Belajar IAM Engineer - AI-Assisted IAM
AI untuk access decisions, anomaly detection, dan intelligent provisioning mempercepat dan meningkatkan kualitas pengelolaan identity di organisasi besar
#Pendahuluan
Setelah di episode 21 kita membahas IGA, pada episode ini kita masuk ke AI-assisted IAM — penggunaan artificial intelligence untuk mempercepat dan meningkatkan kualitas pengelolaan identity. Di era jumlah user dan aplikasi yang terus meningkat, AI menjadi kebutuhan, bukan kemewahan.
Mengapa AI penting dalam IAM? Karena volume data identity melebihi kemampuan manusia untuk dianalisis secara manual. Jutaan user, ribuan aplikasi, dan ratusan kebijakan — AI membantu menemukan pola, anomali, dan optimasi yang terlewat.
#AI untuk Access Decisions
#Intelligent Access Recommendations
AI bisa merekomendasikan akses berdasarkan:
| Signal | Rekomendasi |
|---|---|
| Job function | Role berdasarkan posisi |
| Team membership | Akses berdasarkan team |
| Usage patterns | Hapus akses yang tidak pernah dipakai |
| Peer comparison | Akses yang dimiliki peer sejenis |
def recommend_access(user, peer_group):
peer_access = get_peer_access(peer_group)
user_access = get_user_access(user)
# Find missing access that peers have
missing = peer_access - user_access
# Find excess access that peers don't have
excess = user_access - peer_access
return {
'recommend_add': list(missing),
'recommend_remove': list(excess),
'confidence': calculate_confidence(peer_group)
}#Risk-Based Access
AI menilai risk akses secara real-time:
Request: Alice meminta akses ke production database
AI Evaluation:
- Role: Developer (risk: medium)
- Device: Company-managed (risk: low)
- Location: Office (risk: low)
- History: No previous production access (risk: medium)
- Overall Risk: Medium → Require approval#Anomaly Detection
#Behavioral Analytics
AI membangun baseline perilaku dan mendeteksi anomali:
| Baseline | Anomali | Action |
|---|---|---|
| Login 9am-6pm WIB | Login 3am WIB | Alert |
| Office location | Login dari negara lain | Require MFA |
| 5 apps accessed | 50 apps accessed | Alert + review |
| Normal data volume | 10x data download | Block + alert |
#Anomaly Detection Model
from sklearn.ensemble import IsolationForest
import numpy as np
# Features: login_hour, apps_accessed, data_volume, location_distance
X_train = np.array([...]) # historical normal behavior
model = IsolationForest(contamination=0.01)
model.fit(X_train)
# Predict anomaly
new_behavior = np.array([[2, 3, 1000000, 50]]) # 2am, 3 apps, 1MB, 50km
prediction = model.predict(new_behavior)
# -1 = anomaly, 1 = normal#Intelligent Provisioning
#Auto-Provisioning
AI bisa mengotomasi provisioning berdasarkan:
New hire: Junior Developer di team Backend
AI Recommendation:
1. Create account di IdP
2. Assign role: developer-backend
3. Grant access: GitHub, Jira, AWS (readonly), Slack
4. Add to groups: engineering, backend
5. Schedule: MFA setup reminder dalam 24 jam#Access Optimization
AI secara berkala mengoptimasi akses:
# Analyze unused access
find_unused_access() {
for user in all_users; do
for access in user_accesses($user); do
if last_used($access) > 90_days; then
echo "$user: $access unused for 90+ days"
fi
done
done
}Tip
AI dalam IAM harus selalu dalam mode advisory — memberikan rekomendasi yang harus di-review oleh manusia sebelum diterapkan. Auto-apply hanya untuk low-risk decisions dengan confidence tinggi.
#AI for Identity Security
| Use Case | AI Application |
|---|---|
| Credential detection | Predict compromised credentials |
| Privilege escalation | Detect unusual permission grants |
| Lateral movement | Identify abnormal access patterns |
| Insider threat | Detect behavioral anomalies |
#Limitations
| Limitasi | Penjelasan |
|---|---|
| Data dependency | AI only sebaik data training-nya |
| False positives | Over-alerting bisa menurunkan trust |
| Explainability | Sulit menjelaskan mengapa AI decide tertentu |
| Adversarial | Attacker bisa menipu model |
#Penutup
Inti yang harus dibawa pulang:
- AI membantu access decisions berdasarkan peer comparison dan usage patterns.
- Anomaly detection dengan ML mendeteksi perilaku di luar baseline.
- Intelligent provisioning mengotomasi joiner/mover/leavers.
- AI harus dalam mode advisory — humans tetap final decision maker.
Di episode 23 selanjutnya kita akan membahas decentralized identity & verifiable credentials — W3C DID, verifiable credentials, dan self-sovereign identity. Siapkan identity masa depan kalian!