Unleash the Full Value of Identity Data with an Identity-Aware Business Service Approach best practices WHITE PAPER
Table of Contents Executive Summary...1 The Evolution of Identity...2 > From User Account...2 > Identity Lifecycle...2 Enhance BSM with Identity Information...3 > Service Request...3 > Closed-loop Change and Configuration Automatic User Provisioning...3 > Proactive Incident and Problem...4 > Regulatory Compliance...4 Integrating Identity into the Environment...5 > The Role of the CMDB...5 > Out-of-the-box Integration with Other Solutions...5 > Out-of-the-box Connection to Back-Office Systems...6 Real-World Example...6 Conclusion...6
Executive Summary The World Wide Web was originally developed to permit the basic sharing of information among. people who were geographically dispersed. Think of how that original role has evolved and expanded. Today, the Web is driving rapid information technology advancement that is revolutionizing the way businesses operate. Identity management is also experiencing an evolution and expansion of its role. Identity management was originally developed to facilitate the administration of user access credentials in response to. information becoming scattered across the enterprise in multiple user accounts in different systems and domains. Administrators who had been manually managing user identity information found the process to be time consuming and error prone. What s more, administrator errors could expose the organization to significant security risks. Identity management solutions have been developed to centralize and automate the management. of user identity information within the context of security. These solutions increase administrator. productivity by automating many identity management tasks. The solutions can also boost employee productivity by providing immediate and easy access to the applications and data employees need while ensuring that this access is in compliance with internal policies and government regulations.. In addition, automation reduces the chance for error and permits enforcement of best practices. Limiting identity management systems to security-related functions, however, is like limiting the Web to rudimentary information-sharing. Identity management systems manage and maintain a wealth of user identity information of considerable value well beyond its original security context. What s more, implementing identity management solutions with a Business Service (BSM) approach greatly increases the capabilities and value of BSM solutions in that environment, as well as those of the identity management solution. A BSM approach makes it possible to manage IT based on business priorities. BSM focuses on automating the management of technology and IT process workflow to deliver greater business value. This paper: > Discusses the evolution of identity management systems > > > Describes how the information maintained by identity management systems can be leveraged. by other BSM solutions through integration Discusses the criteria that this integration should meet to deliver maximum value Presents a real-world example of how organizations have benefited from leveraging identity data. in their BSM solutions
The Evolution of Identity Identity management has evolved significantly over the past few years, from a narrow role of access control to one of providing a variety of automated services. In the process, identity management systems have encompassed more and more identity information, thus propelling identity management into the mainstream of business processes. From User Account Initially, identity information was used primarily to control access to enterprise applications and data. It consisted mainly of user access credentials, such as user IDs and passwords. The information was used for two access-. related functions. The first, called authentication, verifies that the user attempting access is indeed who he or she claims to be. The second, called authorization, permits users to access needed IT resources, but only the resources they are authorized to use. It also restricts access based. on the user s authorized privilege level, such as read-only or read/write. Typically, each enterprise application and database maintains its own identity information in a user account, so identity information has become scattered in multiple user accounts in different resources across the enterprise. As a result, systems administrators have had to manage multiple accounts for each user, on separate, disparate systems. The process is manual, time consuming, and error prone. Adding to the difficulty of managing identity information. is the continual state of flux of a company s workforce and of its IT infrastructure. Users come, go, and change roles, and new resources are added that require access control. These issues are exacerbated when the user base includes business partners and customers, in addition to employees. Manually managing user identity information in this complex and continually changing environment presents a challenge. It soaks up administrator time. It also exposes the organization to significant security risks, due to such factors as erroneously configured access privileges and lingering passwords for terminated employees. What s more, manual processes are difficult, if not impossible, to audit for regulatory compliance. Identity management solutions were initially introduced. to address the challenge of user account management. by centralizing that management and automating many. of the account management processes. Identity Lifecycle Today, identity management systems have evolved to encompass all the processes, practices, and tools utilized to govern the complete lifecycle of digital identities. Identity management systems now provide several important functions to consolidate identity information, centralize identity management, automate identity management tasks, and automate both password management and audit and compliance management. Consolidate Identity Information Identity management systems consolidate identity information into a single identity data repository, greatly simplifying management. The identity management system leverages the consolidated information to present a comprehensive, consolidated view of users that enables IT to answer the fundamental question Who are the users? As identity management solutions have evolved, they have encompassed more and more identity data from a variety of different systems and sources. That s why it s important that the identity database be extensible through federation. Federation permits the creation of a single, logical identity data store that can reside on multiple data sources scattered throughout the organization and even outside the walls of the organization. Centralize Identity Identity management systems centralize identity management, enabling IT to control and enforce access privileges from a central point based on roles and business policies. This facilitates identity management and permits IT to answer the question Who has access to what? Centralization helps increase administrator productivity because administrators no longer have to juggle multiple user accounts. on different systems. Automate Identity Tasks A well-architected identity management system automates user administration and access provisioning through automated rule- and role-based management of user accounts on enterprise systems. It grants access to new users based on their roles in the organization. It also grants immediate role-based access to newly deployed IT resources. In addition, it changes user access rights when users change roles, and it revokes access when users terminate their relationships with the organization.
Automation boosts the productivity of administrators and strengthens security by implementing and enforcing bestpractice identity management processes. It also increases the productivity of users. For example, automation enables IT to grant immediate access to new employees, allowing these employees to be productive from day one. Automate Password There are a variety of ways that password management can be automated. IT can define and enforce password. policies to ensure that users maintain secure passwords and change them when required. What s more, through such mechanisms as password synchronization and single sign-on, IT can reduce the number of passwords users have to remember, increasing user productivity. In addition, the enablement of self-service password management permits users to manage password resets and changes on their own. User self-service simplifies administration and increases corporate productivity by eliminating a major source of support calls password resets. Automate Audit and Compliance An effective identity management system automatically monitors, logs, and reports access events, and generates appropriate notifications, including automatic notification. of suspicious activities. It also maintains an audit trail to validate compliance, permitting IT to answer the questions: Who granted access and when? and How is access being used? Automating audit and compliance management helps reduce the cost of achieving and demonstrating compliance. It also frees up considerable IT staff time that can be applied to more strategic tasks. Enhance BSM with Identity Information BSM can help you strike the optimum balance between cost and value. BSM automates the management of. technology and IT process workflow to drive out cost,. lower business risk, and support business growth and. flexibility. BSM is based on a shared view, across all IT,. of how IT resources directly support the business. Identity management has become a key component of BSM because it can help boost staff pro.ductivity, increase user productivity, and reduce security risk. For the most part, however, identity management systems have operated as stand-alone systems that are tied primarily to security; yet the data maintained by an identity management system is essential to other IT processes. As a result, the business value of identity management extends well beyond its. original sphere. The IT Infrastructure Library (ITIL ) provides best-practice guidelines for IT service management. The ITIL books are organized around the service lifecyle, and cover service strategy, service design, service transition, service. operation, and continual service improvement. One of the key processes in these books pertains to access management, which is defined as the process of granting authorized users the right to use a service, while preventing access. to non-authorized users. These guidelines stress the importance of integrating technology, processes, and people. Identity management provides the essential information. for the people dimension. Integrating the identity management solution with other components of a BSM approach allows other solutions to share and leverage this identity data. This data sharing significantly increases the value of the identity management solution, as well as that of the other solutions. Identity management data can be leveraged by a variety. of IT service management processes, including service request management, closed-loop change and configuration management (including automated user provisioning), and incident and problem management. Identity data also plays a key role in regulatory compliance. Service Request A service request management solution greatly facilitates the process of requesting and fulfilling services. It permits people to find and request the services they need online, and track a request status on their own all without assistance from the service desk. It also permits service providers to publish available services in a centralized, Web-based catalog. In addition, it automates the fulfillment of requested services, greatly speeding response. A service request management solution is a consumer of user identity data. It can use the data to determine users entitlements to services based on their roles, presenting them with only those services they are entitled to receive. It can also use identity data to allow only authorized persons to modify the online service catalog. In addition, the service request management solution can automatically populate service request forms with known user data to simplify and speed the requesting process. Closed-loop Change and Configuration Automatic User Provisioning System configurations and access privileges vary greatly based on a user s role in the organization. An identity. management system maintains the links between people, their roles, and their associated access requirements.. A change and configuration management solution can leverage role-related identity information to automatically provision or re-provision systems and access privileges. to users in a fully closed-loop process.
Here s an example: When an employee is hired, changes roles, or leaves the organization, an entry is made into the HR system. This event causes a change request to be generated and forwarded to the change management solution. The change management solution then initiates tasks in both the identity management and configuration management solutions to provision the new employee, re-provision the reassigned employee, or de-provision the terminated employee. Provisioning includes granting access to enterprise applications and assigning new systems, such as a desktop or laptop computer (and appropriate software, if necessary) all according to the user s role. Identity information permits IT to implement an end-to-end, closed-loop change process that spans from request through verification of successful implementation. Identity information plays a key role in change authorization, change notification, standard configuration enforcement, and service continuity management. Change Authorization The change management solution can leverage identity information to control changes, ensuring that only authorized persons make changes and make only the changes for which they are authorized. The change management solution can also maintain an audit trail for regulatory compliance, showing who approved each change and when, and who implemented each change and when. Change Notification The identity management system maintains the role information that links people with the resources they are authorized to access. The change management application can leverage this information to automatically notify affected users of planned changes that may affect them. The solution can also notify affected users, including change requesters, of successful change completion, thus closing the loop. Configuration A well-architected configuration management solution includes a discovery capability that continually monitors end-user computer configurations for any unauthorized changes. When a configuration variance is detected. in a user s computer, the approved configuration, as. determined by the user s role, can be restored automatically such as by removing an unauthorized peer-to-peer file sharing program. Proactive Incident and Problem Identity management enhances a proactive incident and problem management workflow by enabling IT to keep their users informed, in real time, of the status of the IT infrastructure. This enables IT to address issues before they result in service degradation or outages. For example, when a failure occurs in a resource, the solutions within the proactive incident and problem management workflow can leverage identity information to automatically notify affected users of the outage, and, in conjunction with a change management solution, provision users with access to another system during the outage. When the failed resource is returned to service, the incident and problem management solution can automatically notify the affected users and, in conjunction with a change management solution, re-provision access back to that resource, closing the loop. This automatic provisioning and re-provisioning process greatly reduces the disruption to business caused by system failures. What s more, integration of identity management into. a proactive incident and problem management workflow can facilitate the handling of incidents. The incident and problem management solution can automatically populate the relevant fields in the incident ticket with the user s identity information, and the support technician can use the identity information to determine the user s entitlement to support. In addition, the proactive incident and problem management workflow can close the loop by automatically notifying users when the problem is resolved and the incident ticket closed. Likewise, the service desk solution can leverage the identity information. The service desk agent can use the identity information to determine the caller s role for the purpose. of determining the user s entitlement to access the service. in question. The agent can also use identity information. to distinguish between employees, business partners,. and customers, and tailor response accordingly. In addition, the agent can quickly determine which support people are responsible for the IT service in question and immediately and seamlessly transfer the user to the proper support resource, such as an internal help desk, second-tier support, or an external service supplier s help desk. Regulatory Compliance It is essential to integrate identity data with business. processes to achieve and demonstrate regulatory compliance. By knowing who the users are, which users have access to which resources, and what their access privileges are, IT can control, audit, and report on application and
database access in a continuous fashion. In addition, IT. can leverage identity information to control, audit, and report on IT infrastructure changes, indicating who authorized each change and when, and who implemented each change and when. Integrating Identity into the Environment To enable IT to realize the most value from identity data,. it is essential that the identity management solution be integrated with the other solutions in the environment.. This integration should be provided out of the box to permit fast implementation and value realization. There are several factors to consider regarding this integration. The Role of the CMDB The configuration management database (CMDB) provides the foundation for integration between identity management and other BSM solutions. The CMDB is a fundamental component of the ITIL framework. It serves as a single source of reference, facilitating integration and synchronization among ITIL management processes, all of which contribute and consume CMDB information. The CMDB defines a set of configuration items (CIs) and can maintain all IT resources technology assets, processes, and people as CIs. A well-architected CMDB is built on a federated architecture. This gives it access to data, including identity data that is scattered throughout the enterprise, without having to replicate all that data in the CMDB. It is advisable to include only core identity data in the CMDB. Core identity data provides a comprehensive view of all people who have access to IT resources, as well as their organizational alliances, their roles, and their relationships to the IT resources to which they have access. Maintaining only core identity data keeps the CMDB manageable, and still enables the BSM applications to access any additional identity data they need from the identity management database through federation. An important requirement is that the CMDB be capable. of automatically discovering core identity information. This includes the discovery of all users who have access to. systems and applications. It also includes the association of users with their business profiles, such as their departments, business functions, and contact information. IT teams can leverage this data to make better-informed. business decisions and prioritize actions. Because automatic discovery automatically populates the CMDB with identity data, it greatly facilitates deployment of the identity management solution. Automatic discovery should also keep the CMDB updated with changes in identity-related data to ensure that it is always current despite the continual flux in the user base. Out-of-the-box Integration with Other Solutions A well-architected BSM approach provides out-of-the-box integrations to all solutions in the environment at both the process level and the data level. Integration at the process level permits the solution applications to interact Configuration Items and their Relationships Service Impact Asset Configuration Discovery Problem Relationship Discovery CMDB Definitive Software Library Change SLA Identity Incident Figure1. CMDB information-sharing
directly with each other. Integration at the data level permits the solutions to share identity data, ensuring that they are all working with accurate and consistent information. In the automatic provisioning example presented earlier, integration at the application level permits the change. management application to trigger a provisioning operation request with the identity management application when. a new employee is brought on board. Integration at the data level permits the change management application. to access role-related identity data to provision all users with the proper systems, software, and access to enterprise applications. Out-of-the-box Connection to Back-Office Systems It is essential that the solutions, including the identity. management solution, connect out of the box with a wide variety of back-office systems. This connection is essential to permitting the solutions to access the information they need from these systems and to interact with them to. automate processes. To permit consolidation of the identity management database, for example, it is essential that the identity management solution connect to a wide variety of data sources, including network directories and HR systems. In addition, to permit automatic provisioning of user access to enterprise applications and databases, it is necessary that the identity management solution and the change management solution connect to those applications and databases to gain access to their user accounts. To provide complete coverage, the solutions should connect to back-office systems running on all popular operating platforms, including Windows, UNIX, Linux, and mainframes. Real-World Example Some organizations have already implemented BSM. using an integrated identity man.agement solution. The results have been compelling. Kroger Kroger is one of the largest retail chains and one of the five largest employers in the United States. The company operates over 2,500 supermarkets and multi-department stores under two dozen banners, as well as nearly 800 convenience stores, 440 fine jewelry stores, 550 supermarket fuel centers, and 41 food processing plants. Needless to say, the Kroger IT staff has to manage a huge user base more than 340,000 active users. These users conduct anywhere from 450,000 to 650,000 transactions per month, acces sing a wide variety of applications. Changes need to be made when users leave and new ones join the company. In addition, the staff has to manage thousands of other changes per month as users change roles or locations. The company s manual processes for provisioning user access needed to be replaced with automated processes. The IT staff deployed an automated user administration and provisioning solution, an audit and compliance management solution, and a pass word management solution, said Brian Lawhorn, Senior Director, CISO, Kroger. The automated user administration and provisioning solution enables the IT staff to manage a very high volume of user changes daily, as well as to reduce service desk costs significantly. In addition, the identity audit and compliance management solution audits these changes in real time and produces reports to demonstrate regulatory compliance. Conclusion Relegating identity management systems to stand-alone identity tasks would be like limiting the World Wide Web. to basic information-sharing. As identity management. solutions have evolved, they have not only enhanced their capabilities for managing user lifecycles, but have also increased the breadth and depth of the identity data in their purview. Isolating this wealth of data in an identity management silo unnecessarily limits the value identity management solutions can contribute to the business. Creating an identity-aware BSM approach by integrating. an identity management solution into the environment un.leashes the full business value of identity data, as well. as that of the identity management solution. Other solutions in the environment can leverage the capabilities and data. provided by the identity management solution to help IT. add.ress cost-control mandates, while also improving services, strengthening security, and enhancing regulatory compliance. BMC offers solutions that address these issues. For more information, visit: www.bmc.com/identitymanagement.
About BMC Software BMC Software delivers the solutions IT needs to increase business value through better management of technology and IT processes. Our industry-leading Business Service solutions help you reduce cost, lower risk of business disruption, and benefit from an IT infrastructure built to support business growth and flexibility. Only BMC provides best-practice IT processes, automated technology management, and award-winning BMC Atrium technologies that offer a shared view into how IT services support business priorities. Known for enterprise solutions that span main.frame, distributed systems, and end-user devices, BMC also delivers solutions that address the unique challenges of the midsized business. Founded in 1980, BMC has offices worldwide and fiscal 2007 revenues of $1.58 billion. Activate your business with the power of IT. www.bmc.com. About the Author About BMC Software Bronna Shapiro, director of Solutions Marketing for Identity and Services for BMC Software, manages a team that is responsible for marketing and strategy for identity management solutions. In addition, she leads a team responsible for marketing for consulting services, educational services, and customer support. Her prior BMC industry Software experience delivers is in the marketing solutions leadership IT needs for distributed to increase systems business solutions value and through in product better management management of key mainframe of technology products. and She IT has processes. also been an Our instructor industryleading for courses Business on IMS Service and DB2. solutions help you reduce cost, lower risk of business disruption, and benefit from an IT infrastructure built to. support business growth and flexibility. Only BMC provides best-practice IT processes, automated technology management, and award-winning BMC Atrium technologies that offer a shared view into how IT services support business priorities. Known for enterprise solutions that span mainframe, distributed systems, and end-user devices, BMC also delivers solutions that address the unique challenges of the midsized business. Founded in 1980, BMC has offices worldwide and fiscal 2007 revenues of $1.58 billion. Activate your business with the power of IT. www.bmc.com. About the Author Bronna Shapiro, director of Solutions Marketing for Identity and Services for BMC Software, manages a team that is responsible for marketing and strategy for identity management solutions. In addition, she also leads a team responsible for marketing for consulting services, educational services, and customer support. Her prior industry experience is in marketing leadership for distributed systems solutions and in product management of key mainframe products. She has also been an instructor for courses on IMS and DB2. To learn more about how BMC can help activate your business, visit www.bmc.com or call (800) 841-2031. BMC, BMC Software, and the BMC Software logo are the exclusive properties of BMC Software, Inc., are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other BMC trademarks, service marks, and logos may be registered or pending registration in the U.S. or in other countries. ITIL is a registered trademark, and a registered community trademark of the Office of To learn more about how BMC can help activate your business, visit www.bmc.com or call (800) 841-2031 BMC, BMC Software, and the BMC Software logo are the exclusive properties of BMC Software, Inc., are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other BMC trademarks, service marks, and logos may be registered or pending registration in the U.S. or in other countries. ITIL is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office. DB2 is a registered trademark of International Business Machines Corporation. All other trademarks or registered trademarks are the property of their respective owners. 2007 BMC Software, Inc. All rights reserved. *71868*