Identity Access Management Tools Showdown

Identity Access Management (IAM) is at the core of the modern complex and highly distributed IT environment in any organization, and these solutions do way beyond managing user identities and granting access to resources. They are at the core of business and transformation strategies, as well as human resources and security, as over 60% of attacks are now willingly or unwillingly carried out by insiders.

A mature IAM program is well customized to a business’s objectives and the unique circumstances surrounding it can reduce the risk of data breaches involving identities. A proper IAM implementation will help ensure regulatory compliance, reduct cost of performing audits, increase visibility through streamlined reporting and bring a hint of a smile to your tired yet kind systems administrator's face by reducing the IT overhead.

But many organizations fail to experience any of these gains due to fragmented, stagnant and incomplete IAM programs that have been developed over time using point-technology solutions. As a result, businesses are exposed to the risk of major losses and miss the competitive advantage of an agile and connected workforce. Luckily, there are some holistic tools on the market that can aid the journey - and the best of them work in tandem.

SailPoint (IdentityIQ)

IdentityIQ is the only piece on this list built from the ground up with the purpose of being a fully integrated IAM solution. It leverages a unified governance platform to provide a common data repository as well as role, policy and risk model management, giving you a solution that’s easier to deploy, easier to maintain and easier to use. In theory.

Pros:

1. Great app and third party integrations

2. Highly configurable

Cons:

1. Complex and requires skilled talent to get the most out of it

CyberArk Core Privileged Access Security

The CyberArk Core Privileged Access Security solution provides organizations with the ability to take a risk-based approach to credential and session management. Users can transparently enforce least privilege principles and lock down domain controllers to defend against both internal and advanced persistent threats. It also provides SSH key management capabilities, making users able to provision and de-provision SSH key access, know which SSH keys are compromised in the event of an attack, and grant varying levels of control to all entities.

Pros:

1. Great fairly intuitive UI

2. Easy and secure credential vaulting

3. Well suited for audit requirements

Cons:

1. Can be expensive

2. Reporting is not great

Okta Identity Cloud

Identity Cloud from Okta is a behemoth suite of products that are meant to provide comprehensive IAM solutions to workforce and customers of an organization. The suite includes 12 products: Single Sign-on, Adaptive Multi-factor Authentication, Lifecycle Management, Universal Directory, API Access Management, Advanced Server Access, Customer Authentication/Authorization, User Management, Multi-Factor Authentication, Lifecycle Management and B2B Integration. As you can imagine, it's pretty comprehensive.

Pros:

1. Adaptive and flexible MFA

2. Great SSO implementation and app integrations

3. Multiple levels of administrative rights

4. Fairly simple setup and rollout

5. Real-time provisioning and de-provisioning

Cons:

1. Little control over syncing with Active Directory (either manual or every hour)

2. UI can be confusing and/or outdated

3. Lacks access governance, user access certifications and segregation of duties

4. Limited Role-Based Access Control features

Idaptive Next-Gen Access Cloud (Centrify)

Idaptive’s Next-Gen Access Cloud uniquely combines SSO, adaptive MFA, endpoint & mobile context and behavioral analytics in a single platform. Unlike other identity and access technologies that offer piecemeal solutions, Idaptive uses real-time access data and machine learning to understand risk, so customers can make smarter decisions at scale about who they let into applications and services.

Pros:

1. Great Multi-Factor Authentication (MFA) implementation

2. Great Single Sign On (SSO) implementation

3. Great intelligent automation features

Cons:

1. Somewhat lacks app integration

Winner

In our humble opinion, the winner is the fairly recent integration alliance among SailPoint, Okta and CyberArk which, if deployed correctly, will provide some of the best-in-class combined IAM features for any organization. Specifically,

1. Okta provides secure access for entire businesses via single sign-on (SSO) and multi-factor authentication (MFA)

2. SailPoint provides identity governance, security, operational efficiency and compliance to enterprises with complex IT environments

3. CyberArk provides comprehensive privileged access protection, monitoring, detection, alerting and reporting on all privileged users

As end users demand access to everything from everywhere at all times, IT scrambles to keep the network secure and in compliance and CISOs struggle to enforce policies, visibility and security controls, this approach will hopefully allow you to balance the needs and demands of all these key parties to your business.