Howto Approach Identity Management?

Transcription

1 Security Circle Howto Approach Identity Management? IT Architect

2 Agenda Identity Management? Howto approach an identity management project? Project experience

3 A great number of requirements from various perspectives and stakeholders motivate Identity Management projects New user takes long High Privileges Audit Trail Many Password Resets Calls Self Service RBAC Role Model Paperbased Process Many Manual Tasks Who has what access and why? Job Changes Service Request Management Proprietary Systems Too many access rights High Audit Costs Delegated Administration Compliance Reporting Automation Single Sign On Remove accounts on leave Orphan Accounts Request based New Requirements Frustrated End Users Mergers

4 Identity management is a process for recognizing and monitoring users, and granting or restricting their access to business assets or resources. Person join/move/leave Account add / remove Identity attributes management Identity Revalidation Enterprise role management Identity Trusted Identity Store Provisioning Reconciliation Account revalidation (access & privilege) Role assignment revalidation Authoritative Identity Source Ad hoc reporting Compliance reporting Reporting/ Auditing Access Authentication, Authorization Password Mgmt Single Sign-On

5 Identity management systems help to automate the functions performed by identity management processes and workflow. Manager Audit Help Desk ID Admins HR HR System Identity data for Employees Identity Feed Web Interface Identity Mgmt Solution Provisioning Add / Modify / Delete of Accounts Active Directory Lotus Notes RACF SAP...

6 As we now understand what Identity Management is and how a tool can support it, the right priorities are the key to approach such a project? Security / Compliance / Audit Remove accounts on leave Audit Trail New user takes long Cost / Efficiency RBAC Role Model Many Password Resets Calls Compliance Reporting Orphan Accounts Job Changes Many Manual Tasks Paperbased Process High Audit Costs Who has what access and why? High Privileges Too many access rights Delegated Administration Automation Self Service Proprietary Systems Single Sign On Service Request Management New Requirements Request based Flexibility Mergers Frustrated End Users End User Satisfaction

7 The best practice deployment strategy is based on quick wins to ensure smooth integration by considering the identified priorities Targets Functionality User Groups Time User and business awareness of solution and benefits are visible from and early stage. Many manual processes can be replaced by automation. Password management can be implemented for a large number of users. Leaves any required development of adapters to later phases. Broadens skills and understanding within the organisation at the first phase. Eases the solution gently into the business. Phase A : Business Analysis Roles and Policies Phase 0 Design / Analysis Phase 1 Password Management Phase 2 Auto Provisioning & Workflow for Infrastructure Accts Phase 3 Policies and Roles Defined Phase 4 Custom Adapter Phase 5 Maturity Repeat Phase 1 and 2 for additional Systems and Apps as requirements are defined Foundation : Infrastructure Systems Non Infrastructure Systems and Apps

8 Large Swiss University Client Requirements Decomission existing, legacy account management tools Be prepared for new requirements Fully automated process due to delegated administration model Client Profile users 20 target systems Multiple Identity Sources Delegated Administration Complex processes Approach Focus in the first phase on largest platform: Lotus Notes, LDAP Create Roadmap for further phases Document processes and use cases Automate as much as possible but focus on key processes

9 Swiss Medical Technology Company Client Requirements Automate current, manual processes Eliminate paper based request forms Decrease Audit costs Ensure least privilege principle Client Profile users worldwide 10 target systems Relative simple processes Approach Focus in the first phase on major platform: Active Directory, Lotus Notes Integrate Applications via manual services until a technical integration is developed to allow the decomissioning of paper based request forms Create Roadmap for further phases In further phases those applications will be technically integrated Document processes and use cases

10 International Insurance Company Client Requirements Enable consistent and efficient compliance to legal and regulatory requirements Automation of manual processes is not the first priority Approach Focus in the first phase on major platform: Active Directory, Lotus Notes, Mainframes Document processes and use cases by focussing on compliance relevant processes Harmonize processes across countries Create Roadmap for further phases Client Profile users europe wide 6 target systems Strong technical dependencies between systems Different country organisations

11 Swiss Insurance Company Client Requirements Enable consistent and efficient compliance to legal and regulatory requirements Enable flexibility for new business requirements Automation of manual processes is not the first priority Approach Focus in the first phase on compliance relevant systems and processes: Client Profile users worldwide 200 target systems Strong technical dependencies between systems Top-Down role model developed without system to maintain it Establish proper authoritative source and allow assigning accounts to users Password Management Reporting Integrate Applications via manual services until a technical integration is developed Create Roadmap for further phases Document processes and use cases

12 Conclusion Define a long term roadmap for the identity management solution Obtaining executive sponsorship/business unit buy-in Get HR involvement and commitment Empowerment of the identity management implementation team Divide the project into stages and start small Deliver quick wins Managing the change and communicating with the business, end-users and IT organization is key. Ensure sufficient data is gathered in order to plan, design, and rollout the solution Who are you? What privileges do you have?

13 Thank you!