Identity Access Management (IAM) is a critical framework for securing digital resources by defining and managing user identities and access rights.
It includes the creation, authentication, authorisation, and auditing of user identities, ensuring that only authorised individuals have access to necessary resources while keeping unauthorised users out.
By balancing security and accessibility, IAM helps organisations protect sensitive information, comply with regulations, and streamline access management.
The technical foundations, achieving security and efficiency
Shane Devenney is a software engineer at Spanish Point working across cloud infrastructure and security solutions. With specialist expertise in identity and access management, he builds external identity platforms and provides authentication and governance solutions, as well as security-first development approaches for enterprise cloud environments. He said, "Identity Access Management is the process of defining and managing the identities and access rights of users and entities in an organisation."
“IAM involves creating, verifying, authenticating, authorising, and auditing the identities and permissions of users and entities across various systems and resources.”
Shane Devenney
Custom Application Development Lead at Spanish Point
IAM is essential for maintaining a secure and efficient cloud environment, protecting sensitive information, and ensuring that only authorised individuals have the necessary access to perform their roles1. The core principles of IAM include three main focus areas:
- Identity: the unique representation of a user or entity in an organisation. An identity can be associated with attributes such as name, email, role, or department. An identity can also be linked to credentials such as passwords, tokens, certificates, or biometrics, that are used to authenticate the identity.
- Access: the ability or permission to perform certain actions or access certain resources in an organisation. Access can be granted or denied based on policies and rules that define who, what, when, where, and how access is allowed or denied. Access can also be dynamic and context-dependent, meaning that it can change based on factors such as location, time, device, or risk level.
- Management: the process of creating, updating, deleting, and monitoring the identities and access rights of users and entities in an organisation. Management involves setting and enforcing policies and rules that govern the identity lifecycle and access control. Management also involves auditing and reporting the activities and events related to identities and access for compliance and security purposes.
"One reason IAM is a crucial component of cybersecurity is that it enables an organisation’s IT department to strike the right balance between keeping important data and resources secure while ensuring they remain accessible to authorised personnel," Shane explained, "IAM facilitates the implementation of controls that grant secure access to employees and devices, while making it challenging or impossible for outsiders to breach. As such, IAM solutions are highly effective in preventing attacks and mitigating their impact."
30 billion+ attempted password attacks per month worldwide
In the most recent edition of Microsoft's Digital Defense Report, the Microsoft Security Response Center and Security Operations Center teams reported a 23% annual increase in cases processed, with more than 30 billion attempted password attacks per month worldwide. Overall, Microsoft has seen a 35% increase in demand for cybersecurity experts.2
There are a wide variety of IAM tools on the market, which are specifically designed to protect organisations against increasingly common security threats. Azure AD B2C, provided by Microsoft alongside Entra ID, is a tool that enables users to register for access and store their information securely. This platform facilitates the management of users’ multifactor authentication (MFA) and password options, while also offering a self-service password reset feature. Users can be limited in their access within the organisation based on the access token provided to them.
“Multifactor authentication is an essential component of any organisations' IAM framework, and an integral feature of Azure AD B2C. It ensures improved security for user accounts.”
Shane Devenney
Custom Application Development Lead at Spanish Point
Within the Azure AD B2C platform, users are provided with the flexibility to choose their preferred method of authentication. These options include voice, call, and authenticator functionalities, and they can be adapted to diverse user preferences and needs. This multi-layered approach to authentication adds an extra layer of protection, mitigating the risk of unauthorised access and bolstering overall security measures within the organisation.
"User management is conducted through B2C," Shane advised, "Access privileges for users can be revoked to prevent them from signing in. This action is achieved through conditional access rules, allowing specific users or those meeting certain criteria to be blocked from accessing the system. Additionally, users can be deleted from the system as needed."
Data security considerations within IAM systems
User data is securely stored within Azure, ensuring confidentiality and integrity. Passwords of users are inaccessible to anyone within the B2C tenant, enhancing privacy and security measures. Administrators have the capability to reset passwords as needed, providing an additional layer of control and oversight.
Additionally, users can opt for self-service password reset, empowering them to manage their own account security efficiently.
"This approach not only safeguards sensitive information but also promotes user autonomy and convenience within the system," Shane said.
The integration challenge, supporting authentication and single sign-on (SSO) standards
When using or setting up an IAM solution, one common problem is the different types of applications and vendors that organisations use, which have different security protocols like OpenID Connect (OIDC) and Security Assertion Markup Language (SAML). This makes integration challenging. Azure AD B2C solves this problem by offering adaptable integration with different protocols and applications.
“Azure AD B2C lets you customise how authentication works for different vendors. This adaptability makes integration smooth and improves the IAM solution’s ability to handle a diverse range of applications and vendors.”
Shane Devenney
Custom Application Development Lead at Spanish Point
