Hitachi ID IAM Suite

Digital identity is a dominant attack vector in major breaches, with attackers typically compromising user passwords first and then moving laterally to take over administrative or service accounts to exploit elevated privileges. Despite modern alternatives, passwords remain widely used across user, shared, administrative, and service accounts, making secure password handling and privileged access management (PAM) critical. Regulatory pressure also accelerates adoption of stronger controls, including incident reporting requirements for critical infrastructure in Germany and segregation of duties mandates in the US.

Traditional IAM focuses on provisioning, authentication, authorization, directories, SSO/WAM, federation, and governance, historically serving a single enterprise but increasingly extending to partners, suppliers, and customers via federations. Hybrid and multi-cloud needs drive API-based IAM capabilities to enable orchestration across environments and DevOps automation.

Hitachi ID Systems (founded 1992; acquired by Hitachi in 2008) offers an integrated IAM Suite: Identity Manager, Password Manager, and Privileged Access Manager. Identity Manager handles identity and entitlement lifecycles at scale (millions of identities), including group lifecycle management, workflows for approvals/audit/SoD (including nested entitlements), analytics for role optimization and orphan account remediation, and cluster-based role discovery. It supports extensive integrations via connectors and standards (e.g., SCIM/SPML), plus mobile access through a cloud proxy that avoids exposing on-premises systems publicly.

Password Manager provides password synchronization, self-service resets (including pre-boot scenarios), telephone-based resets with optional voice biometrics, enrollment workflows, credential and token/certificate management, and SAML-based federated access with MFA.

Privileged Access Manager secures privileged credentials in an encrypted vault, supports rotation and API-based password retrieval with application fingerprinting, offers multiple privileged access methods (disclosure, injection, proxies, elevation, command execution), automates endpoint onboarding, records sessions with enforcement, and integrates with ticketing and SIEM. Deployment supports on-prem, IaaS, or managed AWS SaaS with replicated, highly available architectures; strengths include integration depth and self-service cost reduction, while challenges include limited market visibility and no out-of-the-box FIDO/OIDC.

• Digital identity was a primary attack vector in nearly all headline-grabbing data breaches of the last few years.
• Attackers commonly compromise user passwords and then seek administrative or service accounts to exploit elevated privileges.
• Germany’s IT-Sicherheitsgesetz requires critical infrastructure operators to strengthen security posture and report incidents to the government.
• US federal laws such as Sarbanes-Oxley mandate segregation of duties.
• Hitachi ID Systems was founded as M-Tech in 1992 in Calgary, Canada, released P-Synch in 1995, and was acquired by Hitachi in 2008.
• Hitachi ID has over 1,200 customers worldwide serving more than 14 million users.
• Hitachi ID Identity Manager includes 120 connectors spanning systems such as RACF, iSeries, Exchange/Office 365, and SAP ECC.
• Hitachi ID IAM Suite ships with over 200 connectors for directories, systems, and applications.
• HiPAM uses an AES-encrypted vault and applies a random 128-bit salt prior to encryption.
• Typical customer deployments use 2 to 5 replicated application servers spanning at least two data centers and at least two metro areas.

• “Passwords remain an all-too-common authentication method for getting access to a user, group, shared, administrative, and service accounts even today.”
• “Managing passwords securely has never been more important.”
• “IAM systems are designed to provision, authenticate, authorize, and store information about users.”
• “By exposing key IAM functionality via APIs, workflow and orchestration capabilities can span across multiple environments as well as providing DevOps support through automation.”
• “Every change processed by HiIM goes through a workflow process, which supports validation, calculation, authorization and audit history.”
• “Workflows can also be used for manual fulfillment in cases where a connector is not available or not yet deployed.”
• “The self-service and telephone reset options can significantly help reduce help desk costs.”
• “Proxies eliminate software dependencies on the authorized user’s device and can overcome network path limitations from the user’s device to the managed endpoint.”
• “If users attempt to disable recording, PAM can shut down the session and send alerts.”
• “One of Hitachi ID’s driving principles is to help customers reduce deployment and technical support costs while providing a full IAM solution.”