Iværksættende proces omkring Identity & Access Management

Transcription

1 Iværksættende proces omkring Identity & Access Management Er der argumenter nok? Dubex Security & Risk Management Summit 7. November 2013

2 Agenda NNE Pharmaplan What is it IAM can do? Technical Benefits why IT want it! Compliance Benefits why QA want it! Economic Benefits why the CFO want it! Why do I want it? How to build the case for IAM The Truth Presenter Further reading

3

4 What is it IAM can do? HR System Privileged Account Management Identity & Access Management User Administration Self service - Manager approvals - Employee requests warnings etc. Access Governance Human Ressource - Create new employees - Delete terminated employees - Changes roles Active Directory Access Logging System A IAM Authentication API System X System B System C IT Security/Compliance Officer - Compliance Dashboard

5 Technical Benefits why IT want it! All user administration is automated and done in a timely manor Most processes are detailed as workflows you only think once Source separation (kildesortering) data/system owners know their data better than IT (and they do all the work!) Better service to business workflows with automated processes and selfservice for customers are far better than manual processes handled via s, Servicedesk, post-it s, Excel,.. Fever mistakes. No more embarrassing audit findings.

6 Compliance Benefits why QA want it! Compliance dashboard real-time. Know where the biggest risks are. Audit trails for all accesses and access changes Extensive reporting capabilities Audit/reporting can prove compliance to auditors Access rights of unstructured data - such as file servers - can be cleaned up ( reattestation ) on a regular basis Revision of - e.g. ERP/Finance - systems can be automated, and system owners can be alerted of unwanted access attempts Policies ensuring segregation of duties can be enforced in workflows

7 Economic Benefits why the CFO want it! Arguing tangible benefits for IT projects is a dangerous endeavor. Building a business case for IAM requires a lot more than proving 300 hours/year saved in IT. An IAM system will free up time currently used for user and access administration! You can try investigating the approximate time spend on daily/weekly/monthly tasks. Remember ALL systems. Not just AD, the ERP system and the odd file server. All of them. It is a challenging task! And you can t win. Using IAM to clean up your user DB s, removing terminated users, dual accounts etc. can help prevent over-licensing of software (e.g. Microsoft CAL s). Agility in processes. Self-service. Time to market for LoB will be faster than waiting for manual processes.

8 Why do I want it? Clean up legacy mess Too much unstructured data (25 TB) governed by very old homemade IAM system - automatic data owner identification, access re-attestation, and continuous reporting to data owners, is a dream come trough Future proofing IT New Sharepoint/Sharepoint Online based Document Management System New ERP system SSO for all new applications utilizing an Authentication API Cloud services (like O365) IT Security/Compliance Security and compliance I can trust for (almost) all systems. No admin can change accesses undetected. Efficiency A transparent and consistent (web shop look-and-feel) user self-service for all systems Workflow engine will enable a more holistic user administration. Why not add users to every single relevant system in one process instead of numerous manual?

9 Traditional Perimeter Paradigm Applications File Servers ERP Sharepoint The Evil Internet HR Active Directory... Sales

10 New Perimeter Paradigm Applications File Servers ERP Sharepoint HR Active Directory... ADFS Federated AD

11 How to build the case for IAM As-Is Analysis - list all the things that don t work properly today - with emphasis on audit findings (if you have any) To-Be Scenarios - time saved both in IT and LoB - it security and compliance - ready for cloud services Implementation Risks Very difficult project technically. Many system integrations have to be done. No guarantied success for all those legacy systems we all struggle with High demand for change management and communication to LoB Possibly an uphill battle teaching IT security alongside the project. Remember no system will ensure compliance if end-users are ignorant or ignore the rules!

12 The truth IAM solutions are too expensive! Market is finally evolving, but vendors have difficulties finding the right price. IDaaS solution will come soon. Expect e.g. Microsoft to move into the area. Financial institutions have been doing IAM for a while. The public sector and the pharmaceutical business are next. Beware some vendors make even more money helping you do the implementation than selling the software!

13 Presenter Henrik Mohr Manager, Global IT Operation NNE Pharmaplan IT Manager UK NDS Ltd (now Cisco) Southampton, United Kingdom IT Manager DK NDS Denmark Copenhagen, Denmark AGENCY.COM Visionik Copenhagen, Denmark IT University of Copenhagen Master, IT Management and Strategy (ILS) University of Copenhagen B.Sc. Chemistry dk.linkedin.com/in/hmohr

14 Further reading Is Identity The New Perimeter? Gartner Identity and Access Management Summit Magic Quadrant for User Administration and Provisioning, Gartner Research (G ), December 2012 Author: E. Perkins A6: Cost, Consequence and Value: The Economics of IAM Speaker: Earl Perkins How do we measure the value of IAM? For many, justifying IAM has been elusive. It remains a horizontal concern in the vertical world of business services, something shared by all business functions but owned by none. How can an IAM project be reconciled with the budgets of business?