The Path of Least Resistance in Identity and Access Management

Building from the path of least resistance in Identity and Access Management.

IAM loves acronyms, so we'll call it PLR.

Balancing convenience and security in Identity and Access Management (IAM) can be tricky.

PLR is important to understand to know how to use it and when to fight it.

All people find shortcuts to save time, and in business processes they can create vulnerabilities and inefficiencies.

Humans are hard wired to look for shortcuts, and our brains convince us to see patterns where they don't exist. PLR isn't going away, so how do we name, shame and claim?

If it's always there, how do you see it?

∙Simple or reused passwords across systems can be found with anonymous questionnaires. People know they shouldn't do it, so in this case, anonymity promotes honesty.

∙Broad access rights granted to avoid detailed role definitions. Look at the process of creating new roles or analysis your access requests for trends. If you're the first person to ask this question, you can check this box yes.

∙Minimal monitoring of user activities or insufficient auditing of access logs, you're not able to look for existing shortcuts. This is red flag internally and a welcome sign to bad actors.

∙Defaults: "We don't have time to configure this tool, so we're using 𝘿𝙚𝙛𝙖𝙪𝙡𝙩 𝙎𝙚𝙩𝙩𝙞𝙣𝙜𝙨." Default security settings that are not customized to fit your specific organizational use cases should be classified as lost dollars and crashes ROI.

A solution that is deployed but isn't leveraging full capabilities can create a false sense of security and feed into PLR with other security measures. This sounds like, "we already have 𝙩𝙝𝙞𝙨. Why do we need 𝙩𝙝𝙖𝙩?"

We know these are cringey, but people and PLR created these problems, and we need to use different language to motivate change.

No negativity. We're not blaming anyone. PLR decisions where made without understanding the consequences. We're here to talk about risk.

∙Weak password policies: PLR tells us that employees are reusing a pool of passwords for access inside AND outside the organization. Find it elsewhere and use it here.

Security breaches at other companies become your problem with weak password and access polices.

∙(Too) Broad access: Over-permissioned accounts increase the risk of insider threats and data leaks.

As we're moving to Zero Trust, over-provisioned access is relying on Max Trust, or trusting people to do the right thing, when in reality, they'll follow PLR on good days and have 𝙬𝙖𝙮 𝙩𝙤𝙤 𝙢𝙪𝙘𝙝 access for those few bad days.

∙Minimal monitoring: Poor monitoring and auditing is words without actions.

The best analogy is running a leg of a race and tripping before the hand off.

Monitoring user activity and auditing access logs is where you 𝙨𝙝𝙤𝙬 policies are working and collect 𝙖𝙘𝙩𝙞𝙤𝙣𝙖𝙗𝙡𝙚 information to continue moving forward.

We care about oversight, but the risk is without proper monitoring, malicious activities can go undetected until small problems have turned into major issues.

∙Default settings: Default settings are often generic and designed to step up with time to avoid doing harm in the initial deployment.

They don't address your specific needs, making them under utilized and create a diminished ROI.

PLR issues are better understood as business risks, but we need to overcome these mindset to be effective.

∙Acknowledge Human Nature: Understand that shortcuts are natural. Focus on ease of use. Ask end user questions in the design process.

∙Educate and Empower: Security is a shared responsibility. Talk about it. Offer educational sessions. Write security tip of the week. Sponsor a company event. PLR can be fought with knowledge. Enknowledgify them. Be a person talking to people.

∙Adaptive Solutions and Processes: There is no end state. Static ideas aren't working.

In technology, use adaptive and context-aware solutions. With processes, use feedback loops and plan for evolution.

Define what's working and how you know it's working. Think through what not working looks like.

∙Celebrate the wins. If we're in this together, share success stories. Recognize those who take the extra step to secure their processes. Show them that their efforts matter.

The goal is to turn the conversation to proactive improvement, but don't boil the ocean. We're building a culture of continuous enhancement, and combating PLR is an ongoing journey.

The path of least resistance (PLR) in Identity and Access Management (IAM) stems from human behavior. People often take shortcuts, sometimes ignoring the risks. Understanding it allows us to use it as a chance for improvement.

Finding the right balance between convenience and security in IAM is an ongoing but necessary effort. Convenience shouldn't come at the expense of security. They should complement each other.

The journey to enhanced security is a collaborative one, and every step forward counts.