Leveraging key CIAM strengths in a Zero Trust Model

You already read about how CIAM and Zero Trust are partners, not rivals. You shouldn’t have to compromise one to achieve the other. If you haven’t already read that, please click here. Moving on now. When it comes to your own customers, are customers who they say they are? How can you as a business be sure of this? CIAM capabilities such as SSO, Identity Federation, MFA, Adaptive Authentication, Approval Workflows, Consent Management, API Security, SDKs, Analytics & Logging are all bricks that help you build a fort that’s your cybersecurity strategy. This strategy will help prevent you from losing face, not to mention millions of dollars in data breaches and subsequent fallouts. For example, with a CIAM solution (Fig.1) -

• You can set it up so that for first-time login, a customer might need to verify their access via Identity Federation via a secure trusted third party.
• You can prompt for multiple forms of Multi-Factor Authentication such as App Authenticator, Biometrics, Security Keys, SMS/EMAIL OTPs, etc. You can also set up multiple levels of these.
• You can allow customers to switch between multiple business applications/portals with Single Sign On, where the customer doesn’t see this but you are constantly validating if they have the necessary roles or rights to access that other app. You can also control what permissions they have within those apps.
• You can set up adaptive authentication that smartly identifies and assesses customer login attempts based on multiple factors like location, roles, age, etc., to decide and enforce if additional verification is required. This will give you flexibility over keeping your customer experience fluid while maintaining strict standards of security.
• You can set up Approval Workflows so that customers who self-sign up will need to go through a process of internal verification via an approver before they are given access to your app.
• You can set up Consent Management so that you are only storing those aspects of your customer’s data for which they have provided digital consent. This can be further separated into mandatory and optional consents; mandatory being what customer info you need and optional being what info would be nice to have to further tailor your customer experience.
• You can secure your APIs by controlling who accesses APIs across an API ecosystem and how often.
• You can use SDKs to integrate modern open-standard protocol support into your apps that may not natively support them.
• You can set up Analytics and Logging Mechanisms to store logs and also analyze them to provide metrics for short and long-term needs. These can also be used to generate reports and alerts in a variety of ways.

Fig.1 — CIAM Solution

Get Robin Antony’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The above are just some ways you can go about using the key capabilities of a CIAM solution to ensure you are in an advantageous position to either provide direct results or integrate better with other vendor systems to achieve the same, to ultimately support the pillars of your Zero Trust Model.

With COVID-19 and its subsequent after-effects accelerating the adoption of cloud and remote work, attack surfaces against businesses are transforming. Businesses have also either faced or are facing immense pressure to improve and move to digital platforms to stay relevant. These digital services are only as good as the customer experience they provide and the revenue they bring in. A future-proofed Zero Trust Model leverages all the above capabilities of a CIAM solution, to provide a frictionless digital experience, while questioning a customer’s credentials and rights dynamically.

While all the above is well and good, the ground reality is that there are wide variances in Cybersecurity Maturity. You still have businesses that let down their guard or misstep and this costs them. This may not happen intentionally, but they may start down a path to modernize security, without fully understanding that something like this doesn’t happen overnight. You need to identify where you currently stand on your CIAM Maturity Scale (Fig.2) and what it’ll take to transition to a higher level of customer security through Zero Trust principles.

Fig.2 — CIAM Maturity Scale

Your business may be at level 0 or higher but it’s critical that you make that assessment and do what’s required to scale up -

• You’re at level 0 if you still need to work on consolidating your identities so that they’re not split across multiple silos, struggling with duplicate identities and non-standard security controls.
• You’re at level 1 if you already have centralized identity management and capabilities such as SSO, MFA and consistent security policies.
• You’re at level 2 if you’ve done all the above (standard CIAM) and also secured your APIs by implementing stronger ciphers or tokens and supporting open integration standards.
• You’re at level 3 if you have adaptive controls in place which are able to identify risk factors dynamically and execute remediation steps. Passwordless access and AI-driven analytics would also fall here.
• You’re at level 4, if you’ve been able to accomplish all the above while still maintaining the core principle of suspect, analyze and execute while maintaining constant verification and validation.

The US National Institute of Standards and Technology (NIST) has published NIST SP 800–207 which is a Zero Trust Architecture (ZTA) document that describes ZT for enterprise security architects. It is meant to aid the understanding of ZTA and provide an enterprise implementation roadmap for Zero Trust security concepts. Enterprises will have unique business use cases and data assets to safeguard, so this isn’t intended to be a single deployment plan for ZTA. A strong understanding of your business and data will result in a strong approach to Zero Trust, which is also why it’s important to partner up with strong security vendors. A solid CIAM product can go a long way in helping you build a solid Zero Trust solution. You are only as strong as the weakest link in a chain.