What should organizations pay attention to regarding identity and access security?

Feridun Aktaş, CISO at Garanti BBVA, explains the critical importance of “identity” as the cornerstone of information security, and outlines the steps organizations should take regarding identity and access management in the digital age.

It is fair to say that identity lies at the very heart of information security; after all, the fundamental goal of information security is to ensure that the right person accesses the right data. Any other scenario or combination inevitably leads to errors, security breaches, or other complications. Consequently, the first step toward ensuring the right person accesses the right data is to accurately identify that individual. This is why identity and access management plays such a vital role—it is, in a sense, the very core of the entire operation. To maintain robust information security, organizations must effectively govern two primary functions: “authentication” (verifying who a person is) and “authorization” (determining what they are permitted to do). Ensuring that these two processes are aligned, consistent, and sustainably managed is critical for any organization. In fact, many information security incidents stem from core issues such as the compromise of user accounts, the impersonation of users, or the negligent transfer of access rights into the wrong hands. Organizations now face a new reality: managing only their own internal identities is no longer sufficient. In this new digital era, organizations are in constant digital interaction with various ecosystem players—including suppliers, stakeholders, and even competitors—which brings us back to the same fundamental necessity: the critical importance of identity and access management. You must ensure that those accessing your systems—whether they are actual human beings or what we call “service accounts”—do so securely, while adhering to the principle that only the right individuals (or entities) access the right data. Organizations must account for risks that exist beyond their own internal environment—in the “outer garden,” so to speak. They are obligated to ensure—and provide assurance—that their governance structures, technical infrastructure, and processes extend to cover all these third parties and stakeholders. This is why, over the past 3–5 years, the industry has adopted the phrase: “Identity is the new boundary.” I believe that the network perimeter—once defined by firewalls—has been superseded; the framework established by how identities are managed and protected has now become the new “castle wall”—the primary security perimeter for organizations.

The Importance of Identity in Information Security

In today’s digital world, information security has become more critical than ever. As technology advances rapidly, so too do threats to information security. In this context, identity management lies at the core of information security. Ensuring that the right individuals have access to the right data is a fundamental principle of information security. If unauthorized individuals gain access to data, it can lead to hacking and various other security issues. Consequently, identity and access management stands out as one of the most vital components of information security.

Identity and Access Management

Identity and access management plays a critical role in identifying the right individuals and granting them appropriate permissions. This process consists of two main phases: authentication and authorization. Authentication serves to identify the individual, while authorization determines which data that individual is permitted to access. Managing these two phases in a coherent and sustainable manner is of vital importance for organizations.

Information Security Challenges

Many information security problems arise when user credentials are compromised or fall into the wrong hands. Such issues necessitate that organizations approach their identity and access management processes with greater care. Securely managing user credentials is a significant step toward ensuring robust information security.

Identity Management in the Digital Age

In this new digital age, organizations must not only manage their own identities but also engage and interact with other participants within their broader ecosystem. Constant digital interaction with suppliers, stakeholders, and even competitors makes identity management increasingly complex. Consequently, organizations must ensure that external users or service accounts accessing their systems are managed securely.

The New Boundaries of Identity

In recent years, the phrase “Identity is the new boundary” has gained significant traction within the industry. Network perimeters, once defined by firewalls, are now maintained through the protection of identities. The framework established by identities has become the new security perimeter for organizations; therefore, identity management is recognized as one of the most critical components of information security.

The Future of Identity Management

Identity management will become even more vital in the future. As technology evolves, identity management processes will grow in complexity, requiring organizations to manage them with greater efficiency. Identity management must expand beyond internal identities to encompass those of other participants within the broader ecosystem.

Conclusion

Identity management lies at the core of information security. Ensuring that the right individuals have access to the right data is a fundamental principle of information security, with identity and access management serving as a critical element of this process. Organizations must manage their identity processes effectively and remain prepared against external threats. Because the protection of identities has become the new security framework for organizations, identity management is now regarded as one of the most essential pillars of information security.