Hitachi ID IAM Program Launch

1

IAM Program Launch

Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications

Kickstart an IAM program with discovery of business and IT requirements

2

Agenda • • • • • •

3 3.1

Who? Introductions.

Why? Business drivers.

What? Business processes.

Where? Integrated systems.

When? Priorities and timelines.

How? Best practices guidelines.

Introductions Hitachi ID and Acme teams Acme • name, resp • name, resp

4

Hitachi ID • name, resp • name, resp

Business drivers © 2012 Hitachi ID Systems, Inc.. All rights reserved.

1

Slide Presentation

4.1

Examples Security

Cost

Service

Audit, compliance, internal controls

Help desk, security admin

Onboarding, change management, authentication

• Complete, reliable deactivation • Excess, inappropriate entitlements • Need to find, remove SoD violations • Control access to privileged IDs • Stronger passwords, authentication • Current rights, change history

5 5.1

• Password, lockout call volumes.

• Workload to setup, change, tear down access.

• Frequency and cost of audits:

• • • •

Faster onboarding Simpler change requests Clear, fast approvals Fewer passwords to remember, type

– What fraction of admin time is audit related?

• Automation replaces routine work.

Business processes The User Lifecycle At a high level, the user lifecycle is essentially the same in all organizations and across all platforms.

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

2

Slide Presentation

5.2

Examples (part 1) Onboard • • • • • • • •

Employees Contractors Vendors Customers Partners By business unit By geography New vs. rehire

Change

Support

• Identity info (name, address, etc.).

• Transfer

• Password, PIN problems • Recover HDD crypto password • Locked out of VPN. • Access denied errors • At office vs. mobile.

– Location.

– Department.

– Manager.

• Job function (role).

• Current work changes – Files/folders – Application logins.

– Fine-grained entitlements.

• Admin access

5.3

Examples (part 2) Deactivate • • • • •

Building access.

Physical assets.

Network access.

Application logins.

Tombstone (rehire, audit).

Audit • • • •

Current rights.

Change history.

Requests, approvals.

Policy violations: – – – –

SoD Orphan/dormant accts.

Excess/unneeded rights.

Consistently strong authentication.

• Admin activity.

6

Integrated systems

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

3

Slide Presentation

6.1

Examples

Integrate with enterprise apps – manual admin for smaller ones.

Primary login • • • •

AD LDAP Exchange Notes

App • • • • •

7

OS

DB • • • • •

Windows Unix/Linux.

OS400 OS390 Filesystem/homedir

Network SAP Oracle EBS PeopleSoft Vertical Custom

• Oracle • MSSQL • DB2

Other

• VPN • Smart card • Token

• • • •

Building/badge PC/installed image Desk phone/VoIP Mobile phone

Priorities and timelines

7.1 • • • • • • •

Incremental deployment Business processes change.

Infrastructure changes too (application and OS upgrades, etc.).

IAM systems link process to infrastructure If deployment takes a long time, the delivered system will meet obsolete requirements (pointless).

Conslusion: deliver fast .

There are many possible deliverables.

Conclusion: deliver early and often .

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

4

Slide Presentation

7.2

Prioritize scope

IAG deployments have ever-growing scope: • Which business processes?

• Which integrations?

• Which user communities?

Systems/applications:

O

pe

ra tio

ns :

Systems/applications

Processes:

Business process:

Auto-create Auto-disable Synch Request portal Approvals Access cert.

RBAC policy SoD policy Manual fulfillment Manage creds

7.3

Active Directory, LDAP Exchange, Notes Unix/Linux Oracle, SAP ERP VPN Client OS RDBMS

Operations: Create/delete account Set attributes Join/leave group Enable/disable acct.

Move/rename user (OU) Set password/PIN Create/manage homedir Create/manage mailbox

IAM Program Priorities Worksheet

Type of User

System of Record?

Suitable for automation?

Lifecycle event

System or application

Change volume

Value or business risk

employee

HR

No (too slow)

Hire

AD

150/month

High

contractor

Request portal

Yes

Resign

Exchange

5/month

Medium

Fire

Epic

200/month

Low

vendor

Change loc.

Change mgr.

Request access Text in italics is provided as examples only

8

Best practices guidelines

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

5

Slide Presentation

8.1

IAG Program

Hitachi ID’s most successful customers establish an IAG program : • Permanent staff allocation (technical + PM).

• Develop + retain skills.

• Deliver early and often: – Features.

– Integrations.

– Policies.

Evolving business + changing IT landscape = continuous investment.

8.2

8.3

IAG Best Practices Scope

Articulate objectives; manage scope creep.

Needs analysis

Up front investment pays off.

Incremental

Phased deployment, starting with simple deliverables.

Integrations

Add several at a time to minimize disruption.

Methodology

Consider formal PM tools, software development lifecycle.

Engage users

Plan for user education, awareness and enrollment.

Pilot

Always pilot the system before rolling out.

Measurement

Identify metrics and track before and after data..

IAG Project Risks Project Characteristics

Risks

• Many stake-holders: – Impact multiple business processes.

– Touch lots of infrastructure.

• Long timeline: – Long list of functions.

– Processes or integrations may be complex.

• Sponsors may lose interest, terminate funding.

• Stake-holder disagreements create delays.

• Changing requirements prevent detailed, up-front design.

• Complexity can overwhelm IT.

• User impact: – Training – Enrollment – Adoption

© 2012 Hitachi ID Systems, Inc.. All rights reserved.

6

Slide Presentation

8.4

Mitigating Risks

• Program, not project: – This is not a new business function – just a better way to do it.

– Changing processes and integrations plus complex deliverables mean that implementation will never end.

• Deliver early and often: – Increase visibility, credibility.

– Deliverables should be backed by metrics.

• Executive sponsorship: – Motivate stake-holders.

– Resolve conflicts.

– Engage all stake-holders early.

• Effective project management: – Phased approach: design/implement/test/rollout - repeat.

– Think software development lifecycle (SDLC).

– Communicate success, next steps to all stake-holders.

9

Project charter

9.1

Rough outline

• Business drivers: – Security – Cost – Service • Priorities: – Processes – Integrations – User communities • Create an IAM program: – Assign resources.

– Budget.

– Responsibilities • Periodically update priorities

500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@Hitachi-ID.com

www.Hitachi-ID.com

File: PRCS:pres Date: March 1, 2012