Think about the last time you tried to log into your work account from a new device. You were traveling, or your laptop died you borrowed someone else’s. You likely got a prompt asking to verify it is really you, a code sent to your phone or a push notification. Not always convenient, but absolutely necessary.
If you have been in that situation, you have experienced Identity and Access Management (IAM) in action.
In banking, where we move money and manage sensitive data every single day, IAM is not just an “IT thing”, it is also a core business priority. For Internal Audit Week, we want to share why IAM matters to all of us and the role we play as IT Auditors.
Understanding IAM in Simple Terms
When people hear “Identity & Access Management,” the topic can immediately sound overly technical. However, at its core, IAM is actually quite simple. It is about ensuring:
- The right people have access to the right systems
- At the right time
- For the right reasons
- And no more than necessary
In practical terms, IAM touches on everything we do. Think about the risks: a resigned employee whose account is still active, a staff member with excessive privileges who can unintentionally alter sensitive data or poor monitoring that may allow suspicious activity to continue unnoticed for months.
Why IAM Matters More Than Ever
There was a time when work only meant coming into the office to access the company network, those days are long gone. Today, our “office” is everywhere. Employees work remotely, access systems from home, from co-working spaces, from their phones while stuck in Lagos traffic.
While this flexibility is great for business, it means our old perimeter (the office walls) is gone. Today, identity is the new perimeter. A single compromised password can potentially expose financial records, customer data, or confidential business information.
This is why many cybersecurity frameworks now emphasize Zero Trust principles – the idea that we should never automatically trust a login just because it “looks” internal. Instead, we must continuously verify every access attempt.
Authentication Resilience: Why MFA is Your Best Friend
Let’s be honest: we all hate passwords. They are either too simple to be secure or so complex that we end up writing them on sticky notes (which defeats the whole point!).
This is where Multi-Factor Authentication (MFA) comes in – that extra verification step proving you are really you, not just someone who stole your password. This could include: a mobile app, biometrics, or a one-time code.
Consider this real scenario: Imagine a phishing email that looks legitimate from “IT Support” asking a colleague to verify their account. The colleague enters their username and password on a fake site. They enter their username and password. The attacker now has those credentials.
Without MFA, that attacker can log in from anywhere and impersonate that employee (accessing customer accounts or downloading sensitive data). With MFA, the attacker hits a wall. They do not have access to that person’s phone or authentication app, so stolen credentials alone are useless.
From a business perspective, MFA significantly reduces the likelihood of unauthorized access through compromised credentials. However, this is important, if the MFA process is so cumbersome that people actively look for workarounds, we have failed, as security that people bypass is not real security.
The Role of IT Auditors
As IT Auditors, our job is not to function as the Police. We provide independent assurance by evaluating these controls before attackers do. We identify gaps in MFA coverage before they become security incidents and recommend practical improvements that support both security and business operations.
As IT Auditors, we remain committed to shining a light on risks early thereby helping the bank strengthen its IAM practices so we can confidently embrace digital innovation and remote work securely.
Conclusion
Identity is now the new perimeter.
The next time you receive an MFA prompt, or you are required to update your credentials, try not to see it as just another inconvenience. Instead, see it as a small but important part of protecting yourself, the bank and our customers. We all play a role in defending this perimeter.