January 11, 2023 | Author: Kanika Anand
IDENTITY AND ACCESS
MANAGEMENT IMPLEMENTATION
– BEST PRACTICES TO AVOID FAILURES
Identity management is key to ensure trust, privacy, and security as well as to facilitate collaboration and improve analytics.
– William Crowell
Former Deputy Director, Board Member
National Security Agency (NSA)
As organizations are expanding and remote work becomes a normal way of life, it is important to understand Identity and Access Management (IAM) needs and implement the required IAM solutions to reduce security threats.
Major reasons for identity related data breaches may include having an ineffective IAM program or not having one at all. A recent poll survey campaign conducted by Templar Shield shows that while most organizations have implemented an effective Identity and Access Management program, there is still a sizeable portion of organizations accounting for 25% that say they do not have an IAM program.
Also, as per a recent study by Gartner, it was discovered that 67% of respondents are aware of their identity challenges but are unsure of how to fully address it. Although 58% of respondents deemed identity management to be of utmost importance, 61% of respondents said that their company believes identity management is too time- and money-consuming to manage effectively on a continuous basis.
The importance of IAM is recognized by businesses worldwide. But while the technology is being widely adopted today, implementation has always been difficult and complex, and unfortunately remains so.
In essence, IAM thrives on striking a balance between user experience and data security. There is a greater need for reliable identity and access management solutions as systems, users, and data volumes increase. Because of their extensive trail of implementation complexities, traditional IAM products, which are intended to improve an organization’s productivity and security, have instead turned into a complicated problem for organizations.
Identity and Access Management implementations take a long time to complete (usually around 6-18 months) and often do not produce results that were promised. The complexity eventually causes the entire implementation to fail by falling short of expectations of the stakeholder executive committee.
IAM solutions have always been expensive because they have complex workflows that require an expert to carry out. If proper analysis is not conducted beforehand, these challenges can also have an impact on the schedule and budget.
Major Causes of implementation failure:
Based on experience, Templar Shield has identified a variety of factors that can contribute to the failure of an Identity and Access Management Implementation:
Lack of clear objectives – One of the first challenges that c-suite executives face is defining clear objectives. It becomes important to understand what your IAM requirements are for a successful and less complex implementation process. Common questions that must be asked as the first step may include:
- What issue are we trying to address?
- Do we want to work on improving user experience?
- Do we require stringent privacy policies or self-service functionality to request and revoke access?
Not being aware who the users are – Gone are the days when users simply included the employees and contractors of an organization. In the complex business environment today, users are not only traditional employees and contractors but also include third party vendors, bots, and external business applications. It is important to understand that every user will have a different requirement and risk profile. An IAM program will help an organization to keep track of what the user is doing and how the confidential data is being utilized. The recent SolarWinds breach was a tough reminder that technological advancements will always carry inherent risks. Managing both internal as well as external user identities is key to gaining comprehensive cyber security for any organization.
Lack of proper planning – IAM implementation is complex and resource intensive. Not planning proper resources and when business grows, not planning to meet the changes in technology and not being able to meet new demands can all lead to IAM implementation failure.
Lack of auditing – As businesses grow and move toward achieving new goals and objectives, users require different access rules to fit their new role. Here, revoking access to previously required resources must not be skipped. If not done, it can lead to a situation where users have access to apps or data that they no longer require.
Insufficient training – IAM implementation is a set of complex processes. Proper training for employees handling such complex tasks must be scheduled. They must be up to date with the technological advancements in the field and must possess necessary skills required.
Best practices for managing an effective IAM program:
Create a long-term roadmap – a successful implementation requires a long-term program which is aligned with the goals of the organization, has several phases and proper governance. It will also reveal gaps in the implementation plan. Stick to the roadmap as much as possible, but leave a little room for flexibility, as market conditions and business strategy may change.
Provide proper training to employees managing the complex implementation processes – it is important for the people involved to understand the tools well before implementation. Training should be an on-going process.
Choose your service partner wisely – depending on the organization’s objectives, choose the right service provider to ensure you stay within the stipulated time, budget and most importantly you are able to achieve the expected outcome.
Identify your end user – End users should have a strong representation in the project scope because they will be the ones most impacted by an IAM system. To ensure you comprehend how they use their various applications on a frequent basis, involve users from various departments. You’ll get a clearer idea of how they’ll have to adapt to the changes the IAM solution will bring in.
Conduct a routine inspection – it is suggested to revisit your IAM policies semi-annually. The recent poll survey campaign conducted by Templar Shield shows that 35% of organizations revisit their policies and programs every 6 months.
Every organization requires an IAM solution on some level. Part of thorough planning for a successful and efficient IAM implementation is understanding associated pitfalls and knowing how to avoid them.
To know more about Identity and Access Management implementation, contact our experts at Templar Shield – info@templarshield.com
References:
- https://www.mercurymagazines.com/pdf/five_keys_to_a_successful_identity.pdf
- https://www.gartner.com/en/conferences/hub/identity-access-management-conferences/insights/planning-guide-iam
- https://explore.radiantlogic.com/c/gpi_identity_data_managementroadblock_or_business_enabler?x=qodikf#page=1
About the Author:
Kanika Anand is an IGA Consultant at Templar Shield. She works with clients to understand their requirements and build roadmaps for effective IAM/ IGA program implementation.
For more information, please reach out to: kanika.anand@templarshield.com
