Skip to main content

Next Generation Identity and Access Management (Next Gen IAM)

May 23, 2016

Featured I am 1

Having spent the last 17 years in the identity and access management (IAM) space, I know two things are certain: Evolution is inevitable, and change is constant. Functions, maturity, risks, trends and buying patterns all continue to evolve, mature and adjust to market conditions. One major change that has been underway is the entry point into identity management for clients.   

In our discussions with clients who are in various stages of investment and maturity, we have developed a clear set of high-level blueprints to guide those conversations. These blueprints assist clients in understanding the progression or continuous evolution of their own IAM-related investments that provide greater benefit and richer value to the organization as it grows.

Today we have four main blueprints:

  1. Considering IAM Investment
  2. IAM Implemented
  3. IAM Program Formulated
  4. Next Gen IAM Initiated and IAM Program Maturing

The focus of this post is next generation IAM. 

Identity is everywhere. It has become very clear that identity is not just a thing on its own, but it also is integrated into every other corner of an organization’s environment. 

The next generation of identity and access management (next gen IAM) is being driven by the constantly changing set of challenges associated with trying to provide an effective cyber security posture for an organization. The challenges are far greater and more complex than ever before:

  • The Internet of Things (IoT) is becoming more corporate and mainstream.
  • Security leaders are forced to demonstrate metric-driven business value.
  • Breaches are happening every day and there must be a coordinated attempt to manage and mitigate them.
  • The threat landscape is constantly changing, including an increase in insider threats.

This is causing clients to ask:

  • Can identity data do more for me?
  • Can identity enable more real time and risk-based decision making in the authentication process?
  • Can identity provide the flexibility required to manage access with an unlimited amount of touch points and device types?
  • Can identity minimize the burden of administration within the other investments we have made in cyber security? 

Our research to date has shown that IAM can provide more substantial value to your organization when integrated with any and/or all of the following cyber security areas:

  • Identity and Access Management (IAM)
  • Governance, Risk and Compliance (GRC)
  • Security Information and Event Management (SIEM)
  • Data Loss Prevention (DLP)
  • Privileged User Management (PIM)
  • Data Access Governance (DAG)
  • Cloud Access Security Brokers (CASB)
  • User Behavior Analytics (UBA)
  • Service Management 
  • Network Security (NetSec)
  • Enterprise Mobility Management (EMM)
  • Endpoint Security 

In each of these areas, IAM performs (at a high-level) two major functions:

  • Provides some level of flexible authentication integration.
  • Provides the context of a user and/or attributes so that more effective management and controls can be executed.

These integrations on their own also are in various levels of maturity and/or functionality. The approach to these integrations from the vendors (or between the vendors also differs):

  • Full-suite vendors are taking a more internal “look to me” approach for end-to-end integration in the various cyber security segments in which their solution focuses.
  • Vendors that provide a more individual segment approach are looking to each other through the use of technical alliance programs to support integration between their products, allowing an organization to make more informed decisions on possible integrations and holistic pictures into their data.

With the above in mind, an industry alliance has been created to help bring all views into one common community to participate and support. The Identity Defined Security Alliance (IDSA) is working to bring a unified platform for collaboration, conversation, community involvement and interoperability between the vendors and organizations that need this level of identity in their cyber security framework to be successful. It is an independent alliance built to be solution agnostic and foster community growth.

Identity defined security (or the next generation of IAM) will allow for intelligence-based, risk-based, adaptive decision making in all aspects of cyber security. The end goal is that threats, breaches and incidents will be managed and contained more dynamically, and CISO’s will be able to report on the health and well-being of the entire cyber security framework based on metrics from these integrations. 

To understand if your organization is prepared for the next generation of IAM, ask yourself these questions:

  • Have I begun to treat my IAM investment programmatically, and do I have a diverse set of advocates that next generation IAM is achievable?
  • Have my IAM investments been measured to be successful, enough so that I can focus on the next generation of IAM?
  • Does my organization understand the overall migration towards intelligence-driven management of risk and decision making?

If you can answer yes to these questions or desire to seek a path towards the next generation of IAM, you are on your way to successfully achieving identity defined security.

    Danny Pickens

By: Danny Pickens

Senior Director, Theat Management Operations

See More

Related Blogs

June 07, 2018

Quick Tips for Building an Effective AppSec Program – Part 3

This is the last post in my series on creating an effective AppSec program within your organization. In my last post, we discussed the importance of t...

See Details

May 10, 2018

Observations on Smoke Tests – Part 3

While attending one of our technology partner’s security training courses, the instructor presented on their product’s various features and capabiliti...

See Details

May 03, 2018

Getting Started with Postman for API Security Testing: Part 1

Postman is a useful tool used by many developers to document, test and interact with Application Programming Interfaces (APIs). With the ubiquity of A...

See Details

How Can We Help?

Let us know what you need, and we will have an Optiv professional contact you shortly.

Privacy Policy


January 26, 2018

Identity and Access Management Solutions

We help you minimize risk and maximize efficiency with our IAM solutions.

See Details

July 25, 2017

Identity and Access Management Program Primer

Learn how to create an identity and access management maturity roadmap tailored for your organization.

See Details

July 21, 2015

Network Security Solutions

Learn how we help protect your environment while maintaining connectivity.

See Details

Stay in the Know

For all the latest cybersecurity and Optiv news, subscribe to our blog and connect with us on Social.


Join our Email List

We take your privacy seriously and promise never to share your email with anyone.

Stay Connected

Find cyber security Events in your area.