How to Leverage UX to Bolster IAM & Security Programs
Identity and Access Management space is big business, worth billions of dollars a year. But while these solutions do what they claim, it’s also true that they introduce additional burdens upon the organizations that adopt them. So when we were starting Axiom, we wanted to know, is this why so many IAM solutions fail to deliver on their promises?
While many security vendors espouse benefits to the Security and IT folks who use their tools, we believe that too little attention has been paid to the end user experience – and that has become a big problem. Here’s why: at the same time you are relying on your employees to move fast and stay competitive, the very tools they count on to get work done are bogging them down. The manual authorization process of understanding, requesting, and waiting for permissions slows their work down to a crawl.
We understand why: the technology that’s supposed to connect workers to the cloud and keep everyone safe is simply a bottleneck, forcing Security and IT teams to make manual, uncorrelated decisions, leading to delays and oftentimes, mistakes such as underprivileged. Without the ability to see which end user can access which systems and understand the actions they can (and should) take, your security folks are forced to make decisions in the dark about who can and should get which type of access to specific assets.
In this all-too-common scenario, they’re managing provisioning through endless orchestration between users, roles, and permissions – logging into each system to understand, manage, and control Cloud and SaaS authorizations. And if they’re fortunate, they’ll remember to prune permissions correctly when they are no longer needed. Adding to the burden is the fact that employees constantly change roles and also sign in from different locations and devices, and you can immediately see the tremendous burden in managing all of that. We’ve spoken to so many companies where this is the case, and we understand that it puts Security and IT teams on the defensive, always reacting to requests instead of getting out ahead of them and being able to be strategic in the business.
More problematically, this is a tediously manual process and inefficient at scale, and it ends up creating friction and frustration for end users, who end up waiting for permission to systems and tools while Security and IT teams sort out and prioritize requests. End users might also be confused or slowed down by complex authorization procedures or difficult-to-use interfaces to permissions tools.
It’s crazy that this is the case, but the sad fact is that the solutions purchased by Security and IT that then have to be adopted by other departments often lack the usability needed by end users.
We’re not sure who fares worst here – the Security and IT teams or the end users they support. But what is clear is that without proper support, end users will almost always find a work around, and that can put the business in jeopardy. Users are known to hoard permissions and get too much access, exposing data they don’t need or don’t even know about. That, in turn, has its own consequences.
For example, as companies struggle to scale cloud authorization, it should come as no surprise that the 2022 Verizon Data Breach report found a whopping 89% of web attacks to be caused by credential abuse. Meanwhile, Gartner believes that this year, 75% of security failures will be attributable to inadequate management of identities, access, and privileges, up from 50% in 2020. The costs of such failures quickly add up. Ponemon Institute’s 2022 Cost of a Data Breach report estimates that the average data breach cost increased to $4.35 million in 2022, up 12.7% from 2020.
The simple truth is that to help your end users get the access they need to do their jobs, you must provide a secure and seamless user experience. IAM software simply should not create additional burden to any of the teams that need to use it – both on the security side and the end user side.
So, what can you do? The best approach is to look for IAM tools that not only secure the business by helping you achieve and maintain least privilege but also you help you decrease the operational overhead for Security and IT while minimizing end user friction and frustration.
Here are three key features to look for when evaluating new IAM solutions, especially as you seek to increase and support your end users’ productivity:
- An end user dashboard of all their active and expired permissions so they can see what they have access to – without time-consuming trial and error.
- An easy-to-use self-service portal so users can find and request just-in-time, right-sized access. You’ll find that instant access to tools reduces friction, decreases frustration, and eliminates wasted time, making for much happier and empowered workers.
- Tightly integration with collaboration tools your users already work with, such as Slack, Microsoft Teams, CLI, and others, to request access. That makes it easy to get the permission they need without having to learn yet another UI.
We built Axiom Security to deliver seamless and secure Cloud authorization, bolstering security while boosting productivity. Axiom offers Sec and IT teams a user-friendly IAMOps platform that automatically orchestrates Cloud and SaaS IAM operations to scale least privilege while minimizing operational overhead and friction.
Axiom takes a holistic approach to Cloud IAM, providing just-in-time personalized access, custom IAM workflows, and centralized entitlement visibility. Moreover, Axiom provides automated approval workflows and a self-service portal for users, who get just-in-time right-sized access. Employees simply request permissions and get the right access, boosting their productivity and the company’s ability to move at the speed of business.
Isn’t it time to do IAM the right way?
If you’d like to experience the power of Axiom and see exactly how we support your end users, please request a demo.
