Identity and Access Management for the Internet of Things

This document is the first in a series of summary guidance aimed at providing easily understandable recommendations to information technology staff charged with securely implementing and deploying IoT solutions. The IoT introduces the need to manage exponentially more identities than existing IAM systems are required to support. The security industry is seeing a paradigm shift whereby IAM is no longer solely concerned with managing people but also managing the hundreds of thousands of “things” that may be connected to a network. In many instances these things are connected intermittently and may be required to communicate with other things, mobile devices and the backend infrastructure. Some have begun to refer to this new identity ecosystem as the Identity of Things (IDoT). The IDoT refers to the relationships between devices and humans, devices and devices, devices and application/services or a human and an application/services.