Identity Access Governance Consulting

Identity Access Governance (IAG) refers to processes that enable organizations to monitor and to ensure that identities and security rights are managed correctly, effectively and securely. IAG includes all related business, technical, legal and regulatory issues.

We comprehensively address the following topics:

• Identity and Access Governance
• Identity Management
• Access Management
• Privileged Access Management

We approach the development of strategies and solutions while taking into account applicable security requirements, user convenience and cost-effectiveness.

We use tried and tested best practices and standards to support you in establishing up-to-date and future-proof IAG strategies and solutions. For an efficient customized approach, we draw on proven methods such as risk analysis, protection needs analysis and data protection analysis as well as the consideration of cloud approaches.

After completing a comprehensive analysis, together with you, we develop and establish new standards or optimize existing solutions (Best of Breed), helping you align your digital infrastructure for the needs of the future while complying with regulatory requirements.

Our service is structured according to an integrated approach that follows the applicable compliance requirements. Our solutions are available as individual modules and are roughly divided into three phases:

• Analysis
• Planning
• Implementation

In our approach, we follow the fundamental principles of Identity Access Governance. To promote resilience and make your IAG solution as future-proof as possible, we work in an interdisciplinary manner. We integrate the results from risk analysis, protection needs analysis and data protection analysis (GRC, GDPR) or use cloud models.

Access Governance is comprised of three principles:

Principle of Least Privilege (PoLP)

The Principle of Least Privilege is an information security concept where user access rights are restricted to a minimum. Users can access only those applications and resources that are essential to their work.

Principle of Need to Know (PoNtK)

Even if a person generally has access to data or information at this security level, the Need-to-Know principle prohibits access if the information is not directly needed by that person to perform a specific task. For governance, a distinction is made between the Discretionary Access Control model and the Mandatory Access Control model.

Principle of Segregation of Duties (PoSoD)

The Segregation-of-Duties principle describes the separation of functions in the area of user authorization management. Different technical duties are assigned to different roles.

Authentication is the verification of a person’s identity. This can be done using passwords, tokens, biometrics (e.g., fingerprint) or similar methods.

Authentication validation is the validation of the asserted authentication. It is performed by an access manager.

If the authentication validation of a person was successful, it will be determined whether the person is allowed to receive the requested information. Authorization is given by Access Management, oAuth2, or by the application itself.

Identity and Access Management (IAM) is the technology component of IAG for managing user identities and their access privileges for various systems and platforms.

Identity Management (IdM) maps the processes within an organization that relate to the management and maintenance of digital identities within the network, including the authorization management for applications, data and systems.

Access Management (AM) is the process of identifying, tracking, controlling, and managing the access of authorized or specified users to a system, application, or IT instance. It is a broad concept that includes all policies, processes, methods, and tools for maintaining access privileges within an IT environment.

Typically, AM is used in conjunction with IdM. Identity Management creates, deploys and controls various users, roles, groups and policies, while AM ensures that these roles and policies are being implemented and followed.