This week, I want to continue to focus on some of the key IT teams and projects at NYU and dig deeper into the scope of their work. Our Identity and Access Management (IAM) team is a crucial component in managing the cybersecurity of and access to NYU data and networks. Every major breach has included a compromise of identity and access. When some component of the IAM system has been compromised, the damages skyrocket.
The number of NYU accounts (3M+), applications (1,000+), and systems (3,000+) make for a very complex environment. IAM reduces that complexity through standardization using recommended government and industry frameworks, to control access to an organization’s digital assets. Accurately identifying and verifying individuals ensures that only authorized personnel can access sensitive resources, reducing the risk of unauthorized data exposure and breaches.
Ensuring that people receive appropriate access to resources based on their roles and responsibilities has never been more crucial. IAM helps units grant access promptly when needed and revoke it when no longer required, minimizing the chances of lingering, unused, and forgotten accounts becoming security liabilities. Privileged accounts, such as administrative and superuser accounts, are prime targets for cyber attackers and top priority within information security.
-
PAM (Privileged Access Management) solutions add an extra layer of protection for these high-value accounts.
-
Regular reviews, security assessments, and testing can identify vulnerabilities and weaknesses in the IAM infrastructure, enabling timely remediation.
-
Certification provides assurance that accounts and their security practices are up to par, reducing risk and fostering trust in the organization’s ability to protect sensitive data.
The future of IAM will likely involve seamless integration across multiple platforms, better application integrations, higher practices for account management, and new methods of authentication. I want to thank the IAM team for everything they do and for their never-ending goal of keeping up-to-date—and ahead of—the ever-changing cybersecurity landscape.