Five Identity and Access Management Predictions for 2020 and Beyond
By Paul Butler on December 11, 2019
As we reach the final few weeks of 2019, many of you will be thinking of the projects which you will be planning or embarking on in 2020. Maybe you will be looking to the cloud for greater scalability; it might be that you plan to replace ageing systems or hardware with something more modern. In either case – and those outside of my two examples – the challenge is to keep up with the fast-pace of change and implement solutions and controls which are in keeping with the wider trends.
I myself have been thinking about how this relates to the industry I work in – identity and access management.
I have spent much of my time, over the past twelve-months, speaking with our customers, business partners and our own experts behind the scenes; learning from their challenges, experiences. Crucially, I get an insight into not just what is up-and-coming, but what will actually take-off.
And so, for 2020, here are my predictions for the identity and access management market.
#1 – Convergence of Security and Networking Teams
Even today in 2019, the line between the SOC (Security Operations Centre) and the NOCs (Network Operation Centre) is already becoming blurry.
For the large part, the role of the two are intertwined and will continue on this path throughout 2020. Very few network roles and jobs are absent of consideration for security, particularly when it comes to communication between the outside world and the internal network.
Similarly, security is no longer the “post-review” department, used to seek sign-off, which it once was. Modern development methodologies and even regulations such as the GDPR require security input at the design stage – meaning security teams are having to become more technology aware.
As an IT security vendor, this means that we must continue to cater to the high expectations of both or a converged version of those two teams.
#2 – Automated Provisioning from a Single Source of Truth
Admittedly, this is not a new concept. For as long as computer domains have existed, IT administrators have used solutions such as Microsoft Active Directory as a single source of truth for much of the services they provide in their networks.
However, the cloud and services which are hosted online have challenged Active Directories flexibility in the modern age, which has led to a fracturing of authentication sources dependent on where the authenticating service is, its capabilities and security.
Federated identity solutions have attempted to tie this all back together, but their complexity meant that the up-take is reserved to the largest of organisations with the most skilled teams.
In 2020, this desire to want to return back to a single source of truth will gain momentum as smaller organisations will want to streamline the way their users work, and want to avoid the security pitfalls of fragmented user repositories.
A great example of how this works in practice comes from our very own Idaptive solution. Our solution can utilise Active Directory, federated identity systems, alternative sources of identity such as a HR system, plus automatically provision and license users in well-known solutions such as Office 365.
#3 – The Death of Hardware 2FA Tokens
We have been building up to this moment for some time. But I do believe 2020 will be the harbinger of the decline for hardware 2FA tokens.
Today, you would be hard-pressed to find anyone other than a commercial bank using these small plastic devices used to generate a 2FA passcode for authentication.
They are costly, require additional management and users tend to treat them with little ownership. Meaning that they are lost or damaged at the cost of the service provider.
Software-based tokens have existed for some time. Starting with the 2FA passcode delivered by SMS and now commonly using a smartphone app. But things have continued to move on since then.
Today, the emergence of push-notifications mean that users no longer have to copy a code from one screen to another. Instead they are presented with a yes or no prompt on their smartphones, to prove it is they who is attempting to authenticate somewhere. The security of passing a passcode is handled in the background and can be called on in very specific circumstances. Such anomalous behaviour or an unusual source location.
When you consider how far software tokens have come and how sophisticated the security is becoming – hardware tokens seem as old as the dinosaurs.
#4 – A stronger Focus on Single Sign-On Technologies
From a user perspective, predictions two and three signal a greater focus on user experience and the simplification of authentication. My fourth prediction continues this theme with my belief that single sign-on will gain more prominence in 2020.
While a single source of truth will dominate the provisioning and de-provisioning of accounts, single sign-on services will become the dominate form of authenticating those accounts, whether that be in be many services authenticating against a single sign-on source or a single pane of glass for authentication.
The reason for this can be attributed to a few reasons:
- More control over the user account in question.
- Weak passwords less likely to be used.
- Less support calls due to forgotten passwords.
- A common branding and authentication experience.
# 5 – Real-Time Anomaly Alerting and Response
Discussions about AI (Artificial Intelligence) and ML (Machine Learning) and their useful application have been going on for some years. Where I think there is great scope is in the use of automated anomaly detection, something which the network vendors of this world have been working with towards with much success.
With regard to identity and access management, we as an industry typically build a wall or a set of policies and only react to unauthorised access post-event.
There is, however, growing interest in the area of being able to detect anomalies such as unusual keystrokes, new source locations, and even the date or time, and then reacting by either alerting, blocking the attempt, or dropping additional controls or authentication stages in place.
Some of these actions could seem counteractive to the aim of making the authentication process simpler and smoother for users. However, such actions would be tuned to take place only in extreme circumstances.
Where actions are not taken directly, SOCs and even converged SOC/NOC teams could be alerted in real-time that anomalous behaviour is being detected, through traditional alerts such as email; or by interacting with SOAR (System Orchestration, Automation and Response). Which could, in turn, trigger a chain of pre-defined steps for response.
Ultimately, what customers are looking for today is better integration between solutions to reduce their response times. What do you think 2020 holds for identity and access management?
- DevSecOpp- Security design / review consultant. SC Clearance. London
CH7838 London £70,000 DevSecOpp- Security design / review consultant. DevSecOpp- Security design / review consultant will ensure that newly created, public facing apps are secure by design and by default by aligning them to current / best practice security policies and standards into the design phases. The individual must have a technical software / application development background with specalist experinece in secure architecture design. (Frameworks, processes, best practice etc) Practical experience translating and ensuring that the OWASP top 10, ISO27001, HMG frameworks requirements are reviewed and embedded into project designs which are implemented is essential. Experience working projects through a full development lifecycle is key. You will work along side the design and project teams to idenitfy and mitigate risks throughout the design phases. This is a permanent role. SC clearance is essential as is the ability to get to the London office. (When appropiate #covid) Security DevSecOps consultant. To arrange a discreet call book via https://calendly.com/chris-holt/devsecopp--security-design-review-consultant
- SPLUNK SOC Analyst level 3, London.
SPLUNK SOC Analyst level 3, Must be able to commute to the City of London. Onsite role. Security clearance needed. The SPLUNK SOC Analyst level 3 must have current experience working within a SOC environment with specific experience using a range of tools and techniques to investigate security incidents. Current experience with Splunk is essential. any additional experience Individuals with Elastic Security SIEM are highly desirable. Any of the following certifications are desirable Splunk Phantom certified admin, Splunk Core Certified Power User / Advanced, Splunk Certified Enterprise Security Admin, etc The role will include, but not be limited to working with sophisticated information security tools, investigating security incidents, incident management, technical escalation, process improvement, research into the latest threats, reporting etc The individual MUST currently be living in the UK and be able to achieve UK security clearance. (SC) This is a permanent role To arrange a call with Chris Holt https://calendly.com/chris-holt/arranged-call-with-chris-holt-elastic-siem-engineer-soc Chris.Holt@dclsearch.com
- ISO 27001 & Business Continuity Security Specialist, End User
- United Kingdom
CH7828 ISO 27001 & Business Continuity Security Specialist, End User, £70,000 United Kingdom ISO 27001 & Business Continuity Security Specialist needed to join a Cyber team within an end user. The ISO 27001 & Business Continuity Security Specialist will have end to end responsibility for the information security and Business Continuity management system. ISMS/BCMS. Both from an information security and technical security perspective working alongside the CISO. Experience must include, but not be limited to; a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling to achieve compliance. ISO 22301, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. Experience taking a company through accreditation is highly desirable Experience managing internal stakeholders, technical teams and external third parties essential Flexible working, very occasional travel to London office This is an exclusive role to DCL Search & Selection. Looking to interview immediately. https://calendly.com/chris-holt/iso-27001-business-continuity-security-specialis
- PCI- DSS Security Consultant, End User
PCI- DSS Security Consultant needed to join a Cyber team within an end user. The PCI- DSS Security Consultant will have end to end responsibility for PCI - DSS and its continuing certification. Both from an information security and technical security perspective working alongside the CISO. Experience must include, but not be limited to; a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling to achieve compliance. PCI objectives / 12 key requirements, OWASP top 10, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. PCI Cloud compliance, specifically someone with experience taking PCI-DSS from on premise into the cloud is HIGHLY desired. However, someone with Solid PCI experience with a strong technical background which include Cyber / Secure by design etc would be considered. Experience managing internal stakeholders and external third parties essential. Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection. 1st stage interviews to happen the week of the 14th September Arrange a call with Chris on https://calendly.com/chris-holt/arrange-a-call-chris-dcl-pci-compliance