Analyst says multiple types of software, business controls and processes are key to successful identity and access management.