Identity and Access Management Roadmap

Identity and Access Management Roadmap

BENEFITS

Identity and Access Management (IAM) projects bring a promise of tremendous business and security benefits. Some of the most obvious reasons to automate your IAM program include:

  • Time Savings: Automation of user provisioning and governance, such as user access reviews, provide tremendous value and labor savings.
  • The Right Access: Automation, especially provisioning by role-based access, leads to consistency of access. Users get the right level of access for their position.
  • New Hire Day One Access: By using automated user provisioning, new hires can have their accounts created and access established before beginning, optimizing the on-boarding process.
  • No User Left Behind: An IAM program will easily identity and help avoid orphaned user accounts, those left behind when workers leave the organization.

TIPS

Unfortunately, IAM projects are often plagued by high failure rates and run the risk of long delays. Failures and delays are typically due to a combination of project management and technology. You should develop your plan and IAM roadmap before beginning project implementation to ensure your solution meets your requirements. Some important tips include:

  • Phased Approach: Before jumping to the end, the well-defined roadmap will ensure success or you will stop the project along the way rather than risk failure.
  • Early Success: Each step should realize project success to enable support for the effort. For example, in Step 1 you will deliver automated user access reviews, realizing massive time and business benefits.
  • Set Measurable Milestones: Your plan should include concrete deliverables such as automating entitlement reviews, automating user on-boarding, automated user termination, and more.
  • Set Realistic Expectations: You will not enable full role-based provisioning in one week. Moreover, not every company or person will fit cleanly into a business role. Rather, we should set expectations and goals that move the program forward, providing value and benefits, rather than perfection.

IAM Roadmap

A well-designed roadmap is essential for a successful Identity and Access Management program. Common pitfalls and project delays can be avoided by following a three-step process, gaining success at each phase of the project. At SCC, we advise our customers to focus on these 3 steps:

  1. Governance: Governance is the read-only side of the project. You will learn your systems and data, and gain quick value by automating user access reviews, off-boarding, and separation of duties.
  2. Role-Based Access Controls: In order to prepare for provisioning, you should consider if your organization can create business roles that define a standard profile for various types of jobs.
  3. Automated User and Access Management: The final step is enabling the automation of user access rights changes including on-boarding, off-boarding, and role changes.

This paper will review each of these steps in more detail, providing tips and guidance on how SCC’s Access Auditor suite will help you deliver success. We will also discuss when it’s appropriate to stop the process and simply implement automated governance. By following this roadmap, you will ensure that you implement the right level of IAM automation for your environment.

Create your IAM Roadmap

Learn More

Step 1: Identity Governance

To help bring clarity to the challenge of conducting entitlement reviews, SCC is publishing this
list of some of the most important considerations for identity governance tools. Rather than just
a simple checklist, we are including details in plain English. The below six factors will ensure
your success.

The first step in any IAM program should be governance, the discovery of user access rights
systems and data. You will need to learn the current state in order to define a business role.
Before enabling automated provisioning, you will need to know what systems and applications
are in the company. This is where the governance step of the roadmap is a required first step.
The idea of automating governance is simple, and Access Auditor makes it easy to deliver
success. You will want to:

  • Define a target set of in-scope applications for Phase 1.
  • Import data and make connections to each application: This discovery is vital to the overall IAM roadmap. You might find that many applications have an API that you can leverage to manage user access rights. If so, this will ensure that we will be able to automate provisioning down the road. You might also discover that some systems only provide a report and do not have any type of API. For these applications, provisioning might require some type of script or robotic process automation tool or simply can’t be automated.
  • Discover who has access to what: By connecting and reading application data, you will build your access rights warehouse. This access rights data warehouse will be the foundation for building the business roles that will allow more powerful access provisioning.

We can expect tremendous success from identity governance automation. Gaining some “quick wins” will not only deliver value to the company, but also provide support for the ongoing project. Three of the most meaningful benefits include:

  1. Automating user access reviews: User access and entitlement reviews typically involve a
    very labor-intensive process we call the spreadsheet rodeo. Companies will collect various
    reports of who has access to what, send them around the company via email, then save the
    results into an archive email account. This entire process can be automated with Access
    Auditor in under a week.
  2. Helpdesk resource for off-boarding: Even before we implement automated changes to
    user accounts, having our data warehouse from Access Auditor provides a single view of
    who has access to what. Helpdesk teams can use this resource to ensure all accounts from
    terminated users have been removed or disabled.
  3. Alerts on Changes and Separation of Duties: Since Access Auditor is reading data
    from various applications on a regular schedule, changes to users and access levels are
    detected and monitored for potential SOD conflicts.

Access Auditor Automates Identity Governance

Since 2005, Access Auditor has been the leader in fast and simple identity governance. Access
Auditor imports data from any on-premise or cloud application. Our Universal REST connector
allows easy integration with ANY REST-enabled cloud application. On-premise options include
Active Directory/LDAP, any database or ODBC connection, or any delimited text file.

One key to success for Step 1 is linking the users together into a single access rights
warehouse. Users from various applications may or may not share a common login ID, but we
still need to connect the accounts to the right person. Access Auditor addresses this critical
requirement with the Identity Mapper and the Fuzzy ID.

The Identity Mapper allows for rules to link users together. You can of course link users if they
share a common login ID, but you can also use alternatives such as email, employee ID, or
custom attributes. In fact, ANY custom value can be used to link users back to their single
profile.

When applications have no common login ID, no common key at all, the Fuzzy ID will help.
Using our proprietary AI engine, the Fuzzy ID will identify users that look to be the same across
multiple applications, giving you a weighted ranked list to confirm or deny, forever joining the
accounts together.

With accounts joined together, user access reviews can be launched with the push of a button.
Access Auditor gives the most advanced and customizable layout to make the user experience
exactly how you wish it to be.

Benefits of Automated Identity Governance

Completing Step 1 in the IAM Roadmap gives tremendous benefits, including:

  • Rapid success, validating the project and encouraging support
    • Automated access reviews
    • Automated alerts on changes
    • Data warehouse of who has access to what
  • Discovery of applications and systems before beginning the provisioning step gives us the assurance of a successful project.
  • Confirm and set expectations by learning which systems support API connections
  • Provides the full data needed to create enterprise roles.

Step 2: Role-Based Access Controls

Role-Based Access Controls can greatly simplify the management of user access controls, but not all
companies have enough consistency to success with RBAC. In practice, therefore, we find that not
all companies will perform Step 2. Many simply obtain the benefits of automated access reviews and
stop there.

By following our IAM Roadmap, Step 1 will provide the user access rights data we need to perform
RBAC data analytics and determine if we do have enterprise roles. SCC’s Role Manager includes a
role mining feature to help you define your enterprise roles.

We encourage our customers to set proper RBAC expectations. You will almost certainly not have
any “perfect fit” of roles. Most everyone will have some amount of excess privileges. The goal of an
RBAC effort would be to collapse a large list of entitlements into a subset of roles that cover 60-80%
of the assigned privileges.

Benefits of Role-Based Access Controls

The benefits of RBAC are two-fold:

  1. First, having a collection of entitlements bundled into a role allows a much simpler and more effective access review. Rather than reviewing the large list of user access rights, users can be reviewed by their pre-defined role and the handful of extra privileges (exceptions) to their role.
  2. In addition, enterprise roles can be the foundation of Step 3 Automated User and Access Management. When using RBAC, the majority of a user’s permissions can be added at once, giving a strong on-boarding experience.

Step 3: User and Access Management

The final step in your IAM Roadmap is the automated management of users and access rights. After
completing Steps 1 and 2, we will have excellent knowledge of our environment and our roles will
be defined. Because we completed the background steps first, automating the management of user
accounts is as simple as configuring the connections to each application.

One of the easiest and fastest returns on investment will be to automate terminations. Users leaving
the organization require no special workflows and accounts can be removed automatically once a
user is no longer an active employee. This should be one of the first use cases in order to deliver an
early project success.

Another large time savings will be the automatic creation of accounts for new users. When configuring
user provisioning, you will generally have three possible approaches:

Option 1 – Create and Delete Only

The first option for user management automation is to limit the scope to only creation and deletion
of user accounts. When a user is added to the HR system, the IAM automation (SCC’s Access
Manager) will create the accounts in the necessary systems. Likewise, terminations will trigger
disable or removal. This approach is very simple and fast to implement. Generally all users will be
created in a similar fashion; disabling or deleting a user account will be the same for everyone. This
option requires no special workflow, making it easy to deploy.

The limitation of this approach is that it does not address the specific entitlements or access levels
each person needs.

Option 2 – Flowchart Approach

The second possibility for user management will be to design a flowchart approach for each type of
user that might need access. This option involves defining a rules-based approach to on-boarding
that will be initiated by some triggered change. For example, you might have a trigger that says when
a person is hired into job title “customer service rep”, the provisioning system will follow a chain of 10
different steps that will create the user account, add certain privileges, create another account in a
different application, and so on.

This option can be very powerful to not only create the user accounts but also add the right privileges.
The downside is that you would need to define and manage the workflow rules for each possible
category of user. In most companies, we would expect a large number of unique combinations that
will need to not only be defined, but also reviewed ongoing to ensure accuracy. This Option 2 is more
powerful but requires potentially more overhead to maintain.

Option 3 – Role-Based Access Controls

The final option would be to leverage the roles that we defined in Step 2 above to provision users to
their business role. Once the role has been defined, the Access Manager will automatically create the
accounts and add the necessary entitlement to each person to make their access rights match the
role. Likewise, when a person is no longer in the Role, the Access Manager can remove them from
the applications.

This option is the most automated and easy to maintain approach to provisioning. As a role is redefined,
all users will automatically be changed to conform to the role. This approach works very well
when roles can be defined. In practice, certain organizations or types of users do not lend themselves
to clearly defined roles. In smaller organizations or departments such as Information Technology,
users often have unique levels of access depending upon their specific projects.

The most efficient approach is full Role-Based provisioning, but many users will not fit cleanly into
a role. Triggered workflows rules can handle any specific use cases, but they have a significant
overhead in maintaining many rules. How then should we move forward?

The Hybrid Approach

SCC’s Access Manager supports a combination of approaches to deliver success to your IAM project.
Many users will have very consistent permissions and RBAC provisioning will deliver outstanding
results. Others may require special workflows depending upon certain job codes, departments,
or other attributes. The results of Step 1 – Identity Governance and Step 2 – Define Roles will
determine which approach to use for provisioning which users.

Benefits of Automated User and Access Management

The benefits of automated user management are significant:

  • Time Savings: Automation of user provisioning and governance, such as user access reviews, provide tremendous value and labor savings.
  • The Right Access: Automation, especially provisioning by role-based access, leads to consistency of access. Users get the right level of access for their position.
  • New Hire Day One Access: By using automated user provisioning, new hires can have their accounts created and access established before beginning, optimizing the on-boarding process.
  • No User Left Behind: An IAM program will easily identity and help avoid orphaned user accounts, those left behind when workers leave the organization.

IAM Roadmap Tips

As you consider your IAM program, SCC recommends a few tips for success:

  • Phased Approach: Before jumping to the end, the well-defined roadmap will ensure success or you will stop the project along the way rather than risk failure.
  • Early Success: Each step should realize project success to enable support for the effort. For example, in Step 1 you will deliver automated user access reviews, realizing massive time and business benefits.
  • Set Measurable Milestones: Your plan should include concrete deliverables such as automating entitlement reviews, automating user on-boarding, automated user termination, and more.
  • Set Realistic Expectations: You will not enable full role-based provisioning in one week. Moreover, not every company or person will fit cleanly into a business role. Rather, we should set expectations and goals that move the program forward, providing value and benefits, rather than perfection.

Summary

Our Identity and Access Management Roadmap gives an excellent path to follow for identity success.
Whether you stop and gain a quick win with automating user access reviews or continue through
automated user access management, Access Auditor and Access Manager will ensure your project
success.