Eric is CEO of Strata Identity, an enterprise cloud identity expert, multi-exit serial entrepreneur and coauthor of the SAML SSO standard.
Identity is the sun around which online life orbits. So, when things go wrong, chaos often ensues.
Recently, Georgetown University and several other institutions learned a lesson about how painful it can be when identity and authentication services fail. Students were unable to log into various systems for several hours, including social media sites, after its cloud identity service went down.
The incident illustrates an important point: It’s unwise to rely on a single central source for identity management. Just as disaster recovery and business continuity rely on multiple instances and backups in different places, identity requires a distributed approach.
Today, every organization is a technology company in some shape or form. This includes websites, applications and services running online. What’s more, as organizations become more digital, the stakes grow. Students, customers and business partners can find themselves unable to accomplish important, if not vital, tasks without identity services.
That’s why it’s critical to implement a higher level of identity resilience.
Lost Identities
Always-on digital resources have become the expectation—and the norm. Today, people expect to interact online anytime and anywhere. Yet, without secure authentication, various forms of online commerce and interactions—from Zoom meetings to interconnected supply chains—aren’t possible.
Whether a disruption is caused by a natural disaster, malicious actors or malware, system failures lead to a predictable place. They torpedo revenues, tarnish brands and increase the cost of doing business. In fact, even the most advanced authentication framework will fail if a primary identity provider (IdP) isn’t available. For instance, an employee may not be able to log in to their device or app because they are on an airplane and can’t receive a phone call to authenticate their identity.
Regardless of the specific reason, the result is typically a painful disconnect that leaves users frustrated and unable to accomplish tasks. What’s more, without a fallback system to maintain authentication services, a business, higher education school or government institution is essentially left in the dark—and unable to operate in a normal way. In the end, everyone loses.
Making The Grade
Addressing this issue requires business and IT leaders to focus on three primary issues: First, as organizations become cloud-native and build out multi-cloud frameworks, it’s vital to eliminate dependencies that may exist between and among cloud platforms, identity systems and applications at runtime.
Creating an air gap breaks dependencies and enables a different identity provider to fill the void until the primary identity system is back online, preventing application outages.
It’s also critical to establish failover capabilities between identity systems in applications and clouds. Problems can occur, for example, when a cloud service goes down, and users can no longer authenticate with its identity service to access applications. Establishing a failover to an IdP on a different cloud service will maintain availability.
Finally, there’s the question of how to keep on-premises applications operating when they use a cloud-based IdP. In order to achieve this level of resilience, failover to another identity system in a different cloud service or on-premises infrastructure like LDAP is required.
Although the situation can seem a bit like a Rubik’s Cube—particularly when multiple clouds are running numerous applications—the right architecture can handle identity across layers without interruptions. Moreover, this level of resiliency can extend beyond clouds to on-premises systems that accommodate identity management locally if this is necessary.
This more evolved framework introduces a level of agility, flexibility and scalability that both simplifies and improves identity management.
Amping Up Authentication
To be sure, the key to greater resiliency is the ability to store identity data outside any specific application, system or cloud. Then, with an automation and orchestration framework in place, an organization can keep an identity system operating when any single application or cloud service breaks.
For example, if a primary cloud identity system fails for any reason, users can still log in because the system is pointing authentication to an on-premises LDAP directory or a legacy IdP.
Along the way, other advantages accrue. This includes greater flexibility about what verification methods can be used if a default authentication method isn’t available at any given moment. This might include text codes, phone calls, YubiKeys, QR codes, authenticator apps and other methods.
Make no mistake: organizations that adopt a stronger identity resilience framework and the technology to support it are better equipped to weather whatever nature, hackers or the gods of computing toss their way.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Read the full article here
