When Is the Right Time to Move IAM to the Cloud?

Now that traditional corporate perimeters are out of the question, Identity and Access Management (IAM) solutions have become key to preventing data breaches. James Quick, Director, Solutions & Advisory for Simeio Solutions explains how to determine when is the right time to move IAM to the cloud and why migration makes a huge difference. 

Ask anyone in security and they’ll tell you addressing cybersecurity blindspots associated with cloud permissions is one of the most challenging problems for security teams. Then there is the ongoing challenge of providing   centralized enforcement of least-privilege policies.

Moving IAM resources to a cloud-managed identity as-a-service, or IDaaSOpens a new window , removes these challenges. Managing the people, processes, and products associated with IAM can be accomplished within almost any budget. And, there are diverse options for in-house and/or cloud-managed services.

Learn More: How to Get Identity & Access Management (IAM) Right, Finally

Is Moving IAM to IDaaS Cost-Effective?

There is an old tongue-in-cheek saying, “half of the money I spend on advertising is wasted. The trouble is, I don’t know which half.” I would say the same thing is true for IT budgets. However, this is where an IDaaS can deliver the full benefits, quantify the value, and deliver a fast return on investment. 

As is the case for most IT functions, properly managing identities in-house is expensive. And of course, it includes people, processes and products. From provisioning identities, and integrating apps and directory services, to onboarding, offboarding, assigning permissions and credentials to employees, and managing workflows; in-house IAM is costly, cumbersome, and not without risk. 

Beyond the staff that manages and supports everything, there are costs for software, systems, and servers, along with the maintenance and support for each. There are costs for fixing manual input errors, managing and supporting data backup and recovery systems, and costs for VPN integration and monitoring of IAM tools and systems.

On the other hand, cloud-based IDaaS is a subscription model. The monthly cost is consistent and predictable. There are no software and servers to maintain, support, and patch, and no backup and recovery systems to manage.

Learn More: 5 Ways to Increase Cyber Resilience Amid Strained IT Budgets

When considering whether to move IAM to IDaaS, there are many options:

• Hybrid IAM/IDaaS – move all applications to IDaaS, where they manage both cloud apps and integrate on-premises apps with out-of-the-box connectors and REST APIs.
• Hybrid IAM/IDaaS with a twist – move all cloud-based applications to IDaaS, and keep on-premises applications in-house with your existing IAM solution.
• Hybrid IAM/IDaaS with a double twist – move all applications to IDaaS. They host the cloud apps and integrate on-premises apps with out-of-the-box connectors and REST APIs. And your in-house engineers maintain all the apps through a cloud portal.
• All-in IDaaS – migrate all on-premises and cloud apps to a fully-managed IDaaS, including the infrastructure, maintenance, DevSecOps, and support services. 

Cloud-based vs On-Prem IAM

Discovering the best solution for your organization requires answering some questions. For example, where are the majority of your applications located? Are they hosted in the cloud through Microsoft, ServiceNow, SMP, etc., or are they primarily on-premises? Many prominent applications that had required data center infrastructure are now cloud-enabled. 

If most of your applications are in the cloud, it may be time to move your IAM to a cloud platform. There are many reasons that support this move. Cloud apps are more streamlined and secure. And there is less risk because the interoperability between cloud apps can be governed by cloud access brokers, rather than ad hoc on-premises defense perimeters. Cloud interoperability allows public and private cloud services to understand each other’s APIs, configurations, data formats authentication methods. 

Equally important to consider is whether managing and supporting IAM in-house is taking away critical resources from your core business and strategic initiatives. If so, this might be a good reason to consider moving IAM to a cloud-based IDaaS.

Determining whether or not to migrate on-premises IAM to IDaaS, often depends upon the decision-maker. For example, a CISO might want to keep IAM in-house, because they may feel it allows them to keep a close eye on everything. Whereas, a CIO or CFO, will evaluate the risk/reward options, and might prefer moving to the cloud, to take advantage of the cost benefits.

The answer also depends on the maturity of your IAM solution. For example, are most of your applications manual, or are applications with HR employee provisioning and de-provisioning automated? Privileged access management (PAM) has a repository, or vault, that holds the company crown jewels, in the form of admin, root, service, and database administrator accounts. Moving this to the cloud will be determined by your comfort-level, or risk tolerance, in having a third-party take on the management.  

Remember, a cloud provider will have the same disaster recovery scenario as you have in-house, but they are able to leverage cloud economies of scale. Also, they typically don’t charge additional for DR and sandbox instances, or test environments. 

Learn More: Choosing an Identity & Access Management (IAM) Solution? Top 10 Questions to Ask

Is Cloud-Based IDaaS Secure Enough to Manage IAM?

Despite any fears, having your IAM managed in the cloud can be more cost-efficient and secure, than within your corporate data center. Additionally, IDaaS can be securely administered from wherever you have access to a web portal. 

If risk tolerance and security are concerns, consider the fact that federal agencies are moving to the cloud. Microsoft and AWS both have FedRAMP certifications. Before a cloud provider can even begin the certification process, they must first implement FedRAMP compliant documentation and controls. The FedRAMP security assessment gives agencies the confidence they need in the security of their cloud environments. 

The Joint Enterprise Defense Infrastructure (JEDI) is a U.S. Department of Defense cloud computing contract. This new system is replacing the DoD’s legacy computer networks with a cloud solution that contains classified secrets and feeds AI-based analysis to the military. If mission-critical government agencies, like the DoD Jedi contract, are moving a large portion of their military’s computing infrastructure to the cloud, perhaps that will give businesses more confidence, too.

Deploying, monitoring, managing, and supporting IAM Opens a new window is complicated and challenging. A successful migration to IDaaS requires the appropriate allocation of People, Processes, and Products. After you’ve evaluated the many deployment options, potential issues, and opportunities for improvement, you might discover IDaaS to be the right solution for you.

Let us know if you liked this article or tell us on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We would love to hear from you.