Identity and access management in a post-password era

Nemanja Krstić, Head of operations (AME & EU) at Galix.

---

Traditional password-based authentication is no longer sufficient as a standalone control for protecting business systems. 

Advances in automation and artificial intelligence have increased the effectiveness of credential-based attacks, while common practices such as password reuse continue to create risk across environments. 

Addressing this requires a structured Identity and Access Management (IAM) approach that strengthens authentication, governs access appropriately, and reduces reliance on static credentials. 

Managed Security Service Providers (MSSPs) support this transition through assessment, gap analysis and the implementation of modern identity controls that enhance security while maintaining operational continuity.

Passwords have become increasingly ineffective. This is due to a number of reasons, including user behaviour and technological advancements. From a behavioural perspective, credential reuse remains common. 

Users often reuse passwords across different websites and applications, rotate between a limited set of familiar passwords or revert to previous ones over time. 

Even where complexity requirements are enforced, passwords remain problematic, as complicated passwords introduce practical challenges with remembering them, which typically lead to workarounds, like writing the password down, which in turn weakens overall control effectiveness.

At the same time, the threat landscape has evolved. Large volumes of credential data are exposed through breaches and circulate online, creating opportunities for unauthorised access attempts. In many cases, using valid credentials is simpler and less resource-intensive than attempting to penetrate a system directly. 

Because these attempts often resemble legitimate activity, they may not immediately trigger traditional detection mechanisms. As computing capability continues to advance, including developments in areas such as quantum computing, the effort required to compromise credentials is likely to reduce even further.

This is where identity and access management become critical. IAM verifies user identities and enforces appropriate access controls across systems. It does this by combining layers that reduce reliance on a single static credential. 

Multi-factor authentication reduces the risk of unauthorised access by requiring a second form of verification in addition to using a password. One-time PINs, authenticator approvals, and phone-based security can all be used to incorporate an additional layer of security to help block unauthorised access attempts.

Passwordless authentication goes one step further by removing the password from the sign-in process completely. It can rely on biometrics such as fingerprints or facial recognition, which shifts authentication to something the user is. It can also use physical keys, which shifts authentication to something the user has. These approaches can be made more specific by tying access to a known device, a known location, or even a designated port.

One-time access links and session-based authentication provide another route. A session can be generated, sent to a controlled channel, and then expire when the user logs out. This reduces the value of stored credentials because it removes the need for a password database. When passwords are no longer stored, one of the primary sources of credential dumps is removed, limiting the availability of stolen usernames and passwords.

For most organisations, passwordless authentication cannot simply replace existing systems overnight. Many organisations have infrastructure that is built on legacy tools and processes that were designed around passwords.

In practice, moving to passwordless authentication often requires adding supporting controls and, in some cases, replacing parts of the existing environment. The challenge lies in introducing it in a way that does not disrupt access, increase user friction or weaken existing controls.

Identity governance ensures that IAM is applied consistently and enforced across the organisation. It automates how access is requested, approved and removed, reducing reliance on manual tickets and ad hoc decisions. 

This is essential because employees need reliable access to the systems required for their roles. If access takes too long, requires repeated escalation to IT or involves unnecessary steps, productivity is affected and support workloads increase.

Governance also ensures that users only have access to what they need for their specific role. This limits the impact if an account is compromised, as there is less unnecessary access to exploit. 

It also improves onboarding and offboarding processes, including the management of third-party access. When access is granted according to defined policies and automatically removed when no longer required, outdated accounts and excessive permissions are far less likely to remain active without oversight.

An effective IAM programme begins with a clear view of the existing environment. Organisations need to understand how access is currently granted, managed and revoked, and where weaknesses exist.

Those gaps can then be prioritised according to risk and addressed step by step. This also ensures that identity controls fit within broader security models, including zero trust and SASE.

MSSPs add value by bringing practical implementation experience and the capacity to support or manage IAM, where internal teams are already stretched and operating reactively. The aim is not to add more disconnected tools but to put the right controls in place so that identities are verified properly, access is granted correctly, and systems remain usable for those who need them.

When the right controls are in place and supported consistently, IAM becomes part of how the organisation operates rather than a series of reactive fixes. A post-password approach works when identity is verified properly, access is granted deliberately, and permissions are reviewed and removed when no longer needed. The tools may evolve, but the fundamentals remain the same: understand your environment, close obvious gaps, and manage access in line with clear policy.

In practice, this reduces the likelihood of account-driven compromise and limits the damage if an account is misused. It also prevents old accounts and unnecessary permissions from remaining active after roles change or contracts end, and it helps avoid delays or repeated support requests when users need access to do their jobs.

Ultimately, strong IAM is not about adding complexity. It is about putting consistent controls in place so that the right people have the right access at the right time. When these controls are applied consistently, organisations reduce the risk of unauthorised access, avoid unnecessary disruption and show customers and partners that access is properly controlled.