AllH2FY20 Get IAM Right: Identity Governance eBook
H2FY20 Get IAM Right: Identity Governance eBook
You go straight… down the
hall, turn right… go about
30 feet, jog to the left…
straight ahead… turn right
for the next two corners…
first door says ‘Authorized
Personnel’… You’re
musicians, aren’t you?
Rock and roll! Hello
Cleveland! Hello Cleveland!
Backstage maintenance guy
Derek Smalls, and Nigel Tuffnel
This is Spinal Tap – 1984
In a perfect world, getting it right would be easy. The risks of inappropriate access
or activity would be minimal because all of it would be controlled by the right people
with complete visibility into proper ownership and responsibility. Your organization
Identity Governance – the
could easily satisfy compliance requirements. If an auditor asks for information, or
you need a periodic entitlement recertification, you could generate an accurate and
user-friendly report with just a few mouse clicks. But, unfortunately, we don’t work
in the perfect world. We work in the real world where getting it right never happens
path to agility
by accident.
For most organizations, governance is a major challenge. In fact, governance can’t
even be considered until access, security, control and management have been
achieved. If simply provisioning access is difficult, leveraging that access to enable
business agility – the goal of governance – is impossible. If all your time is spent
remedying a forgotten user password, for example, how are you going to ensure
that the correct controls are in place so that the user had the appropriate access in
How often do our efforts at governance seem
like the futile attempts of the Spinal Tap band
members to find their way to the stage? And
how often do we, in spite of our best intentions
and efforts, find ourselves wandering through
the first place? And that’s just a couple of components of being compliant. The real
challenge is proving compliance. It’s a complex situation.
Several key governance factors are involved in a typical audit. They may take
different forms, but it all boils down to:
•
access across the entire environment as efficient as possible. This includes
the maze of our organization, hoping to stumble
the more important security-related action of de-provisioning. While
provisioning itself is an access management activity, without provisioning
across the stage door that leads to identity
done right, governance is impossible. To complicate things further, the
governance?
resources that must be provisioned, and therefore governed, have expanded
beyond the typical control of the organization and into the world of the cloud
For our discussion, governance is defined as business-enabling activities that move
and digital transformation
technology beyond simple efficiency tools into the realm of confidently and correctly
providing access and performing administrative activities. This also means all this is
Provisioning – making the process of thoroughly and correctly granting
•
done with the full knowledge and endorsement of the organization, while satisfying
Workflow – showing the steps from access needed to request to fulfillment,
ensuring compliant processes are followed throughout
any internal or external regulations. Providing all these requirements are met,
governance acts as the framework for how those activities should be done.
•
Attestation – fulfilling the periodic requirement to review all access
entitlements (or rights) and certify their appropriateness
Put simply, governance is ensuring that:
•
4
•
The right people…
•
Have the right access…
•
To the right resources…
•
At the right time…
•
In the right way…
•
With all the other right people knowing what’s going on and saying it’s okay
Policy – documenting and enforcing the underlying rules that govern user
access to applications and data, as well as showing that those rules comply
with established regulations
•
Approvals – ensuring all the right people approve access requests before it
is fulfilled
•
Risk discovery and management -- a key component of achieving a governed
state is to find and remediate areas of risk. From an IAM perspective, this is
most often associated with instances of individual ownership, rights, and
Please complete the form to gain access to this content
