As the global digital landscape changes at breakneck speed, the sanctity of organizations’ data has never been more at risk. Driven by the persistent advancement of technology and increasingly sophisticated cyber threats, identity access management (IAM) systems are evolving rapidly to keep up.
IAM systems are the first line of defense in securing organizational data against an increasingly sophisticated landscape of cyber threats, including artificial intelligence (AI)-powered attacks. Recent high-profile data breaches at Samsung and Zoom underscore the urgent need for robust IAM systems. The financial repercussions are staggering, with the average cost of data breaches soaring to 4.45 million in 2023. But it’s not just about the money; cyberattacks damage company reputation and customer trust, and interrupt the continuity of services. While implementing an up-to-date security framework that integrates AI and machine learning (ML) into IAM involves an initial investment, it is crucial for enabling regulatory compliance and a safe, streamlined user experience.
Increased IAM security risks and shifts
Multiple factors are driving the changes in the cybersecurity landscape. One is the increasing deployment of AI and ML for cybercrime. A SlashNext report has identified a 1,265 percent increase in phishing emails since the advent of ChatGPT. During the COVID-19 pandemic, many organizations pivoted to majority-remote workforces, resulting in numerous employees logging in from personal devices or outside regular business hours. Without the security protocols that typically operate in an in-person office, employee activity became more vulnerable to cybercrime. In fact, almost half (46 percent) of businesses reported a cybersecurity incident within two months of implementing remote work. As companies expand their reach globally, their employees are often spread worldwide, further increasing the potential attack surface. Furthermore, the Internet of Things (IoT), in which various industrial or consumer electronics are connected to the web, comes with new security liabilities. For instance, Verkada, a cloud-based security camera company, suffered a hack in 2021 that compromised over 150,000 security cameras, revealing how the IoT can become a trojan horse if not adequately shielded. These factors add to an unprecedented need for organizations to prioritize security in their operations.
The key pillars of successful IAM systems
In the IAM domain, these four “As” are the bedrock of security. From biometrics to zero-trust models and the meticulous management of user privileges, each component is a cog in a well-oiled machine designed to safeguard a company’s most precious asset—data.
- Authentication. Verifying a user’s identity using passwords, biometric logins, or other methods is conducted via authentication. Multi-factor authentication, in which more than one form of identity verification is required for users to access their accounts, can enhance the security of authentication, as can adopting advanced verification methods like biometrics.
- Authorization. This is a user’s ability to access resources and perform actions. A zero-trust authorization model denies users, even those within the company, access to resources by default. Within a zero-trust framework, there are two main ways to manage access control. In role-based access control (RBAC) systems, authorization is based solely on a user’s role in the organization. In attribute-based access control (ABAC) systems, factors such as the user’s role, the resource’s importance or level of sensitivity, and the date, time, or location all contribute to determining access permissions. The most secure and appropriate choice depends on the size and structure of the organization.
- Administration. This refers to the managing of user accounts and permissions. Strong administration grants only the permissions necessary for users to carry out their job responsibilities, a concept known as the principle of least privilege.
- Auditing and reporting. These involve logging and monitoring user behavior to identify suspicious activities, creating detailed reports regarding identity and access permissions, and distributing them to stakeholders.
A robust IAM system can detect and tackle data breaches before they occur. Consider a scenario where an employee’s credentials are compromised. An IAM system with dynamic authorization could limit access based on anomalous login patterns, effectively neutralizing the potential breach.
How continuous user behavior analytics fits into an IAM framework
Continuous user behavior analytics (CUBA) is an advanced approach that integrates seamlessly into an IAM framework, significantly enhancing its security and efficiency. It can be compared to a neighborhood watch that pays attention to everyone’s habits. If someone starts doing something odd, like peeking into windows, the neighborhood watch will notice and investigate. CUBA utilizes advanced ML algorithms that can be integrated into IAM frameworks. By alerting security teams when unusual behavior is detected, CUBA can anticipate and prevent potential security incidents. Financial software company Intuit, for example, has found success by implementing a continuous behavior analytics system. Not only has it successfully prevented many instances of fraud, but it also has a dramatically lower false positive rate than the company’s previous, less sophisticated fraud detection system.
Challenges with integrating ML and IAM
While integrating identity and access management has numerous benefits for organizations, some challenges remain with the initial deployment. There is a significant upfront expense associated with implementing IAM, and it can be challenging to integrate IAM with legacy systems. The ML models that power the behavior analytics approach require large amounts of high-quality data to learn from. This can be difficult to obtain, especially in the early stages of implementation. IAM systems occasionally report false positives and flag suspicious activity when there is none, resulting in increased employee tedium.
Tackling these challenges begins with a sound implementation strategy. Developing a comprehensive data collection, cleaning, and pre-processing strategy can help enterprises ensure they have access to enough quality data to train their models. The difficulties of integrating IAM systems with legacy ones can be eased with the strategic use of application programming interfaces (APIs). End-to-end testing in lower environments before deployment can minimize operational disruption. When false positive flags occur, they can be integrated into future training, resulting in self-improving models that learn from their mistakes. Despite the upfront investment, IAM systems can be tremendously financially beneficial for organizations due to the high cost of cybersecurity breaches. For instance, a Forrester report found that one such system boasted a return on investment (ROI) of 240 percent.
Enterprises can proactively detect and stop potential threats by incorporating ML into IAM. To prepare for a future involving new cybersecurity threats, it is critical for businesses to invest in behavioral analytics technologies. Equally vital is the careful training of analytics models, including designing and implementing data collection, cleaning, and management strategies. The future of IAM lies in self-healing systems capable of predicting and adapting to new threats in real-time, significantly minimizing human error and enhancing overall security posture. With proper implementation, integrating AI and ML can provide strong guardrails against threats in a rapidly changing cybersecurity landscape.
About the Author
Gaurav Rathi is a visionary IT product strategist, with over 17 years of excellence in crafting top-tier digital products within B2B SaaS/DaaS models for influential Fortune 100 firms. Dedicated to driving innovative global IT product strategies, he is highly regarded for his adeptness in synergizing with UX and engineering teams and excels in steering digital transformation and elevating digital products across diverse sectors. Gaurav is an alumnus of Uttar Pradesh Technical University, India, where he earned his Bachelor of Technology degree in Computer Science. For more information, contact gaurav.rathi@outlook.com.
Disclaimer: The author is completely responsible for the content of this article. The opinions expressed are their own and do not represent IEEE’s position nor that of the Computer Society nor its Leadership.
