Importance of CIAM and Analytics

One of the most popular topics discussed in the fraud and security space currently surrounds identity and access management (IAM) within financial organizations, and the limitations that their current set up entails.

IAM itself typically covers the management of employee centric accounts, workflows and permissions. An employee would be granted specific permissions, based on several internally created groups. These could be anything from general system-based access to specific workflow creations. This allowed internal access where permitted, and movement of staff between groups was easy and manageable due to the limited number of users. Despite being prone to human error, it worked. For the majority of financial organizations, it was adequate to manage the security of their systems and quite achievable to create and expand.

This, however, didn’t remain the case when Customers entered the picture.

Despite the influx of users accessing systems via the internet, many companies decided to cut costs by utilizing their internal IAM systems to regulate permissions and access for their customers, or forgo access management and risk-based decisions completely and rely on static authentication only. As you can imagine, it simply isn’t good enough. From a system perspective, it isn’t secure; but turning toward a customer focused perspective, it was clunky, ineffective and more likely to turn them away than create the stickiness that we all strive to create.

Enter, CIAM. Customer, Identity and Access Management. A hot topic, that companies are having to wrestle with currently. So, what is it?

Unlike internal IAM systems, CIAM focuses on an “outside in” risk basis. Managing access, security and permissions for customers in volumes that the traditional IAM simply can’t handle. Instead of internal staff members receiving pre-determined permissions based on a manager’s decision, customers permissions are granted via risk-based security measures and context-aware access grants. You don’t know a stranger like you know your staff member, so how do you determine trust?

A better question, is how do you determine trust with a customer without pushing them away from your service due to the complexity of it?

According to Gartner®:

"Identity and access management (IAM) leaders pursuing identity-first security and zero-trust cybersecurity strategies should enable continuous passive authentication by expanding the range of recognition and risk signals that are evaluated, including additional ATO prevention controls, and extending evaluation throughout each session." [1]​​.

A service that allows you to monitor, challenge and change without disrupting a customer’s flow through security. One main example of this is behavioural biometrics. Monitoring a customer’s behaviour from initial login to logout to ensure that their consistent behaviour doesn’t show any changes. Anything from the way they hold their phone to how they interact with your site. These small markers being monitored doesn’t create walls for your customers to climb over but passively watches to ensure their consistent safety throughout their journey with you.

We have all experienced a terrible login scenario, where it makes you consistently type in passwords or answer security questions to complete a simple task. Despite knowing that it’s for your security, you grind your teeth, roll your eyes and feel a frustration that means you’re less likely to pick up that app again and use it any time soon. If anything, you might find a way to avoid using it – sometimes turning to competitors that make your journey smoother.

This is what CIAM with customer focused analytics is trying to combat.

A good CIAM solution remembers the customer, their behaviour and their data without them having to do a single thing. They may login with their fingerprint and think that they’ve done enough, what they don’t know is that they can be monitored throughout their whole journey. Security without their realisation.

CIAM allows an organisation to Respond instead of Reacting. Standard IAM or static authentication integrations aren’t enough to handle surges in users, new threats or quick enough to react to immediate problems. A quick example is COVID – overnight millions of people turned to online banking to handle their services. An unprecedented number of users that IAM systems simply couldn’t handle. Outages, scams and lost users all overnight from a threat that we simply couldn’t predict. CIAM systems allow flexibility within access and quick changes in response to threats - even the unknown ones!

Imagine that. Your customer accessing your system with ease during a time of unrest, surrounded by hundreds of their family and friends that can’t do the same. All because you could make a quick change within your CIAM system which your competitors couldn’t. Now that creates not only a retuning loyal customer, but a lot more referrals than you think.

Now, after all of that would it surprise you if I said that only 14% of Identity and Access Management deployments include risk-based authentication or behavioural analytics? ​​

CIAM is clearly a blind spot for more organizations than you would think, and running without it is like a ticking time bomb. Sooner or later, your IAM system or static authentication integration will fall behind and cause customer frustration or losses. The question you need to ask yourself is - Is the cost saving worth sacrificing your customer satisfaction?

With an increasing need to make instant changes to your identity access management system, why not start the conversation now with me to discuss your current needs and future plans?

​​References