• What is identity management?
• Why should I care about identity management?
• How can an identity management system benefit my business?
• How do identity management systems work?
• What is Federated Identity Management?
• What challenges or risks does implementing an identity management system present?
• What terminology should I know?

What is identity management?

Identity management is a term that refers broadly to the administration of individual identities within a system, such as a company, a network or even a country. In enterprise IT, identity management is about establishing and managing the roles and access privileges of individual network users. ID management systems provide IT managers with tools and technologies for controlling user access to critical information within an organisation.

The core objective of an ID management system in a corporate setting is this: one identity per individual. But once that digital ID has been established, it has to be maintained, modified and monitored throughout what has been called the “access lifecycle.” So ID management systems provide administrators with the tools and technologies to change a user's role, to track user activities and to enforce policies on an ongoing basis. These systems are designed to provide a means of administering user access across an entire enterprise and to ensure compliance with corporate policies and government regulations.

The list of technologies that fall under this category includes password-management tools, provisioning software, security-policy enforcement applications, reporting and monitoring apps, and identity repositories. Nowadays, these technologies tend to be grouped into software suites with assortments of additional capabilities, from enterprise-wide credential administration to automated smart-card and digital-certificates management.

The ID management buzz phrase of the moment is “identity lifecycle management.” The concept encompasses the processes and technologies required for provisioning, de-provisioning, managing and synchronising digital IDs, as well as features that support compliance with government regulations. Technologies that fall under the ID lifecycle-management rubric include tools for security principal creation, attribute management, identity synchronisation, aggregation and deletion.

Why should I care about identity management?

ID management is inextricably linked to the security and productivity of any organisation involved in electronic commerce. Companies are using ID management systems not only to protect their digital assets, but also to enhance business productivity. The systems' central management capabilities can reduce the complexity and cost of an essential process. The centralised access control also supports consistent security policy enforcement.

ID management systems also give organisations a way to control the swarm of untethered endpoints — laptops, PDAs and mobile phones — buzzing around the enterprise. Many of these devices are neither owned nor provisioned by the companies whose networks they need to access. The ability to enforce a set of policies on the devices that connect with the network through the management of the identities of the users of those devices is fast becoming a must-have security capability.

And besides, the government says you have to care about identity management. In 2005 lawmakers began making moves to put the onus for safeguarding customer info squarely on the shoulders of the enterprise. Sarbanes-Oxley, Gramm-Leach-Bliley, HIPAA — each holds the company, in various ways, responsible for controlling access to customer and employee information.