20 April 2019

Control System Entry: Identity and Access Management

Control System Entry: Identity and Access Management

Identity and Access Management (IAM) lets the right individuals access the right resources, at the right times, for the right reasons.

Most commonly used in the enterprise space, IAM is now being adopted by mid-size organisations to control:

  • Application access through Single Sign-On and Multi-Factor Authentication
  • Remote access, including from foreign countries without staff, via Geo-Gating
  • Centralisation of access privileges and self-service passwords
  • Improved compliance with regulatory requirements

The importance of IAM has been highlighted by the results from Australia’s Notifiable Data Breach legislation.

The data has confirmed a high proportion of security breaches are due to human error, while malicious attempts to gain entry e.g. phishing attacks remain a constant threat. IAM helps mitigate these vulnerabilities within a broader security strategy.

The goal for IAM is to prevent unauthorised entry, without hindering the user’s access to their different applications, wherever the user or application may be.

Advances in Identity and Access Management systems can now achieve these competing challenges, allowing controlled access to resources across diverse technology environments and compliance with security standards, while also improving the user experience.

How IAM improves access and security

IAM addresses many of the security challenges faced by modern businesses, including:

Application access

Distributed applications such as Office 365 are now commonplace. One of the issues with distributed applications is users struggle to remember multiple passwords. As a result, IT departments face rising support costs from frustrated users and from managing different security methods.

IAM addresses this challenge by helping administrators consolidate, control, and simplify access privileges. Single Sign-On (SSO) can help with a single set of credentials for all applications.

SSO is often combined with Multi-Factor Authentication (MFA) to provide a single second challenge via a device controlled by the user e.g. mobile phone text message.


An increasingly mobile workforce means that security is now needed in more places, with employees working from home, mobile sales forces and ad-hoc access inside and outside of office workplaces.

IAM makes this possible through “geo-gating” locations. When inside the office, users can be unhindered by additional layers of security. When outside of the office network, best practice security principals such as MFA and other conditional security measures, including restricting access from selected countries, can be enforced to keep unwanted third parties out.


Poor administrative practices, human error and a lack of automation continue to affect IT departments. A common security failure stems from manual processes to revoke the user rights of former employees.

IAM centralisation, when implemented correctly, ensures that by disabling a single account, access to all systems and applications is removed once a user leaves an organisation.


Finally, with increasing regulatory compliance, IAM has a place in aligning with many compliance standards that businesses are faced with like HIPAA, PCIDSS, and ISO27001.

The First Focus IDaaS solution

To identify and manage the right combination of IAM tools for an organisation requires business analytical skills and technical expertise.

First Focus are experts in IAM and we offer our customers a comprehensive managed Identity as a Service (IDaaS) for on-premise to cloud environments.

We install, embed and manage your IAM solution to ensure your business benefits from:

  • Seamless access to any application from virtually any location or device
  • Secure collaboration with partners and customers
  • Increased IT efficiency and lower service desk costs
  • Enhanced security with real-time response to advanced threats

(1) Notifiable Data Breaches Quarterly Report 1 April – 30 June 2018.  oaic.gov.au