Access Management in Healthcare: IAM vs. PAM vs. MFA

What Is Identity and Access Management (IAM)?

Petros Efstathopoulos, vice president of research at RSAC, explains that IAM is an umbrella term that refers to the set of policies, technologies and processes that manage users’ identities and control their access to resources within an organization.

“IAM is crucial for ensuring secure interaction with web applications and cloud services, as it allows administrators to grant permissions to users and applications, thereby defining how these entities can interact with specific resources,” he says.

For example, in a healthcare environment, IAM can be used to assign staff permissions to patient data or physician appointment calendars.

In other words, IAM is a broad term, and a fundamental concept in security, that refers to three major tasks: identifying users, authenticating them and managing their privileges.

Understanding Multifactor Authentication (MFA)

Brandon Traffanstedt, senior director for CyberArk’s global technology office, describes MFA as a capability of IAM.

“It makes sure that users are properly authenticated in this process by enforcing the use of several controls, or factors, of proof when the user is trying to access something,” he says.

Users might be asked for a password alongside a biometric authentication, for instance, or a password and a ‘push’ to an authentication app or code on a physical device.

What Is Privileged Access Management (PAM)?

PAM can be thought of as a subset of IAM that is focused on powerful or sensitive access and normally used in scenarios whereby an individual (or machine) needs access to systems or services requiring stronger permissions than a standard user.

PAM is used to ensure that this highly sought-after access is hardened with extensive security controls.

“Privileged access can be associated with human users as well as nonhuman users, such as applications and machine identities,” Traffanstedt says.

Likewise, the definitions of privileged access and standard access continue to expand as more users and machines are given additional high-level access.

What Are SSO and Role-Based Access Control?

Single sign-on is an authentication process that allows a user to access multiple applications with one set of login credentials.

“SSO simplifies the user experience by reducing the number of logins required and enhances security by reducing the number of passwords users need to remember,” says Ted Kietzman, product marketing manager for Cisco’s Duo Security.

Role-based access control restricts system access to authorized users based on their role within an organization, Kietzman explains.

“Basically, your role designates what you can and can’t access,” he says.

EXPLORE: These are the top three reasons to modernize your IAM program.

How to Use IAM, MFA and PAM Together

The good news for healthcare IT leaders, Traffanstedt says, is that these security controls are complementary practices.

“The best way to think about how they are implemented is from the perspective of what is valuable to your organization,” he adds.

That can be different for every healthcare business, but it typically includes protecting patient data and ensuring medical service availability.

It might also cover the intricate regulatory framework of the healthcare sector.

“An effective identity security strategy starts with this and works outward to ensure that the right person has the right access at the right time,” Traffanstedt says.

Implementing IAM, MFA and PAM in Modern Architectures

Efstathopoulos explains that modern systems have commoditized a lot of the IAM functions and capabilities, primarily as cloud services.

“The commoditization of IAM cloud services, toolkits and products enables organizations to design and implement a tailor-made system,” he says.

These include readily available components that have been designed to collaborate with one another and improve usability and security.

Kietzman says there are several benefits to moving IAM, MFA and PAM to a Software as a Service model, including reduction of management and maintenance costs, higher availability and scalability, and tooling that is updated consistently.

“However, making this choice and effort will depend on a given healthcare system’s IT stack,” he adds.

Future Trends in Identity and Access Management

Efstathopoulos says a key technological trend that will impact the future of IAM is the increasing use of AI and nonhuman agents in various industries, including healthcare.

“Current systems in place are predominantly designed with the assumption that all agents involved are human,” he says, noting IAM mostly authenticates human identities.

However, the increasing use of AI is providing nonhuman agents capable of handling a wide range of tasks, from automated billing to chatbot-based customer support, and from automated AI-powered remote medicine to the analysis of complex medical data for research and drug development.

“As the number of nonhuman agents involved in clinical healthcare and research increases, we would need to revisit and adjust the identification, authentication and access management strategies in order to integrate these new identities and address the additional security challenges that may arise,” Efstathopoulos says.

UP NEXT: Bust the top three identity and access management myths to boost security.