97 Things Every Information Security Professional Should Know

Chapter 20. Identity and Access Management: The Value of User Experience

Dane Bamburry

When information security or cybersecurity comes up for discussion, most conversations begin with traditional concepts such as firewalls and intrusion protection, which are usually geared towards a defensive mindset. Identity and access management (IAM) is the cybersecurity domain that forces us to incorporate enablement and user experience into the thought process more so than in other domains. Although IAM has been around for a long time, it has become a more mainstream security topic of discussion in the past 10 years. With the addition of smartphones, connected devices, and an infinite amount of usernames and passwords to keep track of, it is extremely important to understand how to develop an effective strategy as secure access to consumer- and business-centric data has become the cornerstone of information technology.

Some may argue that identity and access management goes back to the introduction to usernames and passwords, but to truly understand this vital component of the cybersecurity landscape, we need to go back and understand what is defined as an identity. A general dictionary description of identity is the proven fact of being who or what a person is. So what makes a person’s identity a fact? A birth certificate, driver’s license, and passport are a few examples of what helps ...