Digital transformation: What does it mean for you and your business? The old way of engaging with clients, business partners and even employees is rapidly changing. The new engagement model is focused on collaboration and is increasingly delivered via a mobile channel. Clients demand a first-class user experience; when those expectations cannot be met, low switching costs often result in direct impacts to business results. Even for internal users, the consumerization of IT is driving the same high level of expectations at work.

Digital Evolution Leads to Security Concerns

As organizations adopt technologies like cloud, APIs and the Internet of Things (IoT) to assist them in this digital transformation, security remains a top concern for CISOs and IT professionals. However, one message has come across loud and clear: Business progress will not be derailed by the concerns of security and IT organizations. These groups need to get on board and enable this progress or they risk being left behind or, even worse, completely run over.

Identity and access management (IAM) — that oft-neglected part of your IT environment — holds the key to not only delivering an optimal end user experience in support of your digital transformation, but also to its becoming your first security control. In the digital world, the traditional network perimeter we formerly relied on is no longer sufficient.

Individuals, applications and “things” alike are accessing critical data and resources. Each of these has an identity. It is necessary to have a clear understanding of those identities, what they should have access to, whether their actions are consistent with normal behaviors and what risks they represent to your organization.

Protecting Against Insider Threats

Solutions such as identity governance, analytics and privileged user management are critical components in this digital world for protecting against the myriad of insider threats. First, there is a need to rapidly detect malicious insider activity. This usually requires some form of baselining normal user behavior and then applying intelligence to determine and alert on anomalous behavior.

Identity context is critical to effective insider threat detection. What resources does an identity have access to? Is this normal or expected based on the individual’s role? What is the level of risk associated with a given identity?

The second aspect of an insider threat is being able to actively mitigate the risk associated with insider activity. This may involve implementing tools and processes to control access to shared or privileged credentials in order to protect your crown jewels.

In the world of mobile, that same need to protect critical business assets exists. However, in this world, organizations typically exert less control over the devices individuals use to access those resources. Even where the use of an enterprise mobility management solution might provide greater device-level control, there are still many more variables and risk factors associated with the mobile channel.

Therefore, it becomes necessary for organizations to implement a more dynamic and risk-driven approach to user security. Contextually aware access policies make it possible to deliver increased security without negatively impacting the end user experience.

Read the IBM research report: Battling Security Threats From Within Your Organization

Adding Context to Identity Management

So what do we mean by context in security? This includes information about the device, the user, the environment, the resource being accessed and past behavior.

With a rich set of context, you can implement policies that provide the right level of identity assurance you require to mitigate the risk associated with certain activities. Does it seem odd that one of your employees is suddenly attempting to access an application from a device they have never used before? Perhaps it would be prudent to invoke a stronger form of authentication?

Digital businesses must rapidly adapt to changing market conditions. For all the benefits that IAM can provide in support of these goals, legacy environments that have not been upgraded to provide the latest technological capabilities can become a blocker rather than a business enabler.

To this end, many organizations are turning to cloud-delivered IAM solutions to provide faster time to value, scalability and reduced operational costs. Cloud IAM capabilities may come in multiple forms, from a set of APIs that allow for tightly bound application integration to self-service multitenant software-as-a-service (SaaS) solutions and finally to fully managed, cloud-hosted IAM environments.