Identity and Access Management Conferences

Although IAM teams have been dealing with a continued move to cloud, an increase in devices, shifts in IT management and other changes, a massive shift to remote work accelerated these emerging concepts. The traditional enterprise perimeter has all but disappeared, and while secure remote access to on-site and cloud applications exists, many organizations lack all the necessary IAM controls. Remote access increases the attack surface, requiring additional access control management. When a rapid, global shift in the approach to work drove sudden changes to IAM implementations, it revealed that many IAM processes were too rigid and not agile enough to respond quickly to the new environment.

The need to digitalize experiences and interactions has increased, which means IAM teams need to focus more on external users like customers, citizens, patients, residents, students and vendors. How organizations — and therefore IAM teams — must support customers has shifted rapidly. Digital customer interactions not only must be secure and easy to use, they also must enable a broader range of contactless experiences and integrate with more “back office" IAM systems. An example might be enabling travelers to arrive at a hotel, perform digital identity validation, register and gain entrance to their room without interacting with another person. With the increase in remote work, more organizations also need to provide remote employees, gig workers and contractors — some of whom will never come into any office — a way to perform the required level of customer identity proofing.

The number of machines, whether applications, services, agents or devices interacting with organizations is increasing. Each of these interactions, regardless of their nonhuman status, must be secured and credentials must be managed and maintained. Although organizations require an enterprisewide IAM strategy for handling this challenge, existing organizational barriers and lack of the necessary skills and tools makes this virtually impossible. Development, DevOps, security, IAM and I&O teams have different needs and preferences for tools and processes. Often, IAM teams no longer make identity decisions. Instead, the decisions are increasingly made by other teams.