I have just completed a product selection exercise with a customer who has past experience of a failed solution with one of the Big Vendor products. In doing this I found it useful to refer to the Gartner IAM Maturity Model<\/a>, because what is the use of fancy (\/expensive) features if you don’t actually have the data, processes, and clear understanding of access roles to make use of them.<\/p>\n This is my own summary of the five stages of maturity against common IAM product features.<\/p>\n
| Level<\/th>\n | Characteristics<\/th>\n | Main Problems<\/th>\n | Key IAM Product Features<\/th>\n<\/tr>\n |
|---|---|---|---|
| 1. Initial<\/td>\n | Account creation and management done ad-hoc, as needs arise, with no particular consistency or process.<\/td>\n | Not scalable beyond a certain user population. Too much dependency on individuals who just know how to do the thing.<\/td>\n | Skip the products and invest in documenting account management processes per account types, and rules around access control.<\/td>\n<\/tr>\n |
| 2. Developing<\/td>\n | Processes followed within individual systems, to varying degrees of exactitude. Generally, as processes are created or modified, pre-existing accounts or records are not updated to match.<\/td>\n | User on-boarding is drawn out, with requests sent to different teams for accounts, access and equipment.<\/p>\n Security are starting to get testy about all the enabled accounts for people who’ve left.<\/td>\n | A basic identity synchronization and provisioning service, like the MIM Sync service, is perfect for this stage, as it will start enforcing consistency and surfacing incorrect source data.<\/p>\n It is also important to consider best fit of platform with existing sys-op skills as there is unlikely to be dedicated staff to manage the solution.<\/td>\n<\/tr>\n |
| 3. Defined<\/td>\n | There is now some sharing of identity and organisational data between systems, and processes have been documented end-to-end, looking for inefficiencies that can be resolved.<\/td>\n | As integration increases, the risk of bad data or practises in one system “infecting” downstream systems increases. Testing becomes arduous and some people loudly recall how much they liked the good ‘ole cowboy days.<\/td>\n | Excellent logging which shows where data changes originated. Features like SailPoint’s after-the-fact approval of “native” changes made in target systems can help enforce procedure on those that might still be avoiding it.<\/td>\n<\/tr>\n |
| 4. Managed<\/td>\n | An identity data architecture exists and is kept up-to-date.<\/p>\n Identity interoperability is a key factor in product selection.<\/td>\n | How best to leverage existing systems and well-managed organisational data to provide access that is appropriate, available straight away, and adaptive to risk metrics.<\/td>\n | Role-based and Adaptive access control, Federated authentication and Just in Time provisioning.<\/p>\n To reference Gartner again, the Magic Quandrant leaders are positively judged on these sorts of features, but without the maturity level the customer organisation won’t get much value from them.<\/td>\n<\/tr>\n |
| 5. Optimized<\/td>\n | Proactive stewardship and enhancement of data and processes in source systems that deliver efficiencies and improvements across the business, with genuine recognition of the value achieved.<\/td>\n | Congratulations, you have reached Nirvana!<\/p>\n Be careful however as back-sliding is possible so vigilance is required, particularly if management start talking about outsourcing HR<\/a>.<\/td>\n | At this stage of smooth operations you may be able to consider a less expensive, IdaaS option, having fewer special cases and idiosyncratic processes to work around.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":" I have just completed a product selection exercise with a customer who has past experience of a failed solution with one of the Big Vendor products. In doing this I found it useful to refer to the Gartner IAM Maturity Model, because what is the use of fancy (\/expensive) features if you don’t actually have…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":[]},"categories":[55,3],"tags":[],"class_list":["post-3187","post","type-post","status-publish","format-standard","hentry","category-best-practice","category-philosophising"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pkp1o-Pp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/3187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/comments?post=3187"}],"version-history":[{"count":14,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/3187\/revisions"}],"predecessor-version":[{"id":3390,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/3187\/revisions\/3390"}],"wp:attachment":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/media?parent=3187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/categories?post=3187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/tags?post=3187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |