IAM Roadmap from Assessment to Blueprint and then Roadmap (ABR) is the path to a digital transformation for all CiSCO’s.
Your organization cannot afford to assume that its IAM solution in its current state is providing the protection you need. IT departments and business leaders are facing increased scrutiny on how they protect access to corporate data. Manual processes for tracking and assigning user privileges are inadequate and unreliable.
IAM enables granular access control and auditing by automating these tasks. This adds greater protection to corporate assets, be them on-premise, in the cloud, or in a hybrid solution.
IAM is a technology that is constantly changing to keep pace with the technologies it interacts with. This includes artificial intelligence, machine learning, behavioral analytics, biometrics, and more. IAM has adapted to changes in the security environment. Included in this is the transition from the use of firewalls to zero trust models that take into consideration the unique security requirements of the Internet of Things.
What Is an IAM Roadmap?
In order to outline an Identity and access management strategy IDMWORKS separates the IAM Roadmap into three parts through an Assessment Blueprint Roadmap (ABR).
IAM Assessment
This process evaluates the current state of your IAM solution. This is accomplished by first gathering information about your current state of security and then identifying what you want the future state of your security to be. A comparison is made and a plan of action is created.
IAM Blueprint
Once the assessment is done and problems are identified, the IAM Blueprint lays out the ‘how’. It lays out which functionality is required, why said functionality is needed, and the steps you should follow to successfully implement your strategy.
IAM Roadmap
This process addresses budget concerns. It answers the question, “how can your organization reduce security risks with limited spending?”
On its own, each component of IAM can strengthen your Identity Management Solution. Together, they form an impenetrable bulwark that puts your organization in the best position to protect its sensitive information.
We will discuss IAM Blueprint and IAM Roadmap in greater detail in part two and three of this series. For now, let’s focus our attention on the role IAM assessment plays in bolstering your security.
What Your Organization Gets from an IAM Assessment
You get subjective expert advice garnered by applying several criteria from multiple frameworks. A responsible IAM assessment is based on frameworks, but it will also provide insight into topics that are not covered by those basic frameworks.
The goal is to evaluate your IAM system in a way that is relevant to the needs of your organization. Creativity and subjectivity are essential if your IAM assessment is going to provide the best value.
The subjectivity offered by an IAM assessment is important because your organization is drastically different from other organizations, even within your field. Globally, there are startups, small businesses, multinational enterprises, government entities, banking entities, and businesses in the technology sector. Each organization needs something different from its IAM solution. Therefore, a one-size-fits-all IAM assessment approach will not work.
An IAM Assessment is beneficial because it shines a light on the maturity of an environment and opportunities for involvement. It is easy to identify gaps in your IAM strategy once a data breach is in the rearview mirror or after the problems have been identified. It requires subjectivity and creativity to identify the interdependencies that point to an unforeseen future problem and mitigate its risk.
Through an IAM Assessment, your organization will identify source and remediation activities. At times, it’s revealed that just one strategic change will have a positive impact on multiple findings.
For instance, an IAM Assessment of your organization may reveal:
- Inefficient decision-making among team members
- A lack of continued stakeholder engagement or a diminished or delayed stakeholder engagement
- You need 20 people to complete the integration process when a new application is introduced
- Technology that is no longer supported. This results in a long RTO
The objective way to handle these findings is to address each problem separately. However, a creative and subjective approach would be to reorganize the IAM responsibility matrix. Identifying the few fundamental changes that can affect organizational change requires creativity.
Four Pivotal Areas Considered during an IAM Assessment
An IAM Assessment should address and identify the most common issues faced by your organization when implementing a solution. It does this by considering the following.
1. Your Organization’s Corporate Architecture- Management of user access is evaluated. This is done by reviewing processes, systems, and applications to guarantee they are properly integrated to protect your information and forestall unforeseen IT security risks.
2. Your Organization’s Business Process Assessment- If your organization’s business processes are bad, automating them using IAM technology will only deliver failed results faster. You need to determine if your business processes align with your IAM technology. If not, your processes need to be changed so that you can make the most of the features and functions offered by your organization’s IAM technology of choice.
3. Review Your Organization’s HR Connector- HR policies and the processes the human resource department uses to manage internal users and determine what permissions are needed must be evaluated. When do employees have permission to access information? Are these standards documented? How do HR processes impact downstream access? For example, if an employee goes on vacation, leaves, or is fired, how does HR adjust their provisioning?
4. Review Your Organization’s Policies–To be effective, the organization’s policies must be clearly defined and must harmonize with the security objectives of your organization.
Once the IAM Assessment is complete, it is now time to lay out a blueprint to determine what functionality is needed, why said functionality is needed, and specific steps to implement your organization’s strategy. This will be the topic of part two in our series.
Read IAM Roadmap Series Part 2