Industry Perception of Security Challenges with Identity Access Management Solutions

TY - CONF

T1 - Industry Perception of Security Challenges with Identity Access Management Solutions

AU - Kuzminykh, Ievgeniia

AU - Ghita, Bogdan

AU - Singh, Abhishek

PY - 2024/6/1

Y1 - 2024/6/1

N2 - Identity Access Management (IAM) is an area posing significant challenges, particularly in the context of remote connectivity and distributed or cloud-based systems. A wide range of technical solutions have been proposed by prior research, but the implementation and integration of thesesolutions in the commercial sector represent steps that significantly hamper their acceptance. The study aims to outline the current perception and security issues associated with IAM solutions from the perspective of the beneficiaries. The analysis relies on a series of interviews with 45 cyber security professionals from differentorganisations all over the world. The particular focus of the study is represented by the challenges and vulnerabilities of onpremises and cloud-based IAM deployment models. As highlighted by the interviewees, cloud IAM solutions and onpremises IAM solutions are affected by different issues. The main challenges for cloud based IAM solutions were Default configurations, Poor management of Non-Human Identities such as Service accounts, Poor certificate management, Poor access review, Poor API configuration and limited Log analysis. In contrast, the challenges for on premise solutions were Multi Factor Authentication, insecure Default configurations, Lack of skillsets required to manage IAM solution securely, Poor password policies, Unpatched vulnerabilities, and compromise of Single-Sign on leading to compromise of multiple entities. The study also determined that, regardless the evolving functionality of cloud based IAM solutions, 41% of respondents believe thatthe on premise solutions more secure than the cloud-based ones. As pointed out by the respondents, cloud IAM may potentially expose organisations to a wider range of vulnerabilities due to the complexity of the underlying solutions, challenges withmanaging permissions, and compliance to dynamic IAM policies.

AB - Identity Access Management (IAM) is an area posing significant challenges, particularly in the context of remote connectivity and distributed or cloud-based systems. A wide range of technical solutions have been proposed by prior research, but the implementation and integration of thesesolutions in the commercial sector represent steps that significantly hamper their acceptance. The study aims to outline the current perception and security issues associated with IAM solutions from the perspective of the beneficiaries. The analysis relies on a series of interviews with 45 cyber security professionals from differentorganisations all over the world. The particular focus of the study is represented by the challenges and vulnerabilities of onpremises and cloud-based IAM deployment models. As highlighted by the interviewees, cloud IAM solutions and onpremises IAM solutions are affected by different issues. The main challenges for cloud based IAM solutions were Default configurations, Poor management of Non-Human Identities such as Service accounts, Poor certificate management, Poor access review, Poor API configuration and limited Log analysis. In contrast, the challenges for on premise solutions were Multi Factor Authentication, insecure Default configurations, Lack of skillsets required to manage IAM solution securely, Poor password policies, Unpatched vulnerabilities, and compromise of Single-Sign on leading to compromise of multiple entities. The study also determined that, regardless the evolving functionality of cloud based IAM solutions, 41% of respondents believe thatthe on premise solutions more secure than the cloud-based ones. As pointed out by the respondents, cloud IAM may potentially expose organisations to a wider range of vulnerabilities due to the complexity of the underlying solutions, challenges withmanaging permissions, and compliance to dynamic IAM policies.

M3 - Paper

T2 - IEEE International Black Sea Conference on Communications and Networking

Y2 - 24 June 2024 through 27 June 2024

ER -