One of the emerging topics in the broader IAM space integrates GRC and Identity Management: Identity Risk Management, including aspects like Identity Risk Metrics. Identity Risk Metrics are used to measure specific aspects of Identity Management. These metrics can be mapped to risks and thus serve as a means to detect and, in the next step, reduce risks. Such metrics can be defined in many areas.
May be the most interesting are Application Risk Metrics – in the context of digital identities. Elements of this category are things like
- Usage of central identity stores (instead of application specific identity stores)
- Sensitive attributes in decentralized identity stores
- Sensitivity of the application and its data
- Supported authentication mechanisms and their strength
- Number of user accounts
- Encrypted storage of passwords
- and many others…
Measuring these Metrics can clearly lead in more management support for building application security infrastructures and changing the way security is implemented in applications. It is not very difficult to do this sort of analysis. It doesn’t need a specific Risk Management software, it is just about identifying the applications (which is the hardest part) and counting – and may be some analysis in Excel. And it is about mapping the result to defined risks and to provide an answer on the question of “how to reduce the risk”. The answer is quite obvious – it is the approach of application security infrastructures.
And that is just one example of what you can do with Identity Risk Metrics.