Critical Analysis: Literature Review on Identity and Access Management

This literature review provides a comprehensive overview of Identity and Access Management (IAM), emphasizing its importance in modern business environments. It begins by defining key concepts such as identity, access, and entitlements, and then delves into the evolution of IAM and its role in securing access to organizational resources. The review highlights the benefits of IAM in future technologies, including managing access through social IDs and ensuring secure single sign-on (SSO). It also discusses the significance of IAM in reducing security costs, managing authentication across heterogeneous technologies, and enabling efficient operations. The review concludes by underscoring the need for a centralized approach to IAM to effectively manage user identities and access rights, ensuring the security of IT systems and sensitive information.

Running head: LITERATURE REVIEW
Literature Review: Importance of Identity and Access Management
Name of the Student:
Name of the university:

1LITERATURE REVIEW
Table of Contents
Chapter 2: Literature Review...............................................................................................2
2.1 Introduction:..............................................................................................................2
2.2. Research/Definitions.................................................................................................3
2.3. Theories and Models:.............................................................................................15
References..........................................................................................................................24

2LITERATURE REVIEW
Chapter 2: Literature Review
2.1 Introduction:
The company’s existing in today’s world is seen to be much more concerned about the
value chains which are seen to be complex in nature which are also necessary for the integration
as well as for offering a wide range of information system. This has initially made the lines
existing amongst the service providers as well as the users and amongst the competitors blurred,
for this reasons the companies are having an increased need of implementing the efficient and
flexible business processes get focused upon various electronic exchange of the data as well as
information. For this reason this type of processes requires an identity and access management
system (IAM) which is much more reliable. IAM generally refers to the process which is
associated with managing the information and who is having access to what information. The
IAM activities generally includes the creation of the identities for the users as well as for the
system.
The IAM has seen to have recently emerged as one of the critical foundation so as to
realize the various benefits of the business which are mainly related to saving of costs,
controlling the management, efficiency of the operations and most important is the growth of the
business for e-commerce. There is also a need of managing the process of access by the
enterprises to the various information and the application that are seen to be scattered all across
the internal as well as the external application systems. Additionally there is also a need of
providing the access for the identities that are increasing day by day, both in the inside and
outside the organization. This is to be done by maintaining the security as well as by preventing
leakage of any sensitive information.

3LITERATURE REVIEW
The IAM mainly consists of peoples as well as products and process which are needed
for managing the identities as well as the access to various kind of resources that an organization
is having and the IAM framework for the various processes of an business is associated with
facilitating the process of managing the electronic identities, this framework is also associated
with including the various technological needs as well which are mainly needed for supporting
the process of identity management. The IAM which are controlled poorly might be associated
with leading to regulatory non-compliance and the reason behind this is that in case if any of the
organization is audited then the management would not be capable to proving the fact that
company data is not facing any kind of risk related to misuse.
2.2. Research/Definitions
The definitions of the key concepts in the IAM are listed below:
Identity: The components or the combination of the components that merely defines the
devices or the person is called the identity. It can be stated as the password or any other personal
data or the combination of these that are known.
Access: The data which represents the right that the data was granted to a particular
person is known as access. This data of the access privilege can be granted to allow the users to
operate transactional operations at different levels. Few examples of the transactional operations
are add, delete, copy, approve, transfer, change and cancel.
Entitlements: The set of access privilege that are to operate the transactional operations is
called the entitlements. The word entitlement is generally used with the access privilege.

4LITERATURE REVIEW
The IAM is the what, when, why, who and where of the data technology. It surrounds
many automations and the security practices, secure single sign-on (SSO), the user
authentication, authorization, provisioning and de-provisioning.
Identity access management (IAM)
Identity and Access Management is the method that is used for the management of access
to the resources of the organization. It is the base of any information security plan and it is the
one of the important part of the security areas with which the user communicates maximum.
Rubmann et al., (2015) stated that IAM only gave importance for the establishment of
capabilities for supporting the access management and only for the access related consent
requirements. The solutions provided were mainly focused on the machineries technology and
were adopted poorly. It also became the cause of the high costs and also fulfilled limited values.
The organization most of the time struggled to reach the agreement demands in this period and
the solutions that were deployed managed only a few programs and systems.
Automated, centralized and standardized identity management services were developed
to minimize the cost and risk, and improve the efficiency of the operations. Coppola and Morisio
(2016) analyzed that since the agreement is the most important driver in the IAM initiative, the
IAM is developing into the risk based program with the abilities that are focused on the license
management and the implementation of the rules that are to be obeyed for the logical access
controls. Organizations have finally started to achieve the benefits from their costs of the IAM
but still get challenged by the management of the time intensive processes such as the access
review, manual approval and the provisioning. Identity authority extends the function that is to
be delivered to the association storehouse that resulted in the raise in the cost of provisioning and

5LITERATURE REVIEW
de-provisioning, excessive access to the user and the inefficient processes (Dellios,
Patsakis&Polemi, 2016). As the IAM is developing, the association looks into broadening, the
association based on result are adaptable to the latest utilization trends such as the cloud and
mobile computing.
Benefits of IAM in future technologies
Various people are accessing the services and resources to a greater extend using their
social IDs. Gora and Rüb (2016) discussed that the user requires reaching other user through any
type of platform and then granting them easy access to the users services through their existing
digital identities. The concept of bring your own identity (BYOID) grants the user to access the
system of other user through their own identity. By the implementation of such ideas, the user
can minimize the barriers of entry and let the partners, employees and customers securely and
easily access the business capabilities anytime and anywhere from the world.
Building a connection with people, programs and the devices is the most important need
of the digital change in the market. The IAM results can ensure to manage the complexities that
are faced during the making of connections with the most known identity providers such as
Google, Twitter, and Facebook (Coppola & Morisio, 2016). It is done by invoking the security
policies with the strong authentications. The user also needs to be future-proof to ensure that the
user will be able to extend the solution and connect to some new identity provider that is
developed later.
Today, users does not have time to remember the various usernames and passwords. So
they want to use one identity for login in various system. With SSO and unified identity, the user
can have access to various areas of the system with one identity ensuring that the organization

6LITERATURE REVIEW
provide a logical user experience. When the user is connecting to different identity provider
through the program the risk of a hack is higher. The provider needs to ensure that it has covered
all the bases and has thought of all the securities visible features. With the various factors and the
strong authentication the provider can ensure about the identities that access the users system are
fully genuine. Which part of the system of the organization can be accessed through the user is to
be controlled by the provider. By controlling the systems function through the analytics, using
alert functions and performing fraud detection the provider can know when the organization is at
risk in the real time and ensure to take a quick action toward the risk.
In this fast stepping world, the provider needs to be ensure about the method that can be
adopted by the software as a service offering such as the Google Apps and GoToMeeeting fast.
With SSO, the provisioning and the main authorization management, the provider can grant the
user to have easy and secure access to the systems without creating any type of extra security
storage house. The company provides the user with software that are purposely designed to meet
today requirements for the rapid approach to the API management, identity, integration and the
access management. Automation provisioning guides the user to have speed up and grants the
new employees to access the required part of the providers system. This operations can be
performed manually or and can take a long period of time, and in return it may reduce the
employees ability to start the work faster.
Importance of IAM
Hu et al. (2015) examined that IAM is very important for the future technologies and this
is associated with ensuring the fact that the specified users are having the access to the system or
the technology which they need to access and are authorized to do so, whereas the unauthorized

7LITERATURE REVIEW
users are generally kept away from the sensitive resources as well as information.so by having
the IAM, whenever a user would make attempt for accessing a system or data then the user must
be firstly be associated with making claims related to the identity, typically by means of entering
the username into the system. Then the system must be associated with verifying this particular
claim related to identity by means of an authentication process. The authentication might be
associated with the usage of the basic knowledge based techniques like the usage or passwords
or relying upon the advanced technologies such as the biometric or the token based
authentication (Indu, Anand & Bhaskar, 2018). After completion of the successful authentication
the IAM system of the technologies would then be associated with verifying the authorization of
the user so as to perform the requested activity and this is one of the major reason lying behind
the including of the Identity and Access Management systems in the future technologies.
Another major reason lying behind the usage of the IAM in the future technologies is
that, along with proving the identity of the users the identity and access managements system
would also be ensuring the fact that the technologies which the user wants to used is being
performed within the scope of their authority.
According to Pratiksha, Prasad and Mungara (2017), it is also very important that the
future technologies which are to be used is associated with the usage of a centralized approach to
the IAM. Additionally, one of the major benefits which is associated with the usage of the
centralized approach by the IAM is that the professionals associated with handling this
technologies would not only become capable of managing the authentication but would also be
capable of authorizing the users all across a large number of heterogeneous technology which are
having an increased usage and is likely to have an high usage in the future. These type of
environment is associated with providing support to various kind of operation of the future

8LITERATURE REVIEW
technologies would be performing so as to facilitate the users. In order to make sure that each of
the future technologies is working in an effective and efficient way in such an environment the
security of the IAM solutions must be understood in a proper way and not only the operations
but also the ways that helps in getting access to the IT system which are responsible for enabling
those operations.
Another major reason lying behind the increased importance of the IAM is that it is
associated with helping a lot in reduction of the cost related to the security of the new
technologies which are to be used in the future. According to Hummer et al. (2016), the usage of
the single IAM platform by the new technologies for the purpose of managing all the access of
the users and this in turn would be associated with allowing the technologies to perform in a
more efficient as well as in an effective way. Along with all this another major importance of the
IAM is that it would be helping in improving the security of the data. The consolidation
authentication as well as the authorization functionality on the single platform would be
associated with providing the IT professionals in having a consistent method of managing the
access of the users to the respective technology that they want to access.
Additionally the access of the user by means of the centralized platform would be
benefitting the user by means of the single sign-on or the SSO technology which would be
associated with limiting the number of interactions that the users are having with the security
systems and this in turn increases the likelihood that their legitimate attempts for accessing the
technology or equipment would succeed (Katsikogiannis, Mitropoulos & Douligeris, 2016). The
usage of the IAM in the future world by different organizations and technologies would be
associated with providing a help to the users in having an easy access to everything that are
needed and this would be done just by having a single account. In addition to this the Identity

9LITERATURE REVIEW
and the Access Management would generally be associated with acting as the key which would
be helping in opening up of various aspects and features of the connected technologies to the
user and this is much simpler to set up and can be used very easily.
According to Sharma, Dhote and Potey (2016), the IAM is associated with bringing the
end users digital life to a connected world of new technologies and this is considered to be one of
the major targets of the Tech industry so as to help the users of the future in making their life
much more convenient assisted by a much more secure system. The target involves the bringing
of the digital life that and user is having into a connected world for the purpose of enabling the
similar set of services at the time of moving physically. Ng (2018) stated that this is also
important as the single sign-on would be associated with providing a simple as well as
frictionless service by the various technologies which in turn is associated with also linking the
authenticated sessions of the different digital services for the new technologies. The digital
identity would also be associated with providing the mechanism so as to have a seamless along
with a secure experience.
Identity and access management security challenges
The future technology that are going to be used in almost every aspect of life are likely to
face an increasingly complex challenges related to the providing of granular access to the
information resources by making use of the contextual information that are the related to the
users and their requests, while there is the existence of a successful restricting unauthorized
access to the sensitive corporate data. Some of the major challenges that are likely to be faced in
the future have been listed below:

10LITERATURE REVIEW
Despite of the fact that the future cloud models that are to be used would be making it
easy for the users of the future to gain an easy access of the various applications, the complexity
increases very quickly when the number of applications increases. Each of the application
existing within the future world would be having different password requirements along with the
variety of expiration cycles (Uddin & Preston, 2015). The multiplication of this variety of
requirement by the different kind of expiration cycles would be equaled with the diminished
productivity and increased fatigue and frustration of the users as they would be associated with
spending much of their time in making attempts to reset, remember and managing the passwords
as well as the URLS which changes constantly all across the applications that are going to be
used in the future by different users as well as by the organizations of different size.
Besides this the security risks are increased by users who are password fatigue as they
would be associated with the obvious or the reused passwords. Besides this the cloud based IAM
services that are to be used in the new digital technologies of the user would also be alleviating
these concerns by providing of a SSO or single-sign-on all across the application which in turn is
associated with providing the users with a central place for accessing all the applications of the
new technologies by making use of the single user name and passwords.
Waters (2016) discussed that failure-Prone Manual Provisioning and De- Provisioning
Process is another challenge which is faced whenever a new user would be associated with the
usage of new automated technologies and besides this they would be provided with an access to
the applications as well as to the network. This applications would be managed and access would
be provided to the respective users which would be granted by specific applications
administrator.

11LITERATURE REVIEW
Unfortunately it is expected that the technologies which are to be used in the future
would be suffering from network failures and this in turn would be failing in providing of
enough protection against any kind of unauthorized access to the various digital controls. This
would initially be associated with leaving the connected and the autonomous technologies of the
future vulnerable to various kind of threats from different sources. This in turn makes the
physical access practices lag a lot (Armstrong et al., 2018). One such example is the simple
access code to an application or the PIN consisting of four digits that would be used for granting
access to the application which are very vital such as the system consisting of vital information,
would be associated with the creation of a “one passcode fits all” scenario where any
unauthorized persons could enter the system by usage of the small 4 digit code.
According to Kunz et al. (2015), in the coming future as the connectivity of the various
technology becomes a norm and the increased usage of the various connected technology gets a
steady gain of the mainstream transactions then it becomes very necessary to look out for better
alternatives which would be helping in the secure management access to the different
technologies of the future. The future usage of the inter-operable cloud based platforms in the
future would be associated with enabling of the technologies so as know about anyone who is
trying to have an access of the system and would also be associated with providing of various
levels of authorization, connectivity and privacy protection as well and this is generally
dependent upon one who tries to get access.
According to Indu, Anand and Bhaskar (2018), another major important issue that is
likely to be faced by the technologies of the future is the compliance visibility which generally
refers to who is having access to what. In the future it is very important to understand who is