Simeio IAM for SMB

Digital identity is a business enabler for SMBs but also a primary attack vector, and many SMBs lack the staff and expertise to deploy, maintain, and secure IAM effectively. Weak or poorly maintained IAM increases risks such as productivity loss from password resets and incorrect entitlements, exposure of employee and customer PII, theft of trade secrets, revenue loss due to fraud and reputation damage, and even becoming an attack pathway within a supply chain. Despite a common assumption among SMB leaders that they are “too small” to be targeted, cybercrime studies indicate SMBs are increasingly attacked because they are perceived as less secure.

SMBs face varied IAM needs: B2E is universal, B2B is common, and B2C is relevant for some. Many have Active Directory and a growing set of SaaS applications, yet lack centralized IAM and SSO capabilities. IAM can also support regulatory compliance, including GDPR consent requirements, CCPA consumer interfaces to control sale of private information (effective January 2020), and controls like segregation of duties and access certification relevant to SOX.

IDaaS adoption is growing due to cloud and identity standards. The main IDaaS function categories are identity administration (lifecycle, provisioning, entitlements, self-service, connectors, standards like SPML/SCIM), access management (authentication, authorization, SSO, federation using SAML/OAuth/OIDC, with API security and social login becoming important), and access governance (often missing in IDaaS, but increasingly moved to cloud for faster integration and time-to-value).

Simeio Solutions offers “IAM for SMB,” a cloud-delivered service spanning all three categories with strong mobile-first administration. It supports workflows tailored to owner/manager behavior, invitation-based onboarding, bulk import and REST APIs, biometric mobile authentication, standards-based federation to major SaaS apps, SIEM export (e.g., Splunk), dashboards, and governance reviews. Strengths include usability and security certifications; challenges include limited authenticators and relatively few pre-built connectors, with planned enhancements from Simeio’s enterprise edition.

• Poorly maintained IAM can cause productivity loss through password resets and incorrect entitlements.
• Weak IAM can lead to loss of employee and customer PII.
• Trade secrets and other valuable business information can be lost due to IAM-related security failures.
• SMBs can become an attack vector to other members of a supply chain.
• GDPR requires clear and unambiguous consent for use of consumer data.
• The California Consumer Privacy Act takes effect in January 2020.
• IAM for SMB uses Secure Enclave on iOS and Secure Elements for Android.
• Simeio’s service holds SOC 2, ISO 27001, ISO 27018, and CSA Star certifications.
• As of early 2019, Simeio manages more than 150 million user identities.
• IAM for SMB supports identity federation via SAML, OAuth, and OpenID Connect.

• “Digital identity is a critical business-enabling technology for Small to Mid-Size Businesses (SMBs).”
• “Digital identity is also a primary vector through which SMBs are attacked.”
• “Many SMBs lack a fully staffed IT department to handle the complexities of deploying, maintaining, and securing IAM solutions.”
• “Many managers and owners within SMBs naively assume that they are too small to be attacked by malicious actors”
• “A sometimes-overlooked capability is that IAM systems can aid in regulatory compliance.”
• “There are three major categories of functions provided by IDaaS vendors”
• “IAM for SMB is a workflow-oriented service.”
• “Simeio designed the service to fit in with how managers and/or owners of small-to-medium sized businesses actually work.”
• “For these types of customers, IAM management is not a day-to-day activity, but rather one that takes place only as needed.”
• “Simeio’s IAM for SMB service abstracts and removes the complexity of IAM administration that SMBs would otherwise face.”