CSV ready to upload in the new alternative
Hi infosec professionals,
Based on this article, a few days ago "Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials".
What could be done better to prevent this from happening in the future? Which tools, techniques and solutions could help to a...
IDM Engineer at a tech services company with 51-200 employees
Aug 10, 2022
In case of sophisticated social engineering attack designed to steal employee credentials there is a need to pay attention regarding education of employee first and if not already in place apply Zero Trust approach by implementing OTP and using it as mandatory for all employees. Any technical solution is not good enough to avoid willing leak of employee credentials by themself.
Hi security professionals,
Can you please clarify the definition of the Zero Trust vs Least Privileged model? How are they different?
In which cases you'd use each of them? Please share an example.
Thanks for sharing your knowledge!
Consultant at a tech services company with 1,001-5,000 employees
Jul 12, 2022
Least Privilege is about giving the least privilege (role and privilege) as required by the user, while Zero Trust completely eliminates trust at a whole level, whether internal or external.
Zero Trust sample is MFA, where you would need to validate your access credentials (e.g., through biometrics).
Least privilege access is used to provide access needed to perform a role or action, which is good, while Zero trust completely assumes every attempt as a possible compromise and treats it as such.
If something with the least privilege access tries to access any resource in an environment where Zero Trust is implemented, Zero trust will still take precedence.
Does access control terminology puzzle you? Many people often mistake PIM, PAM, and IAM – privileged identity management, privileged access management, and identity and access management. Oftentimes, they also believe that privileged access management (PAM) and privileged account management (also PAM) are interchangeable terms – which is not entirely true. To shed some light on this topic, in...
What is Privileged Account Management (PAM)?
Privileged account management can be defined as managing and auditing account and data access by privileged users.
A privileged user is someone who has administrative access to critical systems. For instance, anyone who can set up and delete user accounts and roles on your Oracle database is a privileged user.
Lik...
Zero Trust is a set of techniques to secure end-to-end IT network infrastructure. Given the complexity of today’s networks, Zero Trust security principles continue to evolve and adapt to current demands.
As indicated by the history of Zero Trust, an evolving IT security landscape was what had eventually led to this concept. And right from the start, the end goal was to ensure a strong and resi...
Network Security Services at ACE Managed Securty Services
Mar 13, 2023
Zero Trust Security is all the rage these days and for good reason. It’s a powerful security framework that organizations can use to protect themselves against cyber threats. While it sounds complicated, at its core there are five simple principles that makeup Zero Trust Security:
1. Never trust, always verify: With managed email security services, organizations can employ various layers of authentication and authorization to verify user identities before allowing access.
2. Least privilege: Organizations should only grant users the minimal amount of access necessary for their role in order to reduce the risk of a data breach or other malicious activity.
3. Zero trust boundaries: By using managed email security services, organizations can ensure that data and systems are segmented into secure boundaries to prevent the lateral movement of malicious actors.
4. Continuous monitoring: Organizations should employ managed email security services to continuously monitor and log user activity, allowing administrators to spot suspicious behavior quickly and take appropriate action.
5. Comprehensive security solutions: By employing managed email security services, organizations can ensure comprehensive protection from cyber threats.
These five principles are the foundation of Zero Trust Security and managed email security services are necessary for implementing them in a secure and effective way. Take advantage of managed email security services today to ensure that your organization is protected against all types of cyber threats.
Identity and access management in the cloud - there are more interpretations of this question - like where are the identities stored (on-premise/in cloud/ both with sync between them already)?
where is the service with managed access located? what is the access based on?
what kind of SSO service API is supported by the user store/ application if any?
what authentication methods are supported by applications/services?
what technology is preferred by customers consuming/planed to consume those services?
What authorizations are possible/requested and based on what?
Too many possibilities, too many options to answer it in short.
To be honest, universal best practices in this area, as I am aware of, don't exist yet.
Case by case, the best practices will be different based on answers to the questions above.
Cloud IAM is a different beast from traditional on-premises IAM.
There are very many web pages and posts on Q&A sites that deal with common best practices for cloud-based IAM. Many of the points suggested in these web pages and posts are very general in nature and could apply to on-premises IAM installations too.
So, I am going to offer up some unique advice. Here are some best practices for IAM in the cloud:
It is worth noting that Compact Identity from IlantusProducts is the only true Converged IAM product on the market, and is offered as pay-per-use as well.
Understanding who may access your sensitive data and under what circumstances they can access it is necessary for enforcing identity and access management best practices.
You'll also need a full picture of your company's IT architecture to keep an eye on all of your components for future and existing dangers. Staying current with industry developments will help you better your existing IAM situation.
Keep these identity management best practices in mind as you develop your Identity and Access Management (IAM) strategy:
- Implement zero-trust security
- Use multi-factor authentication
- Avoid privileged accounts
- Enforce a strong password policy
- Adhere to regulatory compliances
- Automate Onboarding and Offboarding
- Go passwordless
- Conduct routine audits
Below are some of the best Practices for Identity Access Management
Case by case, that will be the very first thing I am going to tell.
In general, you will definitely need a team to start, IT professionals, application owners, and a trustworthy partner who has the skills.
IAM product-wise, the top-ranking list on the market is always the resort, so go and find someone （architecturally, not sales) from e.g., One Identity, AAD, and have them carve your way out.
Among many relevant responses from other peerposters, I can provide you with the following recommendation: "Always stay in control of your identity data".
That means:
- know where your data are (in the normal situation and after a breach).
- be prepared to restore a degraded service on another provider (or on prems) backing up user data, application config, business rules and compliance reports.
It is usually simple and cheap to achieve this with some Curl commands to get JSON from your IAM cloud provider instance. It is more complex and expensive to have a B plan ready for deployment and to transform those JSON extracts into CSV ready to upload in the new alternative