Identity management a complex process with a simple goal
Connecting state and local government leaders
A failure to realize the process changes involved has doomed some identity management systems, but there have also been successful deployments. And integrated identity management and access control suites are making it easier to achieve the desired result.
Identity management and access control systems have a simple purpose: ensure that users can access only the data and applications they need. However, getting to that point is not so simple.
In this report:
12 questions to ask before implementing an identity management system
Many large organizations have a variety of systems in operation. Different parts of the organization might manage those systems, and they might have a range of processes to acquire user information and approvals.
“When a large government organization takes on a project to automate provisioning, it must include the request process, the approval process, the routing, and, ultimately, the provisioning of credentials and entitlements into the target systems,” said Gregg Kreizman, Gartner’s research director. “Many user provisioning projects have failed because organizations didn't take into account the amount of business process change involved.”
Although some organizations have failed to implement identity management systems, there also have been successful deployments. And integrated identity management and access control suites are making it easier to achieve the desired result.
“The issue here is balancing privacy, security and ease of use for the user,” said Jon Oltsik, principal analyst at Enterprise Strategy Group.
Define the scope
Implementing an identity management system goes beyond just making sure people have their Homeland Security Presidential Directive 12 Personal Identity Verification cards and can remember their passwords.
“What we consider to be identity and access management is really a combination of at least a dozen different technologies,” said Bill Nagel, an analyst at Forrester Research.
Forrester Research evaluates identity management vendors based on 14 different technologies: directories, enterprise single sign-on, entitlement management, federation, identity audit, metadirectories, multifactor authentication, password management, privileged user and password management, provisioning, role management, user-centric identity, virtual directories, and Web single sign-on.
Gartner tracks vendors in three different categories related to identity management: single sign-on, user provisioning and Web access management.
When implementing an identity management system, organizations need to agree on what is necessary to meet business needs, a process that starts with determining what you have in place. That review should include policies, procedures, workflows, hardware, data sources and software, and it must include all departments.
“A lot of people are coming to realize that ID management is, first and foremost, not a technology problem,” said Paul Donfried, vice president of identity and access management at Science Applications International Corp. “It is an issue that permeates organizations, and you tend to find certain functions that had to historically manage identities.”
A human resources department typically will run an employment eligibility check on applicants before hiring them and might already have the organizational structure, chain of command and employee roles loaded into a human resources management system. That data can serve as a basis for creating the identities, roles and authorizations in the system.
For example, when the Agriculture Department needed to implement HSPD-12, it used the department's PeopleSoft EmpowHR system as the authoritative starting point for employment status and then expanded it to cover contractors and state and local government employees who also needed access. Procurement employees know what vendors should be included. Payroll and security staff members can contribute other information that the system should incorporate.
Next, find out the business needs of the stakeholders. In addition to IT access, be sure to consider additional functions that might be needed, such as verification of electronic signatures. From there, design an implementation project that meets those needs and will engender support.
“You need to think about the business needs of agencies and not think of it as purely an exercise in deploying technology,” said Gerry Gebel, vice president and service director of Burton Group’s Identity and Privacy Strategies. “This will result in a more successful deployment, happy customers and increased likelihood that they will invest in future identity management improvements.”
Selecting products
After determining the business needs, you can start looking at the software available to automate the processes. As with other types of enterprise software, the initial choice is between buying an identity management suite and taking a best-of-breed approach. However, with identity management software, software packages could be composed of products that other vendors recently acquired because the market is rapidly consolidating.
“Sometimes, these products have been integrated seamlessly, but with others, it is an ongoing process,” Nagel said.
There are five main vendors in the identity management field: CA, IBM, Novell, Oracle and Sun Microsystems. Although Oracle recently acquired Sun, Nagel said there is significant redundancy between the two companies’ identity management offerings. It isn't known yet whether Sun's suite will be able to improve the strength of Oracle's offering, which is already ranked No. 1 by Forrester and Gartner.
In addition to those five vendors, dozens of other large and small companies offer niche products. Donfried said that when selecting a product — whether it's a suite or best of breed — the first thing to look for is flexibility.
“More than anything, you want to avoid locking in to any single vendor or any type of proprietary solution,” he said. “Whatever we view as the right standard and the right solution today, by the time we have it installed, configured and operational, it is outdated.”
Oltsik recommended keeping an eye on the emergence of what he calls Identity 2.0 technologies, such as the open-source, Web-based single-sign-on systems OpenID and the Shibboleth System, in addition to Microsoft's CardSpace. Those technologies provide users with claims-based authentication, single sign-on and data privacy.
“It is too early for agencies to 'buy' an Identity 2.0 solution, but they should be paying attention to and supporting standards and product development,” Oltsik said. “Since ID 2.0 is built to support anonymity and privacy, it may be a perfect fit for e-government initiatives like online voting and health care reform, enabling cost-saving e-government initiatives without violating the legislative or regulatory requirements around privacy.”
Gradual implementation
Fully implementing an identity management system is a multiyear project involving more than just IT.
“The biggest mistake is not having a vision of the end state right at the beginning and not having full commitment to go through the process,” Forrester’s Nagel said.
After agreeing on a vision, it is a matter of selecting which aspect to implement first and carrying that through to completion so there is an observable improvement and return on investment. Targeting commercial and Web-based products will make for quick success before tackling the more complex problems of integrating existing applications.
“When we look at the larger agencies, it tends to be their legacy applications and their legacy environment that becomes very complex,” Donfried said.