Starting off the 11th Gartner IAM conference in London, Gartner VP Gregg Kreizman highlighted the need for change, and to do a better job of building adaptively.
He said: “The key is to take possible change into account when building solutions. Bad guys find a way in, and sometimes you don’t know that until someone tells you from outside, or your credit card data on the dark net.
“Threat protection brings its own set of processes, controls and efficiency, but IAM security is a set of functions, think privileged access and lateral movement through the organization and think of the role analytics plays in IAM.”
He concluded his part of the opening keynote by saying that if you are going to do IAM, you need to be resourced better, and IAM cannot do the job on its own without sound decisions.
Putting the spotlight on Identity Governance and Administration (IGA), Gartner research VP Lori Robinson said that there are use cases on simple and employee access on point solutions and when they left, access to Active Directory was cut off. However, mobility, apps, cloud and partners have changed that, and Robinson argued that there is innovation in the IGA space to meet that.
Looking at analytics, Robinson suggested a model of peer groups and creating a model based on other users, and using that to determine entitlements and what is necessary for the job. “Analytics has moved to a model that is based on activity and what's happening in the environment,” she said. “Form peer groups on how they are behaving and with peer groups, define policy around that.”
Robinson said that analytics is not just restricted to machine learning, but there is a lot of potential and use cases available.
Rounding off the opening keynote session was research director Jonathan Care, who highlighted the challenge with passwords and that 75% of budget goes on protection and anti-malware. “We are not only doing what we do with analytics to protect, but also predict when an attack has happened,” he said. “The point being, the way we are securing data is not working.”
He called for seamless authentication for business and consumers, and also to look at each transaction to bring it within organizations. “It would be nice if we could provide something which had a low value transaction overhead,” he added. “The interactions need to be slick and seamless and reliable.”
He went on to talk about identity proofing, and proving who a person is with a continuous process, and said that there is too much reliance on static data and with 1.7 billion identities on the dark web, secret information is too easily found.
“It is not just username, passwords, dating history - although that is bad enough - start thinking about healthcare. So I see it moving from an idea about proof to validation because there is no proof, we are saying that for our risk appetite and tolerance, it is likely that Jonathan Care is the one sitting in front of the keyboard, but the question is how do we apply that to the IoT?”
Kreizman concluded by saying that we need good IAM program management that can help ensure “continuous assurance of maturity” and link that to your business outcomes. “Build flexibly and adaptively for the next change,” he said. “Big Data and analytics need to be more than cool.”
