IBM Security Identity Governance and Intelligence

Identity & Access Management (IAM) has become a core element of enterprise IT security because it governs identities, accounts, passwords, and access entitlements across many systems and applications. Several shifts have weakened the traditional network perimeter, including mobile access, integration of partners and customers into processes, and the move to cloud applications. At the same time, the value of digital assets and intellectual property has grown, and initiatives such as connected devices and smart manufacturing turn these assets into “crown jewels,” even in traditional industries. In increasingly hybrid and complex environments facing more attacks, organizations must reduce risk by understanding threats and implementing practical countermeasures.

Done well, IAM reduces the attack surface by enabling least privilege, automating identity lifecycle processes, and supporting regular entitlement reviews to detect excessive access. IAM also enables business execution by streamlining onboarding and change workflows for employees, contractors, partners, and customers, while ensuring timely revocation and deactivation when access is no longer required.

Core IAM is frequently framed as Identity Governance and Administration (IGA), comprising Identity Provisioning and Access Governance. Provisioning automates account creation and entitlement assignment; Access Governance adds analysis, review/recertification, access request workflows, and governance mechanisms such as Segregation of Duties (SoD) controls and access intelligence. IBM’s IGA offerings include IBM Security Identity Manager (ISIM) and IBM Security Identity Governance and Intelligence (ISIGI), the latter originating from CrossIdeas. ISIGI provides lifecycle management, activity-based modeling for SoD and access controls, certification workflows, extensive role management and mining, auditing, and leading-edge access risk analytics. It is positioned as a leading IGA solution, particularly notable for deep SAP SoD capabilities within heterogeneous environments, with the main challenge being that its business-driven activity model requires strong business alignment to succeed.

• IAM manages user accounts and access entitlements across a variety of organizational systems and applications.
• Mobile access, partner/customer integration, and cloud application adoption have reduced the relevance of the traditional network perimeter.
• Identity Governance and Administration (IGA) consists of Identity Provisioning and Access Governance.
• Identity Provisioning automates creating and managing accounts and high-level entitlements across systems and applications.
• Access Governance supports entitlement analysis, access reviews/recertification, and access request workflows.
• IBM’s IGA-related products include IBM Security Identity Manager (ISIM) and IBM Security Identity Governance and Intelligence (ISIGI).
• ISIGI originated from IBM’s acquisition of the Italian vendor CrossIdeas and has been fully integrated into IBM’s portfolio.
• ISIGI includes connectors and integrations for SAP environments, Java, LDAP, and Microsoft Active Directory.
• ISIGI ships with industry-specific business activity trees defined by the American Productivity & Quality Center (APQC).
• ISIGI supports fine-grained SoD analysis in SAP down to transactions and authorization objects.

• “IAM done right ensures that identities, their user accounts and passwords, and their access entitlements are well-managed.”
• “IAM thus reduces the attack surface by helping organizations move towards the principle of ‘least privilege’.”
• “On the other hand, IAM also plays a vital role for business enablement…”
• “Creating that interface well, from the definition to the ongoing management and review of entitlements, is challenging.”
• “Access Intelligence has become an essential part of Access Governance.”
• “Enabling and protecting the Digital Transformation requires IGA.”
• “A unique feature of the tool in the Access Governance market is its activity-based approach to modeling access controls, SoD rules, and so on.”
• “Thus, the approach supports a business-aligned, agile model for describing and implementing the access control needs of the business.”
• “From the KuppingerCole perspective, no other vendor in the Access Governance market has a comparable model at that level of maturity.”
• “In sum, IBM Security Identity Governance and Intelligence is a product that is worth evaluating when looking for a well-thought-out approach to Access Governance that works for both business and IT.”