How Identity and Access Management can enable Business Outcomes and Enterprise Security

Transcription

1 Hw Identity and Access Management can enable Business Outcmes and Enterprise Security Srikanth Thanjavur Ravindran Suresh Chandra Bse Ganesh Bse Abstract In tday s cnsumer driven enterprises, infrastructures are remte and distributed while business and IT peratins are pervasive thrugh mbile and virtual technlgy. Custmer cllabratin and cmmunicatin n scial platfrms and disruptive service mdels such as (Bring Yur Own Device) BYOD and Bring Yur Own Applicatin (BYOA) have bradened the security perimeter and increased the risk expsure pints. In this scenari, the need fr an identity and access management (IAM) slutin has becme paramunt and is a tp agenda item fr mst chief infrmatin fficers (CIOs). In this sessin we will discuss key fcus areas t establish hlistic IAM slutins such as effective gvernance, autmated rle management, authenticatin, user prfiling and integratin. Bigraphy Srikanth Thanjavur Ravindran is a Senir Cnsultant with Cgnizant s Business Cnsulting practice. Ravindran has diverse glbal experience with multiple Frtune 500 cmpanies within the technlgy, telecmmunicatins, il & gas dmains. His specialties include IT transfrmatin, IT Strategy, ITSM, IT gvernance, risk management, infrmatin security, service delivery and infrastructure prgram management. He has published papers n tpics such as BYOD, Identity and Access Management and IT Service Management at prestigius frums like ISACA and ITSMF. Suresh Chandra Bse, Ganesh Bse is a Manager Cnsulting at Cgnizant Business Cnsulting practice. Suresh is based ut f Austin, Texas and has been in the IT Industry fr mre than 16 years with vast Cnsulting experience in varius industries and executed Strategic initiatives fr varius Frtune 100 cmpanies in the areas f PMO, PPM, Prcess Cnsulting, Prgram Management, TMMI assessment/implementatin, Organizatin Strategy, Test Cnsulting and CIO/Gvernance Dashbard/Metrics fr varius clients acrss the glbe. Cpyright Srikanth, Thanjavur Ravindran and Suresh Chandra Bse, Ganesh Bse Cpies may nt be made r distributed fr cmmercial use Page 1

2 1 Intrductin and Evlutin int Identity Gvernance The means f measuring business benefits f Identity and Access Management (IAM) initiatives and the ROI frm IAM slutin investments have been debated withut much cnsensus in bardrms virtually since the inceptin f technlgy. This has led t hesitatin n the part f spnsrs t endrse IAM undertakings leading t unrealistic deadlines, insufficient budgets and ver wrked staff. During the past few years thugh, business agility has intensified, fueled by technlgies such as clud cmputing, remte infrastructures, mbility and BYOD / BYOA. IT has undergne shifts f its wn due t disruptive service mdels in the frm f multivendr utsurcing, Sftware as a Service (SaaS), multitenancy and virtual infrastructures. These shifts have increased the fear f the unknwn due t rganizatinal, custmer, financial and IP data mving utside the rganizatin s security parameter. These changes have als given rise t a plethra f regulatins with heightened penalties fr nncmpliance. All this has cntributed t transfrm IAM frm a prcess fr managing access t data and systems t a gvernance mechanism. Sme f the key bjectives f IAM in tday s envirnment are: Service delivery t the business acrss hsted, remte, physical and virtual infrastructures Secure cllabratin with custmers, partners and emplyees Technlgy prvisin using access mdels spanning acrss web, mbile and applicatin prgramming interfaces Rle management thrugh rle definitins, user grups, identity verificatin, and authenticatin Cmpliance with regulatry requirements thrugh persnal data security, enhanced access cntrl and privileges management Allw line f businesses (LOBs) t simplify access decisins based n trend analysis and save csts by ratinalizing system licenses 2 Key cnsideratins fr success in IAM Figure 1: Vices In The Industry Cpies may nt be made r distributed fr cmmercial use Page 2

3 Fllwing are sme essentials fr a successful implementatin f IAM: Figure 2: Implementatin Cnsideratins Figure 3: Critical Success Factrs Cpies may nt be made r distributed fr cmmercial use Page 3

4 2.1 Rle Plicy Management and Prvisining Prvides real-time enfrcement f plicy/rule and rle based user access t functinal and data levels acrss all applicatins within an rganizatin Prvides centralized administratin f rles/plicies/rules/resurces Serves as a central repsitry f rle/plicies/rule/resurces, thus simplifying business intelligence and cmpliance audit data gathering effrts, and helps t create a mre cmplete view f user access in an rganizatin Supprts enfrcement f Segregatin f Duties (SD) preventing cnflict f interest situatins 2.2 Access Certificatin and Gvernance Autmates discvery, analysis and management f user access rights Emplys Least Privilege Access Principle (i.e. users are given access t nly what is required t perfrm their jb functin) Facilitates peridic review and re-certificatin f access by business managers and data wners Ensures manual r autmated remedial actin t rectify access rights exceptins incnsistent with plicy r regulatry requirements Demnstrates cmpliance with applicable regulatins r business plicies Enables multi factr authenticatin such as bimetrics fr sensitive data r PII (persnally identifiable infrmatin) Figure 4: Access Gvernance 2.3 Single Sign On (SSO) Emplys identity federatin fr securely sharing digital identities with custmers, partners and remte users acrss platfrms Captures identities and recrd audit trails fr web services transactins Cpies may nt be made r distributed fr cmmercial use Page 4

5 Externalizes entitlement lgic frm applicatins and achieves centralized security aviding need fr building security int individual applicatins thereby reducing cmplexity Enables secure delivery f service and cst effective nline cllabratin 2.4 Brad tenets f SSO: Web Crss Platfrm Federatin Enterprise Figure 5: Single Sign On 3 Business case fr autmatin f IAM Critical success factrs fr autmatin Figure 6: Autmatin Cmpnents Cpies may nt be made r distributed fr cmmercial use Page 5

6 Figure 7: Business & IT benefits 4 Illustrating and augmenting thrugh measures While IAM is a cmplex initiative t identify measures fr, analytics and measurements can g a lng way in helping the rganizatin achieve their business bjectives. Types f metrics that can be measured are: Metrics that cntribute t achieving custmer utcmes and influencing them Metrics that impact financial perfrmance and Metrics that mnitr cmpliance These can be mnitred at multiple levels such as strategic, tactical and peratinal t btain a tp-dwn 360 degree view Cpies may nt be made r distributed fr cmmercial use Page 6

7 Figure 8: Perfrmance Metrics Identity intelligence shuld cmprise f analytics n identity related status and trends. Sme f the reprts that culd be generated fr analysis are: Ambiguities in entitlements, user prfiles, accunts and rles mapped t licensing Privileged user access and zmbie accunts (accunts that remain active after user has switched rles r left the rganizatin) DLP mnitring lgs n sensitive transactins (financial statements, mems) and ambiguities in identities and entitlement level authenticatin Histrical access infrmatin n transactins / events mnitred Threats such as DDS and APT can be mnitred and reprted upn and analyzed t enhance security capabilities Mnitring lgs f privileged user accunts, as they wuld be vital fr frensic analysis Access attempts frm hackactive regins mnitred using getagging 5 Summary Thrugh the earlier sectins we have established why IAM is n lnger a debatable ptin but a definite need fr rganizatins wanting t align themselves better thrugh agile and flexible IT mdels, save csts, imprve perfrmance against cmpliance standards, secure their infrmatin and stay ahead f Cpies may nt be made r distributed fr cmmercial use Page 7

8 cmpetitrs. An effective IAM strategy cupled with innvative and best in class technlgies with the abve mentined capabilities can be a true enabler f business prcess innvatin and help in recgnizing the maximum value f investments. In a cmpetitive business envirnment where business services are increasingly being delivered ver cllabrative and scial platfrms, IAM can prve t be a key enabler f differentiatin in enterprise risk management, cmpliance initiatives, custmer alignment, relatinship management, reduced TCO, increased prductivity and imprved security. 6 Glssary BYOD - Bring Yur Own Device BYOA - Bring Yur Own Applicatin IAM - Identity and Access Management CIO - Chief Infrmatin Officer ROI - Return On Investment SaaS - Sftware as a Service LOB - Line f Businesses SD - Segregatin f Duties PII - Persnally Identifiable Infrmatin SSO - Single Sign On DLP - Data Lss Preventin DDS - Distributed Denial f Service APT - Advanced Persistent Threats TCO - Ttal cst f wnership IT Infrmatin Technlgy IP - intellectual prperty Cpies may nt be made r distributed fr cmmercial use Page 8

9 8 References Thanjavur Ravindran, Srikanth Slving The Identity and Access Management Cnundrum. ISACA Jurnal Vl.5, 2013 Kelly M. Kavanagh, Oliver Rchfrd. Gartner Magic Quadrant fr Security Infrmatin and Event Management. 25 June ID: G Maler, Eve. Andras Cser The Frrester Wave(TM): Enterprise Clud Identity and Access Management, Q3 2012", Frrester Research, Inc., July Kuppinger, Martin Kuppinger-Cle Leadership Cmpass. Access Gvernance, February 2013: Cpies may nt be made r distributed fr cmmercial use Page 9