Why Identity Management Projects Fail

Identity and Access Management pitfalls to avoid:
Taking from different experiences, these challenges came at various stages of Identity Management projects. The key to avoiding these are consensus, communication, ownership, and commitment.

-Lack of Key Stakeholder and Executive Sponsorship involvement.
-Don’t reduce risk through reducing scope - Steady, measured, low-risk progress over two years is better than high-risk initiatives over 6 months
-Ownership of the issues
-The strategy is everyone’s job.
-Failure to address political issues immediately when they arise.
-Lack of consensus, support, ownership, and commitment within the organization.
-Don’t set unachievable expectations.
-Understand that there is a point of diminishing return.
-Failure to estimate cost of ongoing service to include support and maintenance.
-Return on investment should not be measured on the entire investment.
-Don’t try to win all at once.
-Failure to set measurable, achievable goals for quick wins
-Lack of education within the organization about the strategic importance of the solution.
-Lack of definition of what a role is and how to manage it.
-Failure to carefully assess the readiness of the organization.
-Don’t reduce cost through reducing business workflow analysis.
-Don’t look at Identity and Access Management as an IT type of project.
-Clearly define and document the responsibilities and commitments of the different business units within the organization.
-Don’t expect to operate IAM without organizational changes.
-Don’t expect to operate IAM without reengineering some business process.
-Don’t exclude any organizational stakeholder or conflicting agendas.
-Wanting a “quick fix” - Very tempting to desire a fast technical solution to solve control ailments (Example: “SOX in a box”)
-Understand technology can’t fix broken processes
-Overstated claims or assertions to elevate ones objective to project sponsors
-Improper evaluation of vendor features and legitimacy
-If the current manual process isn’t adequate, simply automating it will not help
-Creating electronic versions of paper forms that don’t require sign-off
-Aggregation must be considered: 10 customer records, or 10 million?
-Failing to measure properly - some things are difficult to measure
-In the case of audit, the metrics must indicate the effectiveness of control operation
-Misleading dashboards: Does a green light really mean that all is well and there are no issues. Red light does not tell you where the problem is.
-Auditors don’t look at dashboards, but underlying evidence
-Lack of documented procedures for provisioning, access controls and/or their processes
-Understanding compliance issues are process issues first
-Lack of clear define for business, technical, and functional requirements
-Define your architecture
-Invest in technology purchases – pay for support and maintenance
-Carefully leverage SOX and other compliance activities and knowledge to your advantage
-Agreed upon ID creation process and standards to include global unique identification
-Failure to build identical test/production structure and data content
-Provisioning connector challenges with custom developed systems
-No single technology can address Identity and Access Management
-If the current manual process isn’t adequate, simply automating it will not help. -nor will adding technology for its own sake. (e.g. Biometric sensor on a glass door)
-Obtaining accurate people data – data cleansing project
-Lack of data mapping requirements via provisioning connectors to other systems
-Conflicting or competing technologies.

Lack of Identity Data Security Practices

If you and/or your tools (i.e. laptop, usb, network share, backup tapes, paper reports, etc) are a conduit for identity data, understand that there is no excuse for allowing this data to be exposed, accidentally or otherwise.
- Take a strategic, layered approach to data security, rather than focusing solely on one or two exposure points.
- Encrypt sensitive data on laptops.
- Adopt and enforce levels (secret, classified, sensitive, general, etc) of data classification and don't allow employees to transfer defined levels of data to unmanaged systems or PCs.
- Consider using end-point activity enforcement products to restrict USB transfers.
- Use a content-filtering technology along with enforced policies that can monitor and restrict transferring of sensitive data over networks
- Deploy two-factor authentication for all users to access data.
- Audit authentication.

inames - an Internet identity assertion

Here! Here! Finally the long awaited identity service that will move us past managing identities inside the enterprise in a silo, beyond federation. Project Higgins and soon to be integrated Project Bandit will give a whole new meaning to "doing business with others" over the internet. I will be watching the official inames launch in June.
The smart guys, along with a maturing technology, has created the ability to take a collection of attributes to create a structure of your identity that will be used in the process of authorization and authentication of who, what, when, where, and how you are.

Auditing Identity Management Systems

The process of complying with internal audit and regulatory demands can be best viewed as a cycle. Establish Control Objectives, Implement Controls, and Provide Proof. The cycle begins with defining and documenting the organization’s objectives for compliance and risk control and then moves on to implementing the processes to support those objectives and providing proof that those processes are working. The first step, establishes the baseline for complying with internal audit and regulatory demands.

An effective identity auditing solution delivers an automated, proactive approach to meeting enterprise audit and compliance requirements, providing functionalities that move organizations from manual, fragmented processes to a monitored, optimized, sustainable state.
• Provides continuous insight into access, privileges, and violations
• Enables real-time visibility into access status
• Automatically defines why access is granted on any given occasion
• Detects not only violations but also potential violations of audit policy
• Takes steps for remediation and mitigation in the event of a violation
• Creates a trail of accountability with auditable evidence of controls
• Automates processes, reducing staffing and services requirements

Virtual Directory - The Concept

The concept of a virtual directory answers the challenge of enabling appropriate access and maintaining tight security against unauthorized access by isolating access to individual data elements (attributes) based on a replicable strategy with centralized administration.

Fine Grain Access

Database object level access controls are possible, right? So why are the identity management vendors saying they can't do it with their connectors?

User identities and their access to applications and databases that run on a mainframe can be managed down to the most granular detail, right? So why are the identity management vendors saying they can't do it?