![\"Experts](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/10\/iam-insight-jam.jpg\")
<\/p>\n<\/p>\n
For our IAM Insight Jam, we asked identity experts from around the globe to share predictions for identity management in 2020. Originally, we planned on posting all of their comments and predictions for identity management in 2020 on Twitter<\/a> under the hashtag #IAMInsightJam. However, we faced two unique challenges:<\/p>\n Admittedly, these challenges prove the best ones to have. However, it makes posting the full predictions almost impossible for the Twitter-based event. Thankfully, we decided on perhaps the best kind of compromise. We’re going to post shortened versions of the predictions for identity management for 2020 on Twitter during the Jam. As we post, we plan to continually update this article with each experts’ full prediction. Thus, you get the best of both worlds for this first-ever Jam.<\/p>\n Without further ado, here we present our identity experts’ thoughts on identity management in 2020. While your reading, feel free to check out our 2020 Identity Management Buyer’s Guide<\/a>.<\/p>\n VP of Product, Wandera<\/a><\/b><\/p>\n Context Will Become King When it Comes to Authentication<\/b><\/p>\n As the drive toward a passwordless future continues, access will be determined by context – where you are logging in, what time, and from what device. This shift in authentication will change the need for passwords. While the methods of authentication will likely continue to move toward a superior biometrics-based approach, the most important authentication factor will become the context in which users are looking to gain access. Soon, opening different apps will not only rely on facial recognition or your fingerprint, but where you are, the network you\u2019re connected to, the country you\u2019re working from. In 2020, context will be king in the world of authentication.<\/span><\/i><\/p>\n Chief Strategy Officer, JumpCloud<\/a><\/b><\/p>\n We have seen the identity and access market \u2018sea\u2019 of vendors perpetuate best of breed\/point solutions that when integrated, solve a greater \u2018mesh\u2019 of access control and governance needs. The market will continue to contract while vendors strive towards workbenches\/platforms to provide wider coverage. This will be especially pronounced in the SME, where budgets are more constrained.\u00a0<\/span><\/p>\n The \u2018domain\u2019 is no longer defined by brick and mortar locations, in addition to reducing access to ensure least-privilege is the defacto. With remote operations now a reality, the perimeter needs to be defined wherever the internet can reach and demands a robust amount of user self-service. This will be achieved by automation and remote-based policy controls that will leverage security-first principles to gate initial access, then roles the user can play when accessing versus an assumption of complete lockdown.\u00a0<\/span><\/p>\n IAM solutions will be required to expand the information set currently stored about a user. This is not to be confused with PII, but rather data points that inform a user’s role, department, location and very specific elements about their means of access (e.g. the systems they are accessing resources from) for security policies to do their job in providing real-time access to resources.\u00a0<\/span><\/p>\n Zero Trust is forcing IT and security teams to understand that a neat \u2018domain\u2019 of tethered workstations is no longer a reality. Disparity of OSs (beyond Windows), and the fact that solutions like Microsoft\u2019s Active Directory is often not in play in modern organizations (especially within the SME), requires a very special set of technologies and management to secure access to the devices that are the gateway to accessing corporate resources (wherever those resources live…in the cloud or on-premise).<\/span><\/p>\n CEO, BitDam<\/a><\/b><\/p>\n The risk associated with phishing attacks will be the security executive’s top concern in 2020. A year ago, companies were all talking about malware. Phishing attacks are becoming more sophisticated and even professionals can’t detect all of them. There is a real need for technologies that can detect and block this kind of attack, especially when sent via email. The urgency to detect threats at first sight (from the moment they are released) and eliminating the time window which poses a high-risk level will rise.<\/span><\/p>\n The timeframe in which attacks have the most devastating impact on their victims is from the moment they are released and until they are detected by a security solution. Since it takes a few hours (or more) for even the most sophisticated security solution to detect a new never-before-seen attack, the risk within the first few hours is huge. Organizations and security professionals need to acknowledge this and are expected to see it as a key challenge.<\/span><\/p>\n Chief Security Scientist, Thycotic<\/a><\/strong><\/p>\n \u201cIn 2019, we saw more of the same \u2014 privileged accounts are still the No. 1 target of cybercriminals, making identity and access management the top issue in cybersecurity. One of the best practices for protecting organizations\u2019 data and systems has been the zero-trust model, using micro-segmentation to isolate data, deployments and workloads, and protect them individually. However, in 2020, we should see a progression to an adaptive trust approach to adjust protections as risk fluctuates \u2014 when risk is high, security increases and when risk is low, security decreases.<\/span><\/p>\n Unfortunately, cybercriminals are becoming more sophisticated. As they develop new strategies and employ new technology, such as Deepfakes, we will see a response from major governments. These governing organizations will work to pass new compliance regulations and ramp up financial penalties for companies\u2019 misuse of data. We can expect to see legislation expand to include more industries and to increase regulation over more kinds of data, such as biometrics. However, users and their organizations shouldn\u2019t wait for new compliance rules. It is critical for users to be cautious with what data they put online and their organizations need to secure the access these users obtain.\u201d<\/span><\/p>\n VP of Identity and Fraud & Risk Intelligence Products, RSA<\/a><\/strong><\/p>\n The promise and peril of a multi-authenticator world<\/i><\/b>. <\/b>Despite a growing number of options, there is still no one-size-fits all solution for the varying identity and access management needs across organizations and dynamic workforces. The industry will need more buyer support and guides to assist in the decision-making process\u2014ultimately helping organizations strike a balance between security and the user experience.<\/span><\/p>\n CTO, Abacus Group<\/a><\/strong><\/p>\n CTO, Menlo Security<\/a><\/strong><\/p>\n Blurred Lines: Corporate and Personal Identity Will Converge<\/i><\/b><\/p>\n With the rise of bring-your-own-device (BYOD) culture in the workplace and the access to personal accounts, corporate and personal identities have started to become one and the same. Context is a large part of redefining identity, with who you are being based on a number of factors rather than just a username and password. As we continue to shift toward using biometrics as a primary mode of authentication, even for work devices, those lines will continue to blur even further.<\/span><\/p>\n CEO, Evident ID<\/a><\/strong><\/p>\n Data breaches are growing larger and more frequent, due in part to the vulnerabilities of knowledge-based verification and multi-factor authentication with SMS and email. This will eventually lead to enterprises adopting better remote identity verification solutions for account recovery processes around issuing new credentials and resetting passwords. Businesses will begin to embrace technology-driven authentication methods like authenticator apps, passwordless logins, and biometrics to ensure their account holders are protected. <\/span><\/p>\n This change supports the zero-trust world in which we live in, where the presentation of credentials, like a password or token, will no longer be sufficient on their own to grant access to an account with any level of assurance, and where corroborated identity must be combined with authentication to ensure both safe access and reduced fraud.<\/span><\/p>\n Budget and time will continue to be spent on identity verification technology and processes to support compliance with privacy legislation, as governments put increasing emphasis on data security and privacy. While adapting to powerful regulations that require organizations to leverage stronger identity verification mechanisms that produce higher levels of assurance can be challenging, this will only become more necessary in a time where cybercriminals are becoming even savvier.<\/span><\/p>\n Biometric fraud will become more prominent than ever before, as seen with the rise of deep fakes, which are quickly becoming more lifelike and believable. As they advance, bad actors are using deep fakes for nefarious purposes, such as stealing sensitive data and spreading misinformation. As verification technology advances in 2020, so too will the dark technologies that can outsmart it, leaving the cybersecurity industry no choice but to be proactive with constant innovation.<\/span><\/p>\n CSO, Callsign<\/a><\/strong><\/p>\n In today\u2019s modern bank, fraud departments are tasked with identifying when fraud occurs and mitigating the incident. Their job is to simply <\/span>detect<\/span><\/i> the presence of fraudulent activity, rather than correctly <\/span>identify<\/span><\/i> account holders. But increasingly, privacy laws and other regulations like PSD2 in Europe are calling for organizations like banks to confirm identification, so security professionals have to look beyond the fraud solutions. In 2020, identification as we know it will become personal.<\/span><\/p>\n SVP of Product Management, MobileIron<\/a><\/strong><\/p>\n The smallpox of cybersecurity \u2013 passwords \u2013 will be eradicated by 2025.\u00a0<\/span><\/p>\n Passwords are ingrained in our society because they\u2019ve been around for over 60 years, but this doesn\u2019t mean it\u2019s the safest way to secure our digital lives. Passwords are not only a hassle \u2013 they\u2019re antiquated and open us up to even more cyber threats. Similar to how smallpox was eradicated, if we ban together, we can wipe out passwords and the onus is on the technology industry to drive security forward by eliminating them. Capabilities like zero sign-on, software and hardware tokens, behavioral analysis, and biometrics already exist that allow organizations to switch to passwordless authentication today.<\/span><\/p>\n IoT Marketing Manager, GlobalSign<\/a><\/b><\/p>\n Healthcare will continue to be a prime target for cyberattacks<\/span><\/p>\n The introduction of IoT connected healthcare devices, and the high value of private electronic medical record (EMR) information, creates a unique and attractive attack surface which makes it absolutely irresistible to hackers. Namely, it’s growing and it’s lucrative. Researchers and forecasters agree that the healthcare-related IoT will continue to experience rapid growth.<\/span><\/p>\n But more devices may lead way to more attacks. According to Health IT Security magazine, The majority of healthcare organizations, IoT manufacturers, and other organizations that leverage IoT devices have faced a cyberattack focused on IoT within the last 12 months. That includes businesses in Germany, the UK, the U.S., Japan, and China.<\/span><\/p>\n These attacks and their costs have everyone on high alert. Medical device manufacturers and health delivery organizations (HDOs) will be looking for ways to reduce the attack surface. They will find relief through traditional PKI-based identity platforms that provide unique device identities to authenticate users, devices, networks, and gateways. By building a network of identity and trust, manufacturers can then enable secure and connected communication.<\/span><\/p>\n Senior Vice President, Imperva<\/a><\/b><\/p>\n While IAM has a place in cybersecurity, since we all want to confirm one\u2019s identity, the fact is that most data breaches occur from a fully authorized user account, meaning, these breaches occur post-IAM. The repeated problem we see in enterprises today is the reliance on technology at the periphery of data with little scrutiny or controls on the data itself. IAM\u2019s gaps include malicious users, but more so careless and opportunistic users.<\/span><\/p>\n I predict that the trend of more enterprises recognizing the gaps that identity and general user tracking introduce will continue, as IAM and user tracking are common mainstays of cybersecurity. However, post-breach, the shift to models where user and data tracking intersect will continue to rise, as questions around data access continue to confound security teams.\u00a0<\/span><\/p>\n Post-breach questions like: “We know ‘John’ logged in, and we know it was \u2018John\u2019. Did he take any data? How much did he take? How did he take it? Where did it go?”<\/span><\/p>\n Knowing “John” logged in, and confirming it was John, does little to answer the questions regulators, business leaders, and law enforcement agencies ask.<\/span><\/p>\n President and Chief Security Officer, HighSide<\/a><\/b><\/p>\n Cloud services (IaaS, PaaS, SaaS) will make managing identities more and more important (and increasingly difficult without appropriate tools). Identity will be the last perimeter IT security teams can hope to have, and as has been proven with this year’s Capital One \/ AWS breach, even the best-resourced teams will have an occasional lapse in operational implementation of identity policies and controls.<\/span><\/p>\n Co-Founder and CTO, Silverfort<\/a><\/b><\/p>\n As enterprises are moving to the cloud, cloud-based authentication and IAM solutions will be needed to ensure secure access to migrated systems. We will also see wider adoption of identity-based zero trust solutions as securing access of anything-to-anything becomes a priority, within internal corporate networks and across corporate cloud environments.<\/span><\/p>\n VP of Marketing, ID R&D<\/a><\/strong><\/p>\n We’re getting close to finally achieving the strong authentication necessary for the complex digital identities of today.<\/span> The industry is moving, rightly, away from using solely knowledge-based or device-based authentication, and toward a combination of methods that are not only independent of each other, but that also “positively identify” users. That is to say, all organizations are moving toward recognizing that a user, Jane Doe, is actually logging in vs. recognizing that someone with Jane Doe’s credentials is logging in. Shifting authentication to being identity-focused, instead of access-focused, is better for everybody.<\/span><\/p>\n As fraudsters increasingly use AI to breach users’ digital identity, collaboration across the industry will become even more important. Efforts like the<\/span> DeepFake Detection Challenge<\/span><\/a>, a project that’s attracted Facebook, Amazon, and Microsoft as well as tech startups and university teams, or global challenges like<\/span> ASVspoof<\/span><\/a>, exemplify the kind of industry cooperation that will best prepare all of us for the future of protecting digital identity.<\/span><\/p>\n Today’s consumers expect their interactions with brands will be both fast and easy. Security is the point of friction that often leaves customers feeling frustrated, or worse, leads them to abandonment. Savvy businesses realize that authentication isn’t just a security issue, but also a customer experience imperative and are looking at solutions that can deliver on both points.<\/span><\/p>\n Chief Fraud Prevention Officer, Nuance Communications<\/a><\/b><\/p>\n As consumers react to the growing number of data breaches and demand better protection from the companies with whom they do business, they will also start to take matters into their own hands.<\/span><\/p>\n While using multi-factor authentication for all accounts (whether a mobile app, website, call center or other customer service channel) for secure authentication has long been a best practice, consumers will begin using a password in conjunction with another authentication technique to help protect their data and devices when available. <\/span><\/p>\n This means opting for biometrics\u2014such as voice recognition, fingerprint, face scanning, etc.\u2014when it is available. Facial recognition and fingerprint ID on smartphones and other devices have paved the way for making consumers comfortable and accustomed to biometric identification. Biometrics\u2014from voice to behavior and other forms of biometrics technologies\u2014are a natural extension, and convenient for companies to adopt because they don\u2019t have to redesign physical systems or devices.<\/span><\/p>\n CEO, Identity Automation<\/a><\/strong><\/p>\n A \u201cjust in time\u201d approach to access will expand beyond the traditional scope of privileged access as organizations look for ways to get more granular with access controls and eliminate unnecessary standing access.<\/span><\/p>\n Identity will become the new perimeter, as traditional security boundaries have expanded to incorporate a plethora of user types, endpoint devices, and internal and external resources. Ensuring security will come down to effectively managing user identities and the access they are granted.<\/span><\/p>\n The Bring Your Own Identity or BYOI will transition from trend to common practice, shaking-up existing approaches to identity and access management. Instead of creating a new digital identity, more and more users will opt for the convenience of simply selecting to use an existing identity, such as Google, Facebook, or Apple to access digital services.<\/span><\/p>\n Chief Security Officer, Keyfactor<\/a><\/b><\/p>\n Connectivity will continue to drive security identity and access management challenges, like breaches and systems outages in 2020. Companies have long looked at identity within their organization as an individual or a person, but it’s so much more than that, spanning devices and applications. The massive rise in the number of these connected identities and the juggling act required to manage the risk they introduce has created an exposure epidemic at the enterprise level. Expect to see enterprise IT teams embrace IAM orchestration tools that will help them streamline and automate manual identity management processes and have the ability to plug into their security management tools.<\/span><\/p>\n\n
\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/02\/IM_VM_SB_800.jpg\" "\\"IAM")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\nExperts Share Their Predictions for Identity Management in 2020<\/strong><\/h2>\n
Michael Covington<\/b><\/h3>\n
Greg Keller <\/b><\/h3>\n
IAM Technologies will continue to converge<\/b><\/h4>\n
Zero Trust is forcing a rethink in least privileged approaches to resource access<\/b><\/h4>\n
The richness of user identity information stored will trigger key IAM processes<\/b><\/h4>\n
The device matters deeply in the relationship to IAM<\/b><\/h4>\n
Liron Barak<\/b><\/h3>\n
Joseph Carson<\/strong><\/h3>\n
Jim Ducharme<\/strong><\/h3>\n
Paul Ponzeka<\/strong><\/h3>\n
\n
Kowsik Guruswamy<\/b><\/h3>\n
David Thomas<\/strong><\/h3>\n
Ian Cruxton<\/strong><\/h3>\n
Brian Foster<\/strong><\/h3>\n
Diane Vautier<\/b><\/h3>\n
Terry Ray<\/b><\/h3>\n
Aaron Turner<\/b><\/h3>\n
Yaron Kassner, Ph.D.<\/b><\/h3>\n
Kim Martin<\/strong><\/h3>\n
Simon Marchand<\/b><\/h3>\n
James Litton<\/strong><\/h3>\n
Chris Hickman<\/b><\/h3>\n
Gerald Beuchelt<\/strong><\/h3>\n