Is access management still a foundation for strong security?