DAN CONRAD at argues that better funding is needed to unify different identity management tools as a way of reducing security team stress.

The explosion in remote working has undoubtedly opened multiple doors in people’s lives. Unfortunately, one of those doors leads to a very new and real problem for those working in the identity and access management sector: one of exhaustion, complexity, and poor mental health.

The landscape

For businesses, identity management has become an existential need. Online identities across multiple tools, systems and departments, both internal and external, are all potential entries to your network for cyber-criminals and represents a significant number of resources to be managed by IT departments.

According to the survey conducted by One Identity, which approached over 1000 top IT Security Professionals 52 per cent of the companies surveyed are managing over 10,000 identities. While 89 per cent of respondents had been impacted by an identity-based attack in the past 12 months.

The significant growth in the number of managed identities over the past couple of years has resulted in an extremely complex system where remote and hybrid access to key components is crucial to the full functioning of the business. This complexity, in turn, has led to an increase in the number of security tools that IT managers have to deal with every day. 96 per cent of IT professionals reported using multiple identity management tools, whereas 41 per cent of respondents are using more than 25 different systems to manage access rights.

Unfortunately, this is not the only reason that complicates the work of those involved in identity management. According to another survey undertaken during One Identity User and Partner conference, it also affects their psychological well-being: 63 per cent of the polled reported their security teams are overworked and only 15 per cent said that their teams are currently able to manage their workload appropriately.

As a result, companies faced with overworked identity security teams may not be able to complete their job function to a high standard and may begin to consider leaving the organisation, leading to difficulties in replacing them.

What can be done: funding and unification

While the problems outlined in the above surveys represent a significant challenge and a complex one at that, there are some things which can be done to alleviate the situation.

The first thing identified by both sets of data is the importance of a unified approach: A radically different approach is needed to overcome the system of complexity and fragmentation that is currently dominating the identity management space. Around 80 per cent of respondents noted that better identity management tools could have prevented the impact of much such identity-based attacks.

At the same time 58 per cent of partners and customers surveyed believe a unified approach would help their team’s mental wellbeing. An even greater percentage (60%) say that a unified approach could, in turn, provide significant results for the entire company, since the mental wellbeing of the security team effects security at the company as a whole. 

Another key area is funding: a necessary but particularly difficult conversation to have in the current financial climate, but something which the industry overwhelmingly supports: 62 per cent of partners and customers polled suggest that more staff and greater funding could make a serious difference when it comes to improving the resilience of security teams. Another 29 per cent suggest that a more technical approach (better integration of cyber-security solutions) could also help. However, better integration requires resources and funding to achieve!

Thus, to cut through the noisy and complex nature which the market has currently undertaken, security and IT teams need to bring two simple and straightforward solutions to those who set their budgets: Unify the identity security solutions and give the appropriate funding to do this.

Failure to engage meaningfully with these challenges can not only jeopardise a company’s identity security but also lead to the loss or damage of the most valuable IT asset of every enterprise – the team.

• Conrad is AD Security and Management Team Lead at One Identity.