Understanding Identity and Access Management

In a conference session led by Lance Peterman and Aspen Fargo, the topic of discussion revolved around gaining a new perspective on access and identity. The overarching goal of the session was to encourage attendees to become more adept at being part of conversations about identity, both as listeners and as speakers. The speakers emphasized the need for multiple perspectives and frameworks when discussing identity and access management as well as the importance of asking questions.

The Complexity of Identity and Access

Peterman and Fargo began by acknowledging the complexity of the field, debunking the notion that identity and access is a race towards perfect security. They illustrated the challenges of defining identity and the varying perspectives of different stakeholders.

The speakers highlighted the diverse backgrounds of people working in identity and access, pointing out the need for a broad understanding of the different constituencies of users and data sources.

Authentication and Authorization

The speakers delved into the intricacies of authentication, emphasizing the need for multiple methods and the evolving landscape of passwordless authentication methods. They also discussed the concept of "least privilege" in authorization, emphasizing the importance of matching access permissions to the specific needs of each user or entity.

Governance and Role Management

The discussions also touched upon governance, role management, and the challenges of ownership of data. They also highlighted the importance of role management in facilitating access certification and how it can contribute to achieving least privilege.

Analytics, Intelligence, and Recovery

Peterman and Fargo emphasized the potential of analytics and intelligence in optimizing identity and access management, but they also cautioned about the risks of over-relying on automation. They concluded by addressing the importance of recovery mechanisms and level of assurance in maintaining the integrity of the system.

Overall, the presentation provided a comprehensive overview of identity and access management, covering a wide range of topics from authentication to recovery. The speakers urged the audience to consider the multiple perspectives and frameworks in the field, underscoring the need for continuous learning and adaptation in an evolving landscape. They also highlighted the importance of community and professional organizations such as ID Pro in furthering the field of identity and access management.