History of Identity Management

Identity management, otherwise known as identity and access management (IAM) is an identity security framework that works to authenticate and authorize user access to resources such as applications, data, systems, and cloud platforms. It seeks to ensure only the right people are being provisioned to the right tools, and for the right reasons.

As our digital ecosystem continues to advance, so does the world of identity management. But before we look to the present and future, we must understand how we got here, and how the past can help predict future outcomes.

First instances of identity. 

As far as modern civilization dates back, there’s always been a need to safeguard and control access to valuable information. But as society became more advanced, so did the intricacies of identity management, and specific procedures for verification were established.

Passwords.

One ancient method of identity verification that still stands today are passwords. Passwords date back thousands of years—often used as a written or verbal verification method used to authorize and authenticate access to information.

Biometrics.

Another method for authentication that stretched itself to the digital era were biometrics, which are physical characteristics of a person that are used to identify and verify one’s identity. Common identifiers extending hundreds of years were fingerprints.

Cryptography.

Cryptography (writing and solving codes) as a form of access control dates back thousands of years and is still used with modern computer systems today. It’s one of the oldest known forms of access management known to date.

Digital identity and IAM. 

Identity was introduced to the digital world starting in 1960, when Fernando Corbato[1] architected the use of passwords as a way to secure computer files.

But as computing systems and the internet of things (IoT) continued to develop and became essential to businesses processes, the number of applications, systems, and data associated with an enterprise did as well. It was no longer as simple as requiring a username and password to validate one’s identity.

Network perimeters became blurred and organizations needed to adopt security tools for monitoring who gets access to a network and what they can do with that access once inside.

Luckily, Identity and access management tools were developed to secure access and prevent data breach.  

Basic components of IAM include:

• Authentication, which is used to verify one’s identity before accessing resources.
• Authorization, which is the practice of approving whether a digital identity should have access to resources.

Authentication and authorization build the basic framework for IAM. But below the surface, it’s much more complex—with an intricate web of tools and policies helping to keep the identity and access management engine running. Some key components include:

• Access management, which grants digital identities access to tools and resources via methods of identity verification such as sign-on (SSO) and multi-factor authentication (MFA).
• Identity governance and security, which ensures automated workflows and policies are being followed in order to grant user access.
• Privileged Access Management (PAM) manages and monitors access to privileged accounts and applications. It’s rooted in the principle of least privilege (PoLP) which helps secure data by ensuring users are only granted access to tools needed to perform their job function.  
• Provisioning is the process of granting, managing and revoking access to tools, apps, and data throughout the user lifecycle. It’s a core component in the onboarding and offboarding process.
• Zero Trust is the belief that no one should be trusted until their identity has been verified, and once in a network, they’ll continue to be verified until they leave.

IAM manages your applications, unstructured data, and identity access in one consolidated solution. And IAM technology can be offered on-premise, in the cloud, or in a hybrid environment. However, with a growing number of organizations moving their software to the cloud, you’ll want your identity software to be cloud compliant as well.

Introduction to IDaaS.  

Identity as a Service, or IDaaS, is a SaaS based model that allows users to connect to and use identity management services from the cloud. It’s intended as a self-service method for organizations to use IAM to secure their software applications. It seeks to manage and control access across your entire organization.

Components of IDaaS include:

Access management.

Access management grants identities access to your network via methods such as:

• Single Sign-on, which authenticates and logs you into multiple applications while using a single set of credentials.
• Multi-Factor Authentication (MFA), which is an authentication method that requires you to present two or more pieces of evidence (phone number and password) to verify your identity.

Identity management.

Identity management solutions ensure only the right people have access to your organizations data and resources.

Provisioning.

Provisioning, deprovisioning, and lifecycle management are all core to IDaaS. When an employee, contractor, partner, vendor, etc. is assigned a role through an IDaaS system, they’re automatically provisioned access with role-based identity management. And when they leave or change roles, their access is adjusted accordingly.

The future of identity management. 

Identity management has come a long way since its origin story centuries ago. And as our IT environments, workplaces and compliance requirements continue to change, it’s important that identity management continues to advance as well.

Here are some trends shaping the future of identity management and security.

Artificial intelligence.

The shift from on-premise, to hybrid, to multi-cloud environments has created new points of access for cybercriminals—to the point where manual access controls are no longer effective. With artificial intelligence and machine learning (AI & ML), your IAM solution will be able to automatically adapt to the new environment, automating processes and providing visibility that goes beyond the human eye.

Self-sovereign identity.

Self-Sovereign Identity (SSI) is an emerging technology that is based on the concept that only users should own their identity data, rather than a third party. The intent is to make identity management secure and user controlled. However, implementation is still years away.  

Behavioral biometrics.

Biometrics are physical attributes used to authenticate and authorize access to a system. Think fingerprints, facial recognition, voice activation, etc. With behavioral biometrics—biometrics identifiers will be integrated into a continuous authentication model, using dynamic data such as swipe speed, voice inflection, eye movement, etc. to grant access.

To learn more about the future of IAM, check out our article on IAM trends.

Final thoughts. 

Identity and access management has come a long way, and it’s not going anywhere. As your organization goes digital, moves to the cloud and adopts new technologies, it’s important to stay secure and manage users, all while staying compliant.

SailPoint Predictive Identity speeds the process of creating access models and policies and updates them as organizational changes occur. It also provides peer group analysis to quickly identify risky outliers that possess excessive permissions and offers recommendations about whether to grant or revoke access. This ensures everyone and everything has the exact access they need, exactly when they need it, intuitively and automatically.