IBM Security Access Manager (ISAM)

Identity and Access Management (IAM) has shifted from perimeter-bound, on‑premises, monolithic systems toward federated, hybrid, and context-aware access controls. Early IAM focused on centralized identity storage and local authentication/authorization with auditing. Federation expanded identity’s reach by enabling secure user-information exchange across internal divisions and between organizations, while Single Sign-On (SSO) let users authenticate once across many systems. As password-only authentication proved too weak for sensitive access, organizations adopted multi-factor approaches; Two-Factor Authentication (2FA) now meets most organizations’ Level of Assurance (LoA) requirements.

Modern access control must evolve with changing cyber-attacks, increasingly using data analytics and machine intelligence to detect abnormal patterns and enforce policy-driven responses. Risk-based access control adds context—location, device, behavior, activity, and session signals—to dynamically adjust authorization, including step-up authentication or blocking. Mobility and device diversity (smartphones through IoT) plus external user access have become standard, spanning BYOD, corporate-owned devices (COD), and corporate-owned personally enabled (COPE) models. At the same time, enterprises operate in persistent hybrid IT environments across on‑premises and cloud, requiring IAM capabilities that bridge both.

IBM Security Access Manager (ISAM) is positioned as a modern web and mobile IAM platform with cloud extensions. It provides strong authentication options (including OTP, biometrics, FIDO U2F), risk-based access controls with a self-learning attribute store and risk scoring, and broad federation support (SAML, OIDC) built on a reverse proxy that also includes web application firewall capabilities. IBM Cloud Identity (ICI) extends SSO/MFA/governance to cloud use cases and can integrate with ISAM through multiple bridging roles. ISAM supports mobile MFA via IBM Verify, integrates with analytics tools like QRadar, and offers wide deployment choices plus DevOps automation via REST APIs and publicly available tooling.

• Two-Factor Authentication (2FA) provides the Level of Assurance (LoA) for most organizations’ authentication needs.
• ISAM supports authentication methods including usernames/passwords, knowledge-based questions, certificates, hardware/software/email/SMS OTP, FIDO U2F, QR codes, and fingerprint biometrics.
• ISAM integrates third-party authentication providers via IBM’s Security App Exchange.
• WebAuthN support is included on IBM’s authenticator roadmap, based on a W3C specification with FIDO Alliance input.
• ISAM’s risk-scoring can use inputs such as IP address, geo-location, device ID/fingerprint, time of day/week, and user/session attributes.
• ISAM can integrate with IBM QRadar for user behavior analytics to obtain a risk score.
• ISAM supports federation approaches including SAML and OIDC, and originated as a reverse proxy enabling SSO.
• ISAM’s reverse proxy includes built-in web application firewall capability.
• ISAM can be deployed on platforms including physical appliances, VMware, KVM, XenServer, AWS, Hyper‑V, Azure, Red Hat Enterprise Virtualization, and Docker/Kubernetes.
• ISAM has been in the market for nearly 20 years.

• “Federation extended the reach of where identity and access controls reside and allowed for the secure exchange of user information…”
• “Single Sign-On (SSO) systems gave users the ability to authenticate once across multiple IT systems and applications.”
• “Machine intelligence gives the ability to make access decisions that can be acted upon based on the patterns and trends found through data analytics.”
• “Together, these technologies become tools to recognize abnormal user patterns that can be acted upon based on access policies.”
• “Risk-based capabilities are being added to give access controls the ability to make access policy decisions based on the level of risk… making it more context-aware.”
• “The management of user identity and access must evolve into services that can address this new hybrid IT reality.”
• “ISAM improves security access controls through the use of risk-based authentication.”
• “Depending on the definition of the risk-based access policy, users that exceed the risk threshold can be challenged with step-up authentication or blocked entirely.”
• “ISAM provides an automation framework, publicly available on GitHub, to help accelerate the deployment process by running reproducible configurations…”
• “Although the appliance type of deployment model provides for an easier installation, configuration and maintenance can still be complex”