Access Management vs. Identity Management: What's the Difference? (SlideShare)

Courtesy of InfraMatix

http://www.IDMChecklist.com

Access Management vs.

Identity Management:

What's the Difference?

http://www.idmchecklist.com/

You will often hear the terms

access management (AM)

and identity management

(IDM) used as if they

were synonyms

Sponsored by http://www.IDMChecklist.com

Veera Sandiparthi Founder of InfraMatix


The problem is that they are not




We will examine what identity

and access management are,

and more importantly

what they are not




Identity Management




Identity management

is about authentication




Its purpose is to determine

you are who you claim to be




Identity manager applications

will authenticate entities

(people or devices)

by a certain criteria




such as a username/password

combination, biometrics or

tokens, or some unique

hardware/software identifier

in the case of a device




However, an identity

management tool

is not very user friendly,




as it just authenticates entities

against an unsorted list

in a database




Therefore, vendors produce

identity management products

that allow administrators to

place people or devices into

groups and assign them roles




The product can then

determine, for example,

that the person is not just

Joe Smith, but that he is

also in the group “Finance”

with the role of “Accountant”




In its purest sense,

identity management

as a concept is about

authentication




However, identity management

as a product or service is about

authentication & classification




In summary,

identity management:




• In concept

is about authentication




• As a product

provisions & authenticates

user accounts




• As a product

provides mechanisms

for categorization

such as groups and roles




Access Management




Once identity management

has authenticated a user,




then access management

can apply authorization policy

to that entity




Therefore, to differentiate

the two technologies:




• Identity management

creates & provisions

user accounts, and then

authenticates & classifies

entities into groups and roles




• Access management then

applies authorization policy

to those user accounts,

groups or roles




Bottom Line




Identity and access

management are often

confused




And since they are

so tightly integrated,

they cannot work alone




• What is the purpose of

authenticating and

classifying Joe Smith the

Accountant if there is

no authorization policy?




• What is the purpose of

applying an authorization

policy to a user, group,

or role if there is no way of

authenticating the identity?




What do you think defines

identity management and

access management?




Let us know your thoughts

in the Comments box below




Copyright © InfraMatix

Is Your Company Adequately

Protected from Security Risks?

Download the Free

8 Point Identity Management

Checklist Now at

http://www.IDMChecklist.com


Technology

Access Management vs. Identity Management: What's the Difference? (SlideShare)