Future of Identity Management

Short Summary

Digital transformation is driving a shift to “everything as a service,” making cloud delivery the dominant model for IT capabilities, including Identity Management and Digital Identity. Identity Management is expanding from traditional employee-focused scenarios (B2E) to include partners (B2P), business relationships (B2B), customers/consumers (B2C), and non-human identities such as software services and IoT/IIoT devices. As work and collaboration become more distributed and mobile, the corporate network perimeter loses relevance and identity becomes a primary security perimeter. Organizations must therefore manage a growing volume and diversity of identities while simultaneously meeting security and privacy obligations, enabling business growth, reducing friction in user interactions, and supporting personalization.

To avoid hybrid complexity and enable runtime access decisions, Identity Management is expected to move to cloud-based services and more service-oriented, API-driven architectures. This includes shifting emphasis from static, deployment-time governance to dynamic, policy-based and context-aware controls, supported by adaptive authentication and authorization. Key challenges include verifying trustworthiness of external identities (especially B2C/B2P), balancing ease of use with privacy/security, reconciling personalization with regulatory compliance, controlling access capability costs, keeping entitlements current, mitigating privileged access exploitation, and handling heterogeneous environments with legacy systems.

Artificial intelligence is positioned as a major enabler for future Identity Management through behavior analytics, anomaly detection, real-time risk scoring, and automated responses that reduce friction by escalating authentication only when needed. A central proposed architectural outcome is an “Identity Fabric”: a converged, loosely coupled identity backend delivering identity services as a utility via secure APIs. This supports bimodal migration, allowing new digital services to consume scalable identity services immediately while legacy systems transition gradually without creating identity silos.

Interesting Facts

• Identity Management now spans employees, partners, customers/consumers, and non-human identities such as services and IoT devices.
• The traditional network perimeter is becoming less meaningful as cloud services and mobile access increase.
• CIAM products and services have emerged to help businesses manage consumer identities.
• The Ukrainian power grid experienced cyber attacks in December 2015.
• Norsk Hydro suffered a ransomware attack in March 2019 that affected both IT and OT systems and impacted aluminum production.
• Self-service consumer registration commonly occurs without identity verification.
• Future IAM capabilities are expected to include adaptive authentication, auditing, federation, and dynamic authorization.
• OAuth 2.0 and OpenID Connect are cited as open standards relevant for dynamic authorization and federation.
• Privileged entitlements are often assigned to software/system accounts and sometimes to administrative roles or named accounts.
• Identity API platforms are described as delivering services such as directory services, identity lifecycle management, access management, and access governance.

Notable Quotes

• “Essentially, the success of Digital Transformation depends on an ability to manage the access of everyone and everything to every digital service.”
• “Identity Management will inevitably move to the cloud”
• “Identity is becoming one of the new, essential security perimeters”
• “Plan for identity services backed by a converged identity backend infrastructure”
• “Identity is at the core of Digital Transformation”
• “Managing identities has never been more important as a means of blocking disruptive cyber attacks”
• “Identity Management key to unlocking personal data while protecting privacy”
• “Centralized Identity Management will enable consistent approach across all services and channels”
• “Simplify authorization Management with centralized access policies”
• “Future Identity Management will see shift to API-based approach”