Security isn’t a one-time investment: 3 key areas where most organizations fail

Your management team says that the time has come to invest in your organization’s cybersecurity. Your operations team agrees and says they are committed to security. Your IT team says that an IAM would help to secure your data and application, and identifies customizable IAM solutions, such as Akku, for investment.

So far, so good. But does that complete the job from your team’s end?

Even if your organization’s management and users believe that they are totally committed to improving cybersecurity, many of our recent IAM implementations have brought up some interesting issues of organization productivity.

Low priority on training

Many corporates believe that their employees – young, apparently tech-savvy, living in metropolitan areas – are sufficiently aware of all necessary cybersecurity measures. They believe that their teams are equipped to set up strong passwords, manage their own multi-factor authentication, avoid phishing attacks and browse through only secure web pages.

Some businesses, especially very large enterprises, do understand that cybersecurity training is necessary. However, others (regardless of size) often don’t feel it’s important for workers to take time out from their regular routines to focus on security. This is a prioritization issue, not one of budgets or resources. It can result in a number of security issues, including in terms of secure access to applications and data. No matter how technologically aware your team is, no one knows everything. It’s important to keep your learners up-to-date with regular cybersecurity training.

Fear of adoption

For a simple example, consider single sign-on (SSO). Single sign-on is an efficient way to log on to multiple applications. Using 2FA or MFA (two-factor or multi-factor authentication), single sign-on is secure as well as easy. However, if your team has never used such tech before, it can be bewildering. In our experience, 75-80% of corporate users don’t know how to use SSO without training. Post implementation of Akku, our team has occasionally offered training on how to use SSO and multi-factor authentication in the past. 

When we speak to our customers, we find that in many cases, fear of adoption is a bigger hurdle than cost of implementation or features provided by the IAM. They believe that their workers simply don’t know how to use MFA, and that it’s too much effort to provide regular updates and training to fix this gap.

In our experience, fear of adoption prevents more investments in cybersecurity applications than budget or other concerns.

Prioritizing productivity over security

While Akku or other IAM solutions secure access to applications and data, there is a certain amount of involvement needed from your IT team. A classic example is the password change self-service functionality. This functionality allows your users to manage, update and change their own passwords. 

At Akku, our policy is against self-service for password management. This is an intentional choice as it risks allowing users to set weak security questions or repeat common passwords used in other personal accounts. This, further, risks hacking through social engineering or credential stuffing attacks. In addition, when users know that they can reset their passwords at any time, they feel that their responsibility to secure their account and credentials is not as urgent. When they have to disturb their IT administrator every time they forget their password, this feels like a much more serious problem!

However, centralization of password management is inefficient for IT admin teams. In our experience, around 0.2% of users forget their passwords, every day. For an enterprise of 5,000 users, that results in upto 10 password reset requests, every day. As a result, some organizations tend to prioritize team efficiency or productivity over cybersecurity, by allowing users to manage their own passwords.

This raises the question: are you prioritizing your cybersecurity or team productivity? At the end of the day, you are responsible for your own cybersecurity. Taking the decision to invest in Akku or any other security infrastructure is an important step, but you need to keep the focus on cybersecurity on an ongoing basis. 

Security is a long term commitment, not addressed by a single investment. Talk to our team today for a holistic consultation on the next steps towards a more secure organization.

 

What is Open Policy Agent and how do you use it in cloud-native environments?

Open Policy Agent (OPA) helps you to increase application security and to reduce the risk of unauthorized access to sensitive data even in case of a breach of the application. 

It achieves this by simplifying access authentication and authorization within the application architecture, which in turn secures internal communication and access.

Many multinational corporations are using Open Policy Agent in their IT operations to establish, validate and enforce access control and security policies across the architecture of the application, thus allowing them to customize and strengthen security strategies for the application.

Why should Open Policy Agent matter to your business?

Take, for instance, edge security, which is used to protect corporate resources, users, and apps at the “edge” of your company’s network, where sensitive data is highly vulnerable to security threats. The edge security model trusts all internal communication and checks a user identity only at an ingress API-Gateway.

With Open Policy Agent it is possible to plug this gap by building a distributed authorization as close to a data source as possible without having to build the authorization logic directly into services. That increases security at every level of your application.

Here’s how major enterprises are using OPA

  • Goldman Sachs uses Open Policy Agent to enforce admission control policies in their Kubernetes clusters as well as for provisioning Role-based access control and Quota resources central to their security.

  • Google Cloud uses Open Policy Agent to validate configurations in several products and tools including Anthos Config Management and GKE Policy Automation.

  • Netflix uses Open Policy Agent to enforce access control in microservices across languages and frameworks in their cloud infrastructure and to bring in contextual data from remote resources to evaluate policies.

But what is OPA, exactly?

Open Policy Agent (OPA) is a tool that helps you write and test policy-as-code for Kubernetes to improve operational efficiency and promote scalability and repeatability. OPA decouples policies from application configurations and provides policy-as-a-service. Since this engine unifies policy enforcement across the stack, it allows security, risk, and compliance teams to adopt a DevOps methodology to express desired policy outcomes as code as well as offload policy decision-making from software. Created by Styra, and now part of the Cloud Native Computing Foundation (CNCF) alongside other CNCF technologies like Kubernetes and Prometheus, OPA is an open source, general-purpose policy engine. 

When and How can OPA be used to improve your IT Ops?

Infrastructure Authorization

You can use make all elements of your application infrastructure more secure using OPA.

OPA enforces and monitors security policies across all relevant components. For instance, you can centralize compliance across Kubernetes and application programming interface (API) gateways. 

With Open Policy Agent, you can add authorization policies directly into the service mesh, thereby limiting lateral movement across a microservice architecture. That way, since authorization is required at entry to every microservice, improper access to one microservice does not necessarily compromise others.

(You can learn more about Service Mesh and how it can help you with cluster security here and here.)

Admission Controller

You can control admission to your resources by working with an OPA-powered Gatekeeper.

Azure Gatekeeper and other Kubernetes policy controllers work with OPA to allow you to define policy to enforce which fields and values are permitted in Kubernetes resources. They can mutate resources. 

A common example of a mutation policy would be changing privileged Pods to be unprivileged, or setting imagePullPolicy to Always for all Pods. When you’re able to mutate resources server-side, it’s a really easy way to enforce best practices, apply standard labeling, or simply apply a baseline security policy to all resources.

Azure Gatekeeper for example is a Kubernetes policy controller that allows you to define policy to enforce which fields and values are permitted in Kubernetes resources. It operates as a Kubernetes admission controller and utilizes Open Policy Agent as its policy engine to ensure resources are compliant with policy before they can be successfully created.

Application Authorization

With the level of automation OPA provides, your team can make changes with the confidence that access authorization will remain accurate. 

Since Open Policy Agent uses a declarative policy language that lets you write and enforce rules, it comes with tools that can help integrate policies into applications as well as grant end users permissions to contribute policies for tenants. This enforces policies across organizations for end-user authorization with the OPA deciding level of user access in the application.

Open Policy Agent is also used to resolve problems around service-level authorization to control who can do what at different parts of the stack. 

What are the advantages of using OPA?

The OPA policy improves operational efficiency, allows for virtually unlimited scalability, eases interpretation, offers version control, and ensures repeatability. It essentially provides a uniform, systematic means of managing policies as well as auditing and validating them to avoid the risk of introducing critical errors into production environments. That’s because in Kubernetes, policies are best defined in code and OPA allows you to write and validate policy-as-code. 

By leveraging code-based automation instead of relying on manual processes to manage policies, your team can move more quickly and reduce the potential for mistakes due to human error. At the same time, your application architecture remains absolutely secure. Want to know more about how OPA can make your business more efficient? Contact us at Akku.

The risks of depending on password-based login

Logging in to a system without a password may seem unsafe. After all, a long, complex password has long been considered fundamental to secure login. However, though they are difficult to crack, password complexity has its own associated risks.

The vulnerabilities of passwords

Complex passwords are difficult to remember, as a result of which they need to be stored in a separate location. The requirement for frequent password changes also increases the difficulty of remembering them. This risks exposing them to hacking, cracking or phishing attacks.

The greater risk, however, is that the corporate user may use the same password across multiple sites. This creates a risk of credential stuffing attacks and also makes it more difficult to change the password on all websites if required.

(You can learn more about some of the attacks your passwords are vulnerable to, here: 6 Password Policy Management Best Practices for a more secure IT environment)

Security without passwords

When your applications are accessed through password-based login, the credentials can be shared very easily. This is a major risk, since secure credentials may be shared with unauthorized individuals.

Another potential security risk is that application developers and vendors can access user credentials; a real risk to data privacy. Such databases are also vulnerable to phishing attacks.

Passwordless authentication

Instead of logging in with passwords, modern applications and tech systems use passwordless device-based authentication. Since passwordless authentication is a zero-trust login, it prevents all the above risks.

There’s no need to maintain a record of complex passwords or regular password rotations. Since the credentials are non-shareable, unauthorized individuals cannot access your critical data and applications using approved credentials.

Passwordless authentication depends on individual device keys to authenticate user identity. Since the data is not recorded digitally, phishing attacks to gain access to the credentials are impossible.

The device keys are generated by the user, and not even the application owner or vendor can gain access to the user data in question. This helps boost data privacy and security.

(You can learn more about passwordless authentication here: Passwordless Authentication 101: What it is, How you can adopt it, and Why it’s the future)

Akku and passwordless login

As part of our range of MFA (multi-factor authentication) options, Akku offers device-based passwordless authentication. Your single sign-on (SSO) can be customized to deliver passwordless login. Akku offers this feature to protect user data privacy. Do reach out to our team today to learn more about passwordless authentication and how to get started with Akku, the customizable IAM.

Web content filtering: The benefits to hybrid organizations

The main objectives behind web content filtering are accuracy, scalability, and maintainability and unless you have the right service provider working with your organization, these three objectives are going to be hard to meet.

It’s because the three are like cogs in the wheel, and every one of them counts. Accurate blocking makes scalability and maintenance difficult, while easily scalable and maintainable content filtering systems may not be as accurate. 

That’s why content filtering as a service is constantly evolving to address all of these issues and ensure enterprises have a multi-layered defense strategy in place against viruses, malware, phishing attacks, and so on.

First, let’s look at why your hybrid organization needs it

  • Managing compliance requirements:
    By blocking offensive or distracting sites such as social networking platforms and video streaming services on a corporate network you are improving employee productivity as well as ensuring you are managing compliance requirements.
  • Managing bandwidth:
    Web content filtering and YouTube category-based filtering enable organizations to track and regulate access to websites based on their content categories, it can prevent the use of high bandwidth sites like streaming sites that can reduce network performance.
  • Managing cyber threats:
    Web content protects the network by blocking sites that are high-risk, spam, and malicious websites, as well as preventing data leakage. Websites can be blocked by category. For example, websites that come under categories such as Social Media or Entertainment can be blocked.

So, why not just use a firewall, you may wonder.

Well, you can, but the firewall will naturally block particular websites based on defined rules, and that means you cannot allow sub-categories within the website to be whitelisted. For instance, say, a channel on youtube. If your firewall is set to block youtube, the site as a whole will be inaccessible.

The second reason a firewall may not be a perfect choice is that it depends on the internet connection, not on the user or device. And in this era of hybrid working, firewalls can be bypassed if users connect to their home internet.

What you want is to keep the company devices safe and protect them from the risk of compromise even if they access the net from an outside firewall.

Use content filtering the right way

Content filtering is a tool and like any tool, knowing how to use it correctly will help you accomplish your goal. The right service provider can help you navigate the realm of web content filtering.

Take Akku’s content filter for instance. It can be configured to whitelist and blacklist sites. Even within the whitelisted sites, like for instance, YouTube, the Akku filter allows specifically whitelisted channels or categories, blocking all the other irrelevant ones. Akku’s filter uses a proxy server to read each video’s metadata to only allow viewing YouTube content that is allowed, for instance, some reference data or upskilling resources. The filter also allows you to restrict employees by user category defined on Akku’s identity access management solution.

In the hybrid work environment, content filtering by user works better than a firewall internet connection-based content filtering. It’s also helpful for companies too small to invest in on-prem firewalls.

Akku’s dedicated sales specialists are always ready to help with any information you need on content filtering. Contact us to find out more.

Here’s why your apps built with no-code platforms need an external IAM

Have you heard of no-code application builders? They are ideal for minor applications without heavy technological requirements. These no-code apps can be taken to market much faster, are cheaper to develop and can deliver a great experience in many cases.

However, while they are easy to build and use, securing apps made with a no-code app builder requires an external IAM.

Access management for internal applications

Consider a desktop-based application such as MS Access, which is used for combining, processing and editing large groups of data from different sources. It’s largely being replaced by web-based equivalents. This kind of small internal application has a clear function, and is therefore easy to build using a no-code development tool.

Internal applications such as data management tools, onboarding tools and other HR applications are often considered lower priority as they are purely internal in use. Therefore, low-budget no-code app builder tools are used in these cases.

However, these applications process a great deal of valuable internal data, and it’s important to take their security seriously and guard access to them. That’s why it’s important to implement a strong IAM tool for all your internal-facing applications.

The risk of web-based applications

With web-based apps, whether or not it’s developed with a no-code tool, you have the freedom to deploy the application on cloud servers on flexible pricing models, and access them from anywhere. Since such apps are hosted on the cloud, it can be risky to access them directly without a VPN.

Tiny no-code app builders don’t invest the necessary time and effort into security and privacy, which is why it’s difficult to set up good protection for such apps. Additionally, the user working on a no-code app builder typically doesn’t have the necessary time and knowledge to do so.

Syncing your IAM

While some well-known no-code app builders offer plugins to integrate with external IAM through SAML and OAuth2, others do not. In cases where such plugins exist, you can use any external IAM system.

When the plugins do not exist, however, and especially in cases where you would rather reduce the coding footprint of your project, consider an IAM product like Akku. Since Akku is a customizable solution, you can use it as a gateway for any major or minor internal or external application, even when the app being used does not support SAML, OAuth2 or OIDC. 

Your minor internal applications often contain or process the most valuable data at your organization. Protect them with an external IAM that’s easy to set up, integrates with any setup, and restricts access to these key internal corporate resources. Protect them with Akku, the customizable IAM.

The simpler way to manage Remote Employee Onboarding

When onboarding new employees, it’s important to keep the process as simple as possible. When all new user activity occurs in a single system, onboarding, especially remote onboarding, becomes seamless and effortless.

If your onboarding system is integrated with Akku, or if you use Akku itself as the onboarding system, this system becomes the first point of engagement for the user with the organization. Every step of the onboarding process is guided by this tool. Since it collects all the user data requested at the very beginning of the interaction with the new employee, Akku becomes the single source of truth for the entire career journey of the employee.

The onboarding process

Once the employee has been recruited, they are instructed to create an Akku account using their personal email address. A website link is then sent to the employee’s personal email id. Upon clicking on this link, the employee is led to a portal where they can begin onboarding by requesting their new corporate credentials.

Once they receive their new credentials, users log on to the same system using their corporate email address and password. On the same landing page, they see the list of guidelines to be followed, documents to be submitted with deadlines, date and location of reporting, how and what to do upon joining the organization, and more. All details are shared in a single window, often including a downloadable offer letter.

A single source of truth

Since the onboarding process for all employees is undertaken through a common digitized system, Akku becomes a ‘single source of truth’ for all information related to each employee. 

This makes onboarding seamless from the documentation perspective, as the new employee has to upload documents to a single location, and all departments involved can access them directly, as and when needed.

Similarly, since provisioning happens through Akku, access to all relevant software and other digital assets is also granted effortlessly through a single application. Not only is provisioning seamless, but authorized managers across departments can also view details pertaining to the new employee via Akku’s dashboards, as it is the single source of information about the new team member.

Remote onboarding 

This kind of single-window onboarding is extremely valuable to employees working remote or hybrid, as most of their interaction with the organization will be virtual. An efficient onboarding process makes a great first impression. It shows that as an employer, you consider employee support to be a tech priority.

Much of the Know Your Employee (KYE) documentation can (or sometimes, should) be completed before the employee actually joins the organization. Since the portal is open at any time and can be accessed from anywhere, remote document collection (in the form of soft copies) is seamless. This is especially important and useful for employees working remotely, as they may not be located in the same area as your office and could need to travel to visit the office to submit hard copies.

Similarly, since employees are also offered virtual orientation, knowledge transfer and access provisioning, remote onboarding becomes easier.

Benefits to remote employees

  1. Seamless documentation: As discussed earlier, since Akku is a single source of truth, all documentation takes place virtually through the portal itself.
  2. Seamless provisioning: As an Akku-based onboarding system of this kind is a single source of truth in the organization, employees do not have to go outside the system to upload data and documentation about themselves, nor to access relevant information, knowledge, or relevant assets.
  3. Seamless knowledge transfer and training: Akku is integrated with a communication system to push messages and communiques to users. Using this tool, orientation, knowledge transfer and initial training can take place through the system itself.
  4. Seamless reporting: The same tool provides user activity monitoring as well, for the duration of onboarding and orientation, since it tracks the progress of the new employee through the predefined process. Akku can directly intimate HR, reporting manager and head of department regarding the progress of the employee through the KYE process via the system dashboards.
  5. Seamless identity management: Since Akku is a full-fledged IAM, the new employee can directly be provisioned with access to all required software and other assets through Akku itself. At the same time, account credentials for single sign-on (SSO) can also be directly generated.

Automated, single-window onboarding for remote employees makes the process significantly more efficient, especially for large enterprises with a huge number of employees joining per day. Single-window reporting is also a feature that smaller businesses find extremely useful, as it makes user management much more efficient for small HR teams. 

Wondering how to make your onboarding process more efficient? Take it digital with Akku. Contact our team today to discuss how to get started.

Maintaining in-house control of your digital access gateways

Unless you have the right kind of access control, you don’t have ownership of your assets. For digital assets, you also need a proper access gateway, which should not be under third-party control for storage and management. That’s because losing access keys means losing control of assets. With digital gateways, one can access the assets without needing to know where the keys are. It is very important to always keep these gateways running, disaster-free and tamper-free, and free of vendor lock. 

Digital vaults

In a smart society and business set-up, every person has the right to their own digital vault to store their digital keys, with a common gateway to access all their assets. This digital gateway should be tamper-free, immutable and self-sovereign. You need a reliable, dependable single gateway for all digital assets wherever they are, with distributed and decentralized systems.

Multi-cloud data storage

Cloud computing makes this possible, as it works with distributed and elastic principles itself. Data can be distributed into multi-cloud platforms. One can build need-based custom IAMs for digital gateways by spanning its infrastructure into a multi-cloud environment with distributed storage like Hadoop and distributed databases with hash sharding, as distributed technology has self-balancing and auto-scaling features.

In-house or third-party?

It is extremely complex to build such a system manually. Instead, you can achieve the same result with the Google Anthos multi-cloud platform. As it can work on other cloud platforms as well as on on-prem platforms, it is vendor-lock-free.

Google Anthos

Since Anthos is a multi-cloud platform, you are not forced to depend on specific highly integrated tools specific to that cloud service provider. Rather than siloize each cloud environment, you can use Anthos to deploy and manage workloads to multiple cloud platforms. Google Anthos allows the creation of Kubernetes clusters in both AWS and Azure environments.

Source: https://cloud.google.com/anthos/clusters/docs/multi-cloud

For any organization to keep its digital world alive and healthy, this kind of multi-cloud environment with hybrid cloud architecture is required. It might be the foundation of the smart world.

At CloudNow – creators of the Akku Identity and Access Management solution – we understand the importance of maintaining the sustainability and privacy of digital gateways, the real holder of all digital assets. Contact our team to learn more about how to implement a cloud-based access control system that works for your organization.

Identifying Training Opportunities and Boosting Productivity with a User Activity Monitoring (UAM) tool

User Activity Monitoring tools (UAMs) have a bad rep, with many employees believing that they are used by employers for the sole purpose of spying on them. While this may actually be true in some cases, there are so many ways that a UAM can be of real value to an organization – for both the management and the employees. 

Helping you to identify training opportunities for your employees is among the most important benefits that using a UAM can provide. Gallup found that “hope for career growth opportunities is the number one reason people change jobs today”. By offering training to your top talent, you can upskill them and prepare them for new roles and responsibilities.

Do your employees have the skills they need?

Gartner found that “58% of the workforce will need new skill sets to do their jobs successfully”. However, do you know which employees are up-to-date in their skills, and which ones need upskilling or reskilling?

Similarly, you recruit candidates with the skills and expertise that you require for the organization, but you may request your employee to take on slightly different tasks from time to time.

As a manager, you would ask the employee if they have the skills to take on the task. However, new employees or those being considered for promotion may not be comfortable with replying honestly in the negative.

In such a situation, what does the employee do?

What usually happens in such a situation is that the employee accepts the new responsibility and agrees to deliver within the defined turnaround time. They then log on to Google to find out how to perform the task!

The worst part is that as management, all you know is that your team member is not meeting their commitments. You may think they’re lazy or inefficient. There’s a tendency to put more pressure on them, resulting in unnecessary stress and employee burnout.

Even if you have product management tools where the team logs time spent on different sub-tasks, they’re not likely to log research time. After all, they are trying to hide from management the fact that they lack the required knowledge or skills!

How can you solve this problem?

Use a User Activity Monitoring (UAM) tool to understand how the employees are performing. For instance, Akku’s UAM proxy reads users’ app activity, including which websites they are visiting and how long they’re spending time on sites like Google, Stack Overflow or Stack Exchange.

Akku then shares reports on the relevant data. By studying these reports, you can see which employees are spending an unusual amount of time on Google and other work-oriented research. You then understand that they need more training on specific subjects, and can plan reskilling accordingly.

Using a UAM right 

UAMs are often used by managers to snoop on their employees and penalize them for slacking or for time away from their device. As a result, employees try to work around the system to maintain their privacy.

A UAM is not about policing employees’ time – it’s about productivity. User activity monitoring, when it’s done right, is of great benefit to both employee and employer. Prioritize productivity by identifying skilling opportunities and delivering appropriate training content to your employees who need it, when they need it.

Work with Akku to implement UAM and improve organization productivity. Schedule a consultation with us for more information.

When should you implement an IAM solution?

In which stage of the user or employee lifecycle should an IAM solution ideally be implemented? The answer is: Right at the beginning, during onboarding. When the IAM is implemented early, it becomes part of the organization’s culture and ethos.

Provisioning and onboarding

Access to necessary applications and data needs to be provisioned as soon as the employee is onboarded. When an IAM is not used, access may be provisioned improperly with the intent to keep track manually and perform proper provisioning later.

For enterprise-level organizations with a huge number of employees, this causes issues at a later stage, as you may not have a proper record of the rights provided to each individual. When access provisioning is done properly with an IAM, access privileges will be tracked automatically to keep track of what access is and is not given to each employee.

Redundant data capture is also a real problem as the same data is entered by the new employee in the HRMS and then in the IAM for provisioning. By using a single platform, the redundancy is eliminated.

Single-platform onboarding

Instead of onboarding through multiple tools such as an HRMS or ERP, you can complete onboarding through a single platform – an IAM, such as Akku. You can also integrate your HRMS with Akku’s REST API, if you prefer. When using Akku for onboarding, your employees can upload all required induction documents through the IAM dashboard itself. This could include proof of identity documents, experience certificates, etc. Akku also allows you to set deadlines and schedule reminders for each employee. 

Why choose Akku?

Many businesses choose to work with Active Directory to simplify onboarding. However, there are certain issues with AD, including non-seamless remote working and of course, the enterprise-level costing.

Additionally, in as much as 50-70 percent of cases, in our experience, employees are brought in via a different tool and then asked to provide details on IAM as well. Instead, you can streamline the process with Akku, a tool that allows single-point data capture for onboarding.

How does a true PAM work?

A Privileged Access Management (PAM) solution helps to secure and control privileged access to critical software and assets. Credentials and specific levels of access to various applications are provided through the PAM.

Usually, organizations implement PAM only for authorization and de-authorization of access to the apps. For instance, let’s say a new employee needs access to Gmail, Jira, and your CRM. Typically, organizations only provide access when the employee joins, and revoke it when he or she leaves. This can be done by a simple Identity and Access Management (IAM) solution – however, a PAM can do much more. (Quick side note: Akku serves both PAM and IAM needs.)

Here are some of the key functions that a PAM solution generally serves.

1. Assigning specific rights and access privileges

On each SaaS platform, what rights does each employee have? For example, take the CRM. Can they add and delete workflows? Is an individual user to be a super-administrator? Do they need to be allowed only to create contacts, but disallowed from editing or deleting?

Access may also be changed for the employee as they grow within the organization. When the employee is promoted, they may get additional responsibilities. For instance, a sales executive may not be allowed to edit contacts, but once promoted as a sales manager, this permission may become necessary. 

You need not go to the CRM to make these changes – you can do so directly from your PAM platform. An IAM and PAM tool (like Akku) will allow you to manage changes to access permissions such as these from a single dashboard, with a single click.

2. Deprovisioning access

The day an employee leaves an organization, the IT team usually uses their generic IAM to revoke access to all SaaS apps (Gmail and Freshdesk, for example). 

However, by doing this, only the IAM gateway to the app is deactivated: the license on the application itself remains. That means that the subscription charges continue on, as well, unless you go to the SaaS platform and delete the license there.

A true PAM directly deletes the license on Gmail or Freshdesk as well. It also follows the same exit procedure as that of the app itself. For instance, Gmail allows you to back-up email data to an email account of your choice before deleting the account. A professional IAM and PAM tool like Akku does the same, following the same laid-down process of the application.

By directly deleting the license on the application platform itself, you can be sure that you won’t waste money on subscription charges due to human error. This kind of automation is essential for enterprise-level customers. As they have a huge number of licenses, it is impossible to manually track the licenses in use and those no longer required. As a result, enterprises may realize that such a costly error has occurred only after subscription fees have built up! 

The PAM also prompts you when you’re not using a license, upon which you can delete the license through the PAM.

Akku is a customizable IAM and PAM solution with user-friendly features that can be configured based on your specific requirements. Our team is well equipped to help you implement PAM at your organization and get the most out of it. Let’s talk.