External Identity Managment

This week, I had an interesting discussion with a local healthcare provider regarding the best way to secure third-party access to systems.

Essentially, it’s well known that IT risk management increases exponentially when managing external identities and more so if hosted on-premise. The goal of an Identity Service is to ensure users are who they claim to be and to give them appropriate access to applications, files and other resources at the right times.

If the infrastructure to make this happen is built on site, then the company has to figure out what to do every time a problem comes up. This is especially true when a user has multiple identities with different rights.

It’s much simpler to implement a centralised cloud-based system created by identity experts who have already solved such problems for hundreds of organisations. Identity and access management-as-a-service (IDaaS) offers:

* Third party single sign-on (SSO) via portals, functionally identical to internal counterparts

* Identity, governance and administration (IGA) including provisioning of users to cloud applications and password reset functionality

* Authentication via commonly used apps such as Facebook and Google

* Support for federation standards such as SAML and OAuth

* Self-service capabilities

* Delegation

* Approval workflows

* Automation

* Identity access log monitoring and reporting

* Synchronisation/translation capabilities, automated to apply changes to other systems where appropriate.

An important advantage of IDaaS is savings since provisioning identity on site, with software such as Active Directory Domain Services, can be full of costs. Also, there is a reduction in complexity that the existence of a single identity repository gives the organisation. IDaaS costs are limited to the subscription fee and the administration work. Like network security monitoring or email search, identity can be moved to the cloud.