Gerry Gebel, Strata Identity Head of Standards, former Burton Group analyst and tech executive at Chase Manhattan Bank (now JPMorgan Chase).
Running applications and processes in the cloud has profoundly reshaped business and society. It’s introduced remarkable gains in speed, efficiency and convenience. Today, about 70% of organizations report that more than half of their infrastructure resides in the cloud.
As a result, cloud resilience and business continuity have entered the spotlight. What’s often lurking backstage, however, is the vital role identity plays in keeping cloud platforms and business applications operating smoothly and effectively. When these systems falter, business operations and security take a hit.
It’s no small matter. Hardly a week goes by without new headlines reporting on the latest security breach, misconfiguration or other incident that results in cloud system outages. Today, organizations require a robust and highly flexible cloud identity framework that can adjust and adapt to a wide range of events in real time.
Business leaders must understand how identity systems operate in the cloud, recognize how, when and where identity risks occur and adopt a set of best practices for securing identity services and the data that resides behind them.
How The Cloud Impacts Identity
Multicloud environments that run highly decentralized applications and services have fundamentally altered the identity landscape. Replicating and synchronizing this information across clouds, systems and apps is a complex and costly endeavor. A subpar framework can lead to service disruptions caused by power failures, software glitches or cyberattacks.
Here’s another challenge: As companies outsource identity management to the cloud—an increasingly common practice—there’s a tradeoff. They simplify numerous tasks, but they also relinquish direct control over their infrastructure.
The takeaway? For many organizations, it’s time to rethink and revamp cloud identity to better balance opportunities and risks. In today’s SaaS-driven landscape—where reliance on third-party vendors is commonplace—identity represents a potential point of failure.
Many application and infrastructure services can leverage conventional methodologies to achieve high availability. For example, you can install multiple copies of a service behind load balancers for scale, performance and availability. You can also use tooling like Kubernetes to auto-scale as workload volume fluctuates over time. But what about identity? You can’t employ these methods for a SaaS-based identity provider (IDP) and are forced to rely on the vendor for whatever high availability or backup options they provide.
Identity Continuity Requires The Right Tools
Achieving the same level of high availability and continuity of operations for identity systems requires a different approach—one that offers similar control over identity infrastructure in the cloud. Let’s take a closer look at the steps that can help transform potential chaos into order:
• Determine if any single points of failure exist in your identity services. It’s important to know where the weak points are so they can be addressed with monitoring, manual workarounds, custom solutions or commercial products.
• Identify the potential business impact of identity service failure. Can you quantify the business impact if identity systems are down and business applications can’t be accessed? I’ve seen examples at both ends of the spectrum: companies that know the exact cost of downtime and others that have difficulty quantifying the impact.
• Examine the current state of your business continuity plan. Do you have an inventory of all the tools in use today, including backup/recovery, hot/warm standby systems and more? Are they being tested regularly? Where are the gaps?
• Employ specialized load balancing. In application management, load balancers distribute tasks across multiple cloud servers to ensure continuous operation even if a server fails. However, in identity systems, achieving continuity requires specialized load balancing that ensures identity verification tasks are handled seamlessly across the cloud.
As an organization develops an identity continuity plan, it’s crucial to recognize that not all applications require the same level of availability. Consequently, it’s important to identify the most critical systems and prioritize these resources. In most cases, these are applications that directly impact revenue generation, customer interactions and essential business functions.
Best Practices For Identity Continuity
Transforming an identity continuity plan into a best-practice approach revolves around three key strategies:
• Develop a comprehensive backup and recovery plan. A business must ensure that robust and specific procedures are in place to restore identity systems swiftly and correctly in the event of data loss or service disruption. A proactive approach centers on downtime, service disruptions and the loss of revenues. Remember, a backup system is only as reliable as the restore procedure—make sure you test it regularly!
• Leverage the resilient capabilities of your primary IDP. When your primary IDP is deployed in multiple cloud regions, there may be capabilities that you can leverage to continue operations when the primary region isn’t available.
• Maintain alternative IDPs as a failover option. What happens when your primary cloud IDP fails? Do you have an alternate cloud IDP that can be used in its place? Do you still have an on-premises Active Directory server that can be utilized as a standby system?
Make no mistake, identity continuity isn’t an obscure topic, and it isn’t relegated to companies operating in critical spaces like healthcare and finance. As cloud platforms have evolved, so have the requirements for identity management. Organizations that get the identity continuity equation right dial down risks, lower costs and, in the end, build out a cloud identity framework that can achieve the maximum level of operational security and resilience.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
link
