What is Web Access Management (WAM)

Initially, web access management was conceived to manage access between external users and network resources. But as remote work and web-based office access expanded, it became an important access system for employees as well.

However, WAM was designed to regulate access to web servers. As a result, it does not take into account the needs of hybrid cloud users. More effective identity and access management solutions are rapidly displacing it as a secure access option.

Key takeaways

• Web Access Management (WAM) controls user access to online resources and services.
• Developed in the 1990s alongside the World Wide Web, WAM merges user authentication with access control and includes Single Sign-On (SSO) for simplified access across various domains.
• WAM secures web resources by authenticating and authorizing access for legitimate users while blocking unauthorized ones.
• It operates by checking user credentials and implementing policy-based authorization to set user permissions on network resources.
• Modern access management technologies now outpace WAM, providing broader solutions for varied user identities and cloud environments. WAM falls short in creating user identities and does not align well with cloud-based authentication standards.

The history of WAM

WAM developed in the 1990s, parallel to the emergence of the World Wide Web. It served as a form of Identity and Access Management (IAM), merging user verification with access control. This approach allowed network managers to protect networks and assign appropriate access rights efficiently.

An early significant feature of WAM was Single Sign-On (SSO), which let users access multiple areas with one login.

WAM evolved to manage identities across various domains, broadening its effectiveness. Key early products in WAM included Oracle Access Manager, IBM’s Tivoli Access Manager, and Microsoft’s Active Directory Federation Services. Though groundbreaking in their era, these products have become less relevant, surpassed by newer, more adaptable security technologies.

What is WAM used for?

Why did companies embrace web access management? For a time, WAM was a critical security tool.

As web resources became commonplace, WAM solutions made it possible to control access to critical resources. Authentication and authorization systems kept out illegitimate external actors. But they allowed genuine users to access workloads and services.

WAM also made it easier to bring different web domains together. Federated identities and SSO made it possible to combine access to a variety of web resources. This helped to manage security. It also simplified access. Instead of handling multiple credentials, users could access web resources via a single panel.

How does web access management work?

Firstly, web access management software controls access by requesting user credentials. Typically, access is granted when users provide a username and password. But security teams can add extra authentication management factors such as one-time passwords, digital certificates, or a temporary token.

When the system verifies a user's identity, WAM solutions apply policy-based authorization. This matches each user to a set of permissions. These permissions define what resources are available to the user, and the level of control they have over data on the network.

Most WAM implementations rely on on-premises infrastructure. Agents associated with web services communicate with central servers. These authentication servers approve or deny access based on ledgers of network users. However, proxy servers can also play a role.

Web access management vs. modern access management

WAM was one of the best IAM types for handling application access to the web-based network architecture of the 1990s and 2000s. However, it has generally been outpaced by modern identity and access management (IAM) technology.

Modern access management builds on WAM in several important ways:

• WAM systems provide user access to specific resources such as web applications or physical machines. This is less relevant to cloud environments with large communities of virtual machines and application instances.
• WAM typically has limited identity management features. But modern networks must cater to many different identity types. Access management systems need to admit different tiers of employees. There may be third-party users, clients, or even non-human service accounts. All require specific access management policies.
• WAM cannot deliver granular privileges management to effectively protect cloud data. Data breaches are a critical security threat. But granular authorization is needed to protect cloud-hosted client data.
  
  

Modern access management is more comprehensive than older web portals. Newer systems can monitor user activity and calibrate precise access controls for every role. And they can do so across hybrid cloud environments. Just managing web access is not enough.

Web access management vs. identity management (IdM)

The best way to understand how access control has changed is by comparing web access management with modern identity management (IdM) technology.

WAM

Usually based around authentication servers and networks of agents on web services. Authentication requests pass from user devices to agents, and then to authentication servers. Servers are located on-premises.

WAM usually does not generate user identities. Services are reliant on separate identity management tools and do not include cloud authentication standards.

IdM

Modern IAM types include identity generation as a core component. Modern access management systems assign user identities and manage them across their entire lifecycle. Managers can assign access privileges across multiple cloud platforms and on-premises resources.

IdM works with cutting-edge authentication standards and protocols. It is cloud-based and works well with remote access devices and mobile apps. There is little need for on-premises equipment.

Legacy web access management has several drawbacks compared to modern access management. For instance, negatives include:

• Expensive to use at scale.
• Unable to effectively manage external user access to cloud resources. Incompatible with popular cloud authentication standards like Google Authenticate.
• Slow to introduce or remove identities, inflexible when managing privileges or authentication settings.
• Limited data collection features. Cannot create in-depth audit trails or generate data flows to assist security or marketing efforts.
• Problems with user management and cloud compatibility may create serious security gaps. This may put confidential data at risk.
  
  

Fundamentally, WAM was an effective way to manage identities on the web. But it is a dangerous option for securing identities in the cloud.

Cloud computing requires IAM solutions that accommodate remote access and ever-changing network endpoints. And compliance requirements now exclude older WAM systems, which are deemed unsafe for sensitive data management.

Modern identity management has moved beyond WAM, which is now a technology of the past.