PIAM 2.0
The new science of physical access management post COVID-19
Security professionals understand that the fundamental objective of both physical and logical access control is to safeguard people, property, assets and things by preventing unauthorized entry. However, digital transformation is changing everything. This trend is forcing businesses to adopt digital platforms and processes to eliminate latency in access management functions.
However, this acceleration comes with its own challenges. Legacy PIAM players will have a difficult time coping with digital transformation trends. PIAM 2.0 comes to rescue by automating physical identity and access management processes with data-driven techniques to achieve frictionless and predictive management of access permissions and the inherent risks associated with this process.
While Physical Access Control Systems (PACS) have dutifully served the industry by physically controlling entry and egress points, that is opening and closing of the lock; PIAM 2.0 uses data, identity intelligence, and a comprehensive approach to manage the rules associated with every worker’s profile and attributes to allow or disallow facility access. It involves real-time access management aspects considering the dynamic nature of access requirements, evolving roles and responsibilities, and changing organizational needs.
PIAM 2.0 does not rely on hard-coded business rules and rigid structure as is the case of legacy PIAM offerings. It relies on data and dynamic rules to manage access.
Access management also incorporates aspects of identity management, which involves maintaining accurate and up-to-date information about individuals and their associated privileges, thus creating Physical Identity Access Management (PIAM).
Dynamic Workplace; Dynamic Workers
Post COVID-19, organizations often struggle to manage access to different doors at various locations for workers who may have a fixed office schedule or may work remotely many times in a month. There is a clear shift from regular office access to purpose-based access in a hybrid work model. This shift demands that PIAM 2.0 is smart enough for office planning, occupancy, and accommodation of the hybrid workforce access routine.
At the same time, organizations are looking to optimize their existing office space globally. As office spaces grow and old leases come to end, facility planners are looking for accurate data on how to efficiently allocate space amongst a hybrid workforce. PIAM 2.0 can enable individual level analysis of historical and real-time data with predictive capability to ensure office workspaces are constantly optimized in such environments. This helps organizations reduce costs and increase utilization of the space they have.
Data-driven Security Threat Intelligence
Decentralization of office spaces, a hybrid workforce and site-level manual management of physical access create security gaps. When an identity is not connected with appropriate access permissions and logical rules, a security gap exists. This security gap creates a false sense of security wherein an organization believes it is protected by their access control system, but in reality, the access control system is introducing new risks, such as insider threats, access anomalies and suspicious behavior of access.
PIAM 2.0 leverages purpose-built artificial intelligence and machine learning algorithms to learn from millions of identity access actions, behaviors and anomalies to detect incidents of potential breaches in security. Such behaviors could manifest as physical access card/badge cloning, to access phishing exercise to tailgating to gain inappropriate access.
By combining and correlating various data streams, such as badge access, video, IT & networking systems data, organizations can thwart an unpleasant security incident in advance.
Moreover, PIAM 2.0 automation allows organizations to autonomously manage every identity over their entire lifecycle across the enterprise. This includes gaining key insights into potential risks while also promoting operational efficiency through the automation of tasks related to onboarding and offboarding. In this way, PIAM 2.0 takes the pressure off administrators and allows them to focus on more mission critical assignments.
Given the numerous benefits afforded by PIAM, organizations are deploying new PIAM-centric solutions to address challenges beyond security related to a shrinking labor pool, rise in hybrid working, and new compliance mandates. And they are doing it using their existing data.
Deploying Data-Driven Security in PIAM 2.0
To understand how PIAM solutions work, it helps to illustrate how access is traditionally managed when relying solely on legacy access control systems and manual processes. In the absence of PIAM, access management is handled through a process typically involving an organization’s Human Resources (HR) department and department managers.
These departments rarely collaborate to determine appropriate access privileges for staff and visitors, issuing credentials and provisioning access on a case-by-case basis. However, this manual approach is prone to errors and delays due to the reliance on physical procedures.
To address these limitations, PIAM 1.0 solutions were introduced in the early 2000s, characterized by computerization, role-based access control, and centralized access permissions. This automation allowed for easier review and updates of access privileges, highlighting discrepancies, and simplifying the management of permissions when employees left the organization.
Despite these advancements, PIAM 1.0 systems operated in isolation and required manual updates, leading to backlogs, errors, and the accumulation of inaccurate access data.
Early PIAM systems also required hard coded rules and logic and were inflexible to changes, incapable of keeping up with the changing business requirements. These issues were only exacerbated post-pandemic that saw the Great Resignation, “quiet quitting”, and return to office mandates. As a result, insider threats remained hidden and difficult to identify within the access control system. Security threat intelligence metrics were missing.
While this phase brought improvements, there was still room for further enhancements to optimize access management. Thus, PIAM 2.0 was born.
Advanced PIAM 2.0 solutions revolutionize access management by leveraging data-driven automation, Artificial Intelligence (AI), and Machine Learning (ML). These advanced systems aggregate and analyze a vast array of data, including identities, credentials, permissions, and information from various business systems, such as HR software and PACS. This comprehensive data intelligence provides organizations with enterprise-wide visibility over the entire lifecycle of identities.
By centralizing identity management on a single platform, PIAM 2.0 automates the access provisioning process, granting access permissions based on roles and approval rules. This automation minimizes the risk of errors, unintended privileges, and tedious manual tasks associated with onboarding and offboarding processes.
PIAM 2.0 also goes where legacy PIAM 1.0 was unable to in the search and identification of insider threats. Insider threats, intentional or unintentional, are often challenging to detect due to their deceptive nature. However, modern PIAM software is designed to uncover access anomalies and suspicious activities by employing machine learning algorithms to analyze data from various access control parameters like timestamps, locations, credential usage, and transaction patterns.
By monitoring for deviations from an individual's normal behavior, PIAM solutions alert security teams promptly so they can initiate appropriate remedial action. These advanced systems significantly improve visibility and understanding of potential insider threats, helping organizations to more effectively prevent unauthorized access attempts that with legacy PACS alone.
With PIAM 2.0, organizations effectively eliminate the need for siloed systems managing isolated pain points, thus achieving a more efficient and effective access management approach.
PIAM 2.0 in Practice
Beyond greater efficiency and security, PIAM software offers a host of benefits for virtually every type of industry. Take healthcare for example, an industry hit hard by recent staffing shortages and rising labor costs. To combat these challenges, hospitals and other healthcare providers are turning to temporary and contracted workers.
These types of workers provide flexibility in managing workforce needs, allowing businesses to scale up or down based on demand. However, they also introduce the risk of security/access violations and may even require several types of access based on their current work assignments.
Healthcare facilities are also unique in that they are highly regulated, yet public places. Hundreds, potentially thousands, of employees, patients, contracted workers, and visitors are coming and going from the facility each day. Managing access for each of these identities manually is both time inefficient and practically impossible based on the sheer volume of identities. Allocating more staff to address access provisioning and visitor management is not possible given the aforementioned labor challenges, creating a security issue if left unaddressed.
PIAM 2.0 solutions address these concerns with ease, using software instead of people to keep hospital operations running as safely and efficiently as possible. First, PIAM software provides a holistic view of all identities across all potential healthcare campuses. This allows administrators to manage their entire third-party staff from a single pane dashboard, consolidating insights and ensuring policies are consistently and accurately enforced.
PIAM also makes it possible to implement automated contactor requirements, including automated badge application review and approval processes, automatic termination of physical access immediately upon expiration of pre-requisite criteria, or a secure application process that collects all pre-requisites (training confirmations, identity documents, background checks, etc.) required to confirm work assignment eligibility. In this way, many of the headaches associated with contractor management are effectively eliminated.
Achieving regulatory compliance is also imperative for many of today’s largest enterprises. Industries such as healthcare, energy, aviation, and more are bound by regulations related to access and privacy. For example, the FAA Extension, Safety, and Security Act of 2016 tightened the requirements for security measures related to airport access control. Under this act, any airport found to have more than 5% of their Security Identification Display Area (SIDA) badges unaccounted for must effectively rebadge the entire airport.
The process of rebadging thousands of individuals would be both tedious and time-consuming, but also costly.
To confirm compliance and avoid infraction, automated PIAM 2.0 solutions can be deployed to continuously check actual operational data against policies and historical data patterns. In essence, this approach can be described as a “continual audit,” automatically enforcing and proving compliance to keep any operation audit ready at all times.
Management can easily review access sorted by person, by area, by approver, or any other relevant factor to answer urgent needs. These capabilities extend to all industries that are subject to regulations including CCPA, FISMA, GDPR, HIPAA, SOX, SOC 2 Audit, NERC CIP, TSA SD, and more to help ensure 100% security compliance across all facilities and avert costly infractions.
The Future of PIAM
The security industry has come a long way since the advent of access control and even legacy PIAM 1.0. However, there is still much to be discovered in terms of data-automation as it relates to security. On the horizon, imagine an AI co-pilot that generates access or visit requests based on an existing schedule and the queue of individuals requesting visitor access. The same AI assistant that just generated the visitor schedule would then be able to deliver access notifications to both administrators and end users through an existing corporate messaging app.
These kinds of capabilities have the potential to positively transform how organizations address physical security, so it becomes a more natural extension of those procedures and applications already in use today. They also underscore the growing imperative for enterprises to make use of the data that is available to them now to facilitate higher levels of security and efficiency.
This article originally appeared in the September / October 2023 issue of Security Today.