Delivering on identity and access management
Does authorisation provide the link?
At a recent panel event involving senior security managers and chief information security officers from a number of industries, Identity and Access Management came up as one of the top priorities. Participants gave a number of reasons, which can be distilled into three categories: more efficient and less fragmented delivery of IT services; facilitation of better collaboration with customers and partners; and the necessity to demonstrate compliance with data protection legislation.
All of which would be great - if only identity and access management hadn't proved impossible to implement. As one participant stressed, "We're five years down the line, and it still hasn't delivered." Worthy of note: that's not meaning, "delivered on its promises" mind, that's, "delivered at all." So, what is it that makes identity and access management so hard to do?
We can consider this question from both the IT and the business perspective. Considering IT in general, and security-related topics (such as identity and access management) in particular, the challenges faced in deploying such capabilities cannot be helped by our innate desire to concentrate on the 'how' rather than the 'what'.
Identity and access management requires two complex areas to be understood at the same time - first, the (rapidly changing) roles and requirements of a large number of individuals; and second, the diverse hotchpotch of new and legacy systems that may be in place. Wouldn't it be great if there could be a system to just resolve all of that? The answer has to be 'yes' - but while the requirements for such a system may be obvious in principle, the practicalities of implementation have defeated all but a minority of organisations.
It is understandable, and indeed desirable, that the IT industry has looked hard at how to resolve some of the technical and philosophical issues around delivering identity and access management. Initiatives such as the claims-based architectures espoused by the likes of Microsoft, together with cross-industry efforts such as OpenID, are to be welcomed. However the one thing they cannot do, is circumvent the complexities at the heart of deploying identity and access management on an industrial scale.
So what are the options? One can turn perhaps to the business, and insist that it gets its own house in order before IT automates what is required. After all, surely identity and access management systems exist to support such manual processes as role definition, access provisioning and the like?
It's here that we reach the nub of the matter from the business perspective: in a word, churn. As soon as any understanding is reached of who has access to what and why, such information almost immediately becomes out of date. Organisations large and small are dependent on pools of contractors and temporary staff; management roles change; hirings, firings, maternity provision and job shares are part of the fabric of modern industry.
Meanwhile, the boundaries of organisations public and private are today more like semi-permeable membranes than fortress walls. We see this in pharmaceutical companies creating innovation ecosystems, just as in borough councils and local health authorities looking to provide services and "deliver individual outcomes" to what is often a highly transient population.
From this standpoint, it is not absolutely clear what is the answer. However, we can perhaps identify where it may be found - not in the complexity of systems and applications that need to be accessed, nor in the constantly changing pool of people and roles that need to be identified and trusted. Rather, we could look at the interface between the two - or more importantly, the specific event during which authorisation is made between a specific individual and a specific service.
This is not proposing any magic bullet. Rather, by recognising the importance of this irreducible event, we can gain a level of clarity about what is at the heart of the problem – and the potential solution. Either it is possible to manage the event taking place at the moment of service provisioning, or it is not - but if the latter is true, no amount of clever technology is going to help.
Managing authorisations may hold the key, and for added impetus, we only have to look to legislation. Both industry-applicable regulations such as Sarbanes Oxley and national laws such as the data protection act require that authorisation of access to a given data set is in some way controlled. In other words, organisations have no choice but to make this happen: it's the law.
In order for identity and access management to succeed, then, we need to look at both the technologies available to facilitate provisioning of access, and the authority we vest in individuals to provision. For identity and access management to work, such capabilities need to operate as close to the point of authorisation as possible, such that the event itself can be captured.
This may be no easy task, but at least it provides a starting point - and let's remember, it isn't necessary to deliver everything, all at once. In conclusion, it is perhaps time to dispense with ill-fated attempts to provide blanket policies and approaches, however attractive they may seem at the outset. Instead, we can focus first on how to enable responsible individuals to provision access to higher priority systems and higher risk data. If and when this has been enabled, then other, lower priority systems can be brought into the fold.
From our research we know that there are no easy answers to complex issues such as this. But we would welcome any feedback, particularly concerning how to successfully deliver identity and access management. If you have any experiences to share, good or bad, we'd love to hear them.