For Identity and Access Management specialists like us, the case is the same, and it is becoming a struggle to communicate our message clearly and in a way that can be compared to what is already out there. So, here is a guide to the forest of terms related to Identity and Access Management.
Basically, the idea behind what is known as Identity and Access Management, among other names, is to club access rights from a number of systems and applications into logical and easily controlled “Identities”. In that way, we avoid the very common problem of lazily adding access rights based on other users, and start handling them based on the organization’s structure according to the actual job description, or job function of each user.
As an overview, here is a list of some of the most common terms and practices that all cover what are required, valuable components of a well-prepared and well-thought-out IAM project:
IAM – Identity and Access Management.
IDM – Identity Management.
IAG – Identity and Access Governance.
RBAC – Role Based Access Control.
ABAC – Attribute Based Access Control.
No 2015 IAM solution falls under just one category. Some will argue that IAM is the umbrella term—the mother of all Identity and Access Management efforts, but it actually depends quite a lot on your need, or your primary “pain”.
Your need might very well be to get things under control. It can be to respond to an audit, or maybe you find that Governance and Auditing is, in general, a hassle that keeps getting worse. Perhaps your colleagues and yourself work in a very scattered environment, traveling a lot or having offices that are spread out, and still need to be in control of all the pieces. Perhaps your license management has gotten out of hand.
Maybe you need to comply with well-known international or local Compliance frameworks, or your major customers and shareholders demand that you do—how do you document that you are in fact compliant?!