Consumer Identity & Access Management Market & Technology Overview

Based on best selling Amazon book.

• What is CIAM?

• CIAM Market Overview

• CIAM Life Cycle

• Requirements and Solution Design

• Implementation Standards Review

• Vendor Selection Guidance

• Measuring Success

Over 11 hours of content, videos and quizzes. Includes a PDF copy of CIAM Design Fundamentals.

Enrol with 25% Off

Authentication Design & Management

Learn how to design, build and assess secure and usable login experiences for B2E, B2C and IoT based ecosystems.

• Authentication Types

• Authentication Life Cycle

• Standards Overview

• Non-Person Entity

• Deployment Design and Metrics

Over 7 hours of content, videos and quizzes.

Enrol with 25% Off

• The identity runtime is the live execution environment for identity

• Identities (be there human, non-human or agentic) perform actions and access services, APIs and data

• To do this they need an identifier, attributes, permissions (which we can classify as identity data)

• During usage they will authenticate, be authorized and monitored

• Each of those stages has numerous sub-stages such as credential life cycle management, just in time access request, behaviour monitoring and so on

• This is becoming increasingly important as identity risk is occurring during usage, where as traditional controls have focused on profile storage and authentication

• Core components of the identity runtime include:

  • credentials

  • session management

  • policy design

  • policy decisions

  • policy enforcement

  • behaviour monitoring

Read more

Takeaway Points:

• Agentic identity generates new risk for the enterprise

• Existing IAM tools and frameworks are not built for the agentic-era

• We need to consider 6 core control areas:

  • Discovery and visibility

  • Ownership and life cycle

  • Identity data security

  • Runtime access controls

  • Guardrails and behaviour boundaries

  • Observability and intent management

• Let’s cover these 6 areas in more detail below

Read more

Takeaway Points:

Section 1 Why this matters now

AI agents are not just passive workloads. They can:

• receive instructions, make decisions, call tools, query data, interact with users and likely other agents

This generates new security questions:

• which agent is acting?, who owns it?, what is it allowed to do?, what is it actually doing right now?, and does that behaviour still align with the intended outcome?

Section 2 What is agentic identity?

• An agentic identity is an identity assigned to an AI-driven software entity that can act with some level of autonomy, using credentials, permissions and tools to achieve tasks on behalf of a person, team or business process.

Read more

Takeaway Points:

• Just-in-Time (JIT) access is a modern approach to access management

• The idea being access is granted to a resource only when it is explicitly needed - and only for the specific duration required.

• That “time” aspect could be explicit - with access given for 10 minutes, or more contextual. For example access is linked to a service ticket and is granted until the ticket is closed.

• Key aspects of JIT access:

  • Principle: It allows identities to request access only when needed and only for as long as needed.

  • Goal: It is critical for minimizing the identity attack surface and enforcing a least-privilege principle.

  • Context: It is part of a strategic shift toward an Identity-Native, API-first model to secure high risk systems, modern production infrastructure and modern privileged access management (PAM) systems.

• This concept is often paired with Zero Standing Privileges (ZSP)

• ZSP relates to accounts having no permanent access rights - no existing provisioning exists.

• Key aspects of ZSP:

  • Core Principle: It means that a user, machine, or service has no permanent user access permissions to a resource.

  • Mechanism: When access is needed, it is dynamically granted using a “Just-in-Time” (JIT) approach, which provides access only for the specific task and time required.

  • Benefit: The implementation of ZSP holds promise to reduce risk by significantly minimizing the identity attack surface. In essence, adversaries cannot exploit standing privileges if those privileges do not exist in a permanent state.

• How to implement? This depends on whether existing or new accounts and permissions are under analysis.

• Essentially some key concepts need to be considered:

  • inventory creation of accounts and permissions

  • identify and analysis risk

  • automated removal of unused access

  • access request functions for gaining access via policy

  • manage approvals and removal post usage

Takeaway Points:

• NIST Special Publication 800-207 is a good starting point for understanding the core concepts and design patterns

• The core principles from NIST include:

  • No implicit trust based on network location (e.g., being inside a corporate firewall).

  • Continuous authentication and authorization based on dynamic risk/context.

  • Least privilege access is enforced per request, not per session.

  • Strong identity verification for users and non-human entities.

  • Access policies are enforced at the application, data, and service level.

  • Assume breach: Monitor, log, and analyze for abnormal behavior.

• “Identity as the New Perimeter” sees both design and budget move from network and point security, to a focus upon information flows and identity journeys

• This places greater emphasis on identity verification and validation of on-boarding data as well a focus on continuous authentication and how authorization enforcement is designed

• Continuous authentication is difficult and many start on the strong authentication journey first - perhaps with native biometry and passkeys, with things like behaviour monitoring and device usage being used as a proxy for the continuous aspect

• We see a need to focus upon per-request design making - so we need to have a strong approach for attribution as well as scaleable and distributed access enforcement - the typical PEP approach

• To that end we see PBAC being a common concept, externalising access logic into a centrally managed model with the addition of context

• Other more lightweight ideals come into play too - such as just in time access and zero standing privileges

• Getting to these concepts is a strategic initiative and will require improves to access removal for existing users as well as more contextual and dynamic ways of assigning access for both standard and privileged access requests

• The NIST guidelines were written before the proliferation of NHI and Agentic-AI systems were as popular as they are today

• So the same principles need to be applied to more identity types - often requiring specialist tools and platforms

Takeaway Points:

• SPIFFE stands, the Secure Production Identity Framework For Everyone with a dedicated site and is part of the Cloud Native Computing Foundation

• It’a a framework to identify and secure communications between application services

• Described as a “universal control plane” for distributed systems, it comes with a corresponding deployment pattern and tool-set called SPIRE

• With the rise of diversified application development, individual APIs and service building blocks are often built in different frameworks, with different languages and deployed in different locations. SPIFFE can be the glue to provide a level of identity control

• The concept is to provide naming and a framework for authentication that moves away from statically assigned credentials and shared secrets

• There is also quite a strong focus on federation or at least boundary traversal

• A SPIFFE identifier is basically a URI with a SPIFFE prefix, that indicates a service. For example SPIFFE://radar.thecyberhut.com/headlines/latest.

• But of course we need to then bind that identifier to something - and consistently verify that, which is the authentication angle which is done using something called an SVID - SPIFFE Verified Identify Document - a signed artefact that supports a possession auth factor

• But how to define and issue SVIDs? A mechanism called attestation is used to analyse and understand process level characteristics that are not self asserted - which essentially allows for a secret-less bootstrapping process

• SPIRE is away to make this “magic” happen with agent and server components

• An agent interacts with the server which acts as a signing authority for that trust domain

• The agent represents the “workload” or service and interacts with the server to get SVIDs and provide attested process information

• The SVID is typically an x509 cert - which can be used for authentication and can be rotated when necessary

• Useful links:

  • Walk through of SPIRE concepts

  • SPIRE case studies and use case cases

Arrange Training

Takeaway Points:

• Relatively new definition appearing regularly in the last 3 years

• Definition is not standardised and many vendors describe it in different ways

• What is the problem being solved?

• IAM infrastructure becoming regular adversarial target - why?

• IAM components often isolated, poorly integrated and create trust and visibility blind spots

• IAM components - including relying systems spread across different deployment locations - on-prem, private cloud, containers, virtual, cloud service providers, SaaS

• Introduces disconnected detection, protection and response issues

• ITDR aims to provide overlay technology to protect end to end life cycle of identities

• I in ITDR: all IAM components, data and activity analysis, multiple identity types including customers, workforce and non-human/workloads

• T in ITDR: threat analysis, external intelligence, vulnerability analysis of data and static components, threat informed defence, risk based approach to modelling

• D in ITDR: rule and behaviour based detection of issues, misconfiguration and posture, abnormal activity

• R in ITDR: semi-automated and automated response, chatops integration, alteration of in-flight access and long term policy

Arrange Training

Introduction

Simon Moffatt's "Consumer Identity & Access Management: Design Fundamentals" explains the essential concepts of CIAM (Consumer Identity and Access Management), highlighting its differences from IAM (Identity and Access Management). It explores the evolution of identity management, discussing the shift from employee-centric systems to a consumer-focused approach.

The text also delves into key CIAM requirements, emphasizing the importance of user experience, security, privacy, and compliance. It provides a detailed overview of the CIAM lifecycle, including onboarding, proofing, secure login, device binding, contextual and adaptive access, profile management, consent management, data management, and account removal.

Furthermore, the document presents a technical toolbox for CIAM implementers, outlining key cryptographic concepts, standards, and libraries, such as OAuth2, REST, and FIDO2. It concludes with considerations for vendor selection, KPI (Key Performance Indicator) development, and metrics related to data breach prevention, stressing the importance of aligning CIAM initiatives with business objectives.

Audiocast Interview

The following is a NotebookLM generated conversation discussing the book and the role of B2C identity.

Read more