Policy Based Access Management

Graham Williamson

Martin Kuppinger

Description

Short Summary

Interesting Facts

Notable Quotes

Recommendations

Takeaways

Efficient, effective management of access controls from infrastructure to applications remains an aspiration for enterprises. The main drivers of this goal include the need for strengthening the cybersecurity posture, efficiency gains in managing access controls, the need for consistency in access controls across multiple solutions and layers, and regulatory compliance. Most organizations today struggle with a mixture of point solutions for managing access controls, many of these relying on static entitlements causing massive work and tending to become inaccurate. A consistent, policy-based solution for managing access controls ensures that the right people have the right access, at the right time, from the right place. This Leadership Compass features vendors offering policy-based access control solutions and provides guidance on aligning a vendor’s solution to common corporate access control requirements.

The "Leadership Compass" report provides an in-depth examination of Policy-Based Access Management (PBAM) solutions, which are utilized for defining and enforcing access entitlements based on policies. PBAM’s advantage lies in dynamic, real-time updating of entitlements to match the rapid changes typical of agile and DevOps environments. The report contrasts PBAM with Attribute-Based Access Control (ABAC) and Role-Based Access Control (RBAC), highlighting the blurring lines among them due to dynamic role memberships. PBAM’s flexibility makes it better suited for modern applications, microservices, and cloud environments, where static entitlements become difficult to manage. PBAM also covers both authentication and authorization, requiring scalable solutions to avoid bottlenecks. Organizations are encouraged to develop a PBAM strategy and blueprint that addresses current and future use cases, along with high-level and lower-level policies.

The market for PBAM is diverse, with vendors offering solutions for various use cases, including policy management and governance, API access control, cloud infrastructure security, business-level PBAM, application-level PBAM, and Zero Trust frameworks. Leading vendors in the market include AWS, Ping Identity, PlainID, NextLabs, and Strata Identity, among others, with distinctions made between overall leaders, product leaders, and innovation leaders.

Cloud-native PBAM approaches, such as the Open Policy Agent (OPA), facilitate container-based deployments with service-level policies that support dynamic, real-time authorization decisions. The report also traces the historical evolution of PBAM, from mainframe environments to contemporary cloud-native implementations, and highlights ongoing innovations and challenges in integrating legacy systems.

Evaluation criteria for PBAM solutions include policy decisions, policy enforcement, policy administration, information point support, hybrid cloud, cloud-native, governance, and SOC/SIEM support. Vendors are assessed based on security, functionality, deployment, interoperability, and usability. The report concludes with an overview of leading products and vendors, providing comparative ratings and recommendations for each.