Did you know that $445 million was lost to cybercriminals in 2018 alone?
According to the 2019 Verizon Data Breach Investigations Report, 80% of hacking-style attacks involved compromised or weak credentials. Overall, 29% of all breaches were due to stolen credentials.
Identity and access management solutions have never been more critical for businesses. But most companies have no idea where to start. We’ve created this article to give you a starting point and explain more about Microsoft Identity and Access Management solutions.
What Do IAM Services Do?
Your employees are your biggest security risk. If they’re careless about keeping their passwords secure, or use weak passwords, you might as well send out a notice saying, “Hack me.” Managing access is simple when you’re running a small business with a few employees. The more employees you have, the harder it becomes to manage. That’s where IAM services come into play.
Manage Employee Access
They allow you to manage employee access to your systems more efficiently. They offer an alternative, more secure access options. Microsoft’s Azure Active Directory, for example, offers you a single sign-in point coupled with a multi-factor authorization system.
So, instead of just typing in your username and password, you’ll have a few different authentication steps. You might, for example, have to type in an authentication code sent to your phone. Or, if you need even more security, biometric identification might be brought into play.
With IAM systems, you’re able to see at a glance what systems an employee can access. You can adjust their access to just the systems vital to their function. You’re also able to program the system to reset passwords after a set interval automatically.
Improve the Customer Journey
These systems can make the client journey better by making the sign-in process easier and more secure.
Manage Access for External Contractors
If you need to work with freelancers, these systems allow you to set up the user profiles quickly and easily. You’re able to assign limited user privileges to only the systems that they need to access.
You can, for example, give them access to just one company email address or basic access to your database. You can also program in an end date for the contract to ensure that access is canceled automatically.
Improve Productivity
They can also be useful in improving productivity because they allow employees to work from different devices securely. Many of these services are cloud-based, so they are not device-dependent. In other words, you don’t have to download them to the device itself.
By limiting employee access to your systems, you’re better able to manage congestion within those systems. This, in turn, improves productivity.
Support Compliance
With privacy laws becoming stricter, businesses are under greater strain to protect client information. IAM systems can assist with this.
Allow IT Personnel to Focus on More Important Tasks
Finally, these systems allow for the automation of essential security tasks. This frees up your IT personnel to work on more important things. It also reduces the potential for human error.
How Does Microsoft Fit In?
Microsoft’s Azure range offers a set of robust tools that provide you with the levels of security that you need. They’ve also partnered with several third-party providers to enhance protection further. So, if Microsoft doesn’t have the tech to offer facial recognition software, for example, they’ll partner with a company that does.
Azure Privileged Identity Management
This product provides approval-based and time-based activations to help prevent the abuse of resources and unauthorized access.
The features include:
- Just-in-time privileged access: This feature lets you block incoming traffic to your Azure virtual machine. This effectively protects you against attacks by reducing your exposure. When the system is not in use, it’s locked out.
- Time-bound Access Privileges: Say, for example, that you’re employing someone temporarily. Enter the dates when the contract begins and is terminated. The system will cut off access on the termination date automatically.
- Control who is in control: The system requires the creation and then activation of user profiles. Activation of special privileges can only be achieved with approval from the system administrator. You can, if you prefer to follow the maker/ checker model here. IT pro 1 creates the profiles and then kicks these up the line for activation approval.
- Use multi-factor authentication for user activations: The protection extends beyond just your employees. You can enable two-factor authentication for users signing up for your site as well. If they create a profile, for example, they’ll have to verify the email address to activate it.
- Notification when a privileged role becomes active: This is another form of authentication. If someone signs onto the system, or requests permission to do so, a notification is sent.
- Review of access: Have employees changed roles? Do they still need as much access as before? Microsoft Identity Access Management makes it simple to review roles and change access as necessary.
- Full Audit History: This is useful if you are being audited. This provides proof of activation dates, data change dates, and so on. This can become important if your company is facing charges in terms of privacy laws. It also makes internal audits a lot easier to conduct.
Who is Allowed to Do What?
The system assigns different privileges to those charged with managing it. Here’s how that works.
- Security Administrator
The first user registered here is assigned the roles of Privileged Administrator and Security Administrator.
- Privileged Administrators
These are the only admins who may assign roles for other admins. You are also able to give other admins access to Azure AD. People in the following roles may view the assignments, but not alter them. These people include Security Admins, Global Admins, Security Readers, and Global Readers.
- Subscription Admin
People in these roles can manage the assignments for the other admins. They can change and terminate assignments. Other roles allowed to do this are user access admins and resource owners.
It should be noted that people in the following roles need to be assigned permission to view assignments: Security Admins, Privileged Role Admins, and Security Readers.
Terminology that You Need to Know
The terminology used in Microsoft Privileged Identity Management may be confusing for the uninitiated. Here’s a breakdown of the basic terminology.
- Eligible
With this assignment, users need to take a specific action or actions to activate their role. The difference between this role and a permanent one is that not everyone needs access at all times. The user can activate the role when they need access.
- Active
These are the role assignments that are assigned by default by the system. They don’t need to be activated. For example, System Admins being able to create assignments for other admins.
- Activate
This is the action or actions people must take to prove that they’re authorized to use the system. Inputting a username and password is an example of this. Many different authentication methods can be used here.
- Assigned
This means that the user has been granted certain privileges within the system.
- Activated
This is a user that can use the system, activate their role, and is currently using it. The system will prompt the user to re-enter their credentials after a set period of inactivity. An example is with internet banking, where you’re signed out after ten minutes of inactivity.
- Permanent Eligible
This is an assignment that allows the user to activate their role whenever they like. They’ll have to perform specific actions to access roles. Say, for example, an employee captures a payment to be made. They may need to enter a randomly assigned code to confirm the transaction.
- Permanent Active
This assignment allows the user to use a role without activation. These are roles that the user can take without further actions.
- Expire Eligible
This is a time-based role. Here you’ll have to assign start and termination dates. This can be done for freelancers. It can also be used to force employees to update their passwords regularly.
Access management, especially in a medium to large organization, can be a challenging task. With the power of Microsoft’s Azure suite, though, it becomes a lot easier to accomplish. IAM services add an extra layer of security to protect against breaches that stem from internal accesses and compromises.
***
Chris Usatenko is a computer geek, writer, and content creator. He is interested in every aspect of the IT industry. A freelancer by nature, he is willing to gain experience and knowledge from around the world and implement them in his life.
