Identity management a complex process with a simple goal

 

Connecting state and local government leaders

A failure to realize the process changes involved has doomed some identity management systems, but there have also been successful deployments. And integrated identity management and access control suites are making it easier to achieve the desired result.

Identity management and access control systems have a simple purpose: ensure that users can access only the data and applications they need. However, getting to that point is not so simple.


In this report:

12 questions to ask before implementing an identity management system


Many large organizations have a variety of systems in operation. Different parts of the organization might manage those systems, and they might have a range of processes to acquire user information and approvals.

“When a large government organization takes on a project to automate provisioning, it must include the request process, the approval process, the routing, and, ultimately, the provisioning of credentials and entitlements into the target systems,” said Gregg Kreizman, Gartner’s research director. “Many user provisioning projects have failed because organizations didn't take into account the amount of business process change involved.”

Although some organizations have failed to implement identity management systems, there also have been successful deployments. And integrated identity management and access control suites are making it easier to achieve the desired result.

“The issue here is balancing privacy, security and ease of use for the user,” said Jon Oltsik, principal analyst at Enterprise Strategy Group.

Define the scope

Implementing an identity management system goes beyond just making sure people have their Homeland Security Presidential Directive 12 Personal Identity Verification cards and can remember their passwords.

“What we consider to be identity and access management is really a combination of at least a dozen different technologies,” said Bill Nagel, an analyst at Forrester Research.

Forrester Research evaluates identity management vendors based on 14 different technologies: directories, enterprise single sign-on, entitlement management, federation, identity audit, metadirectories, multifactor authentication, password management, privileged user and password management, provisioning, role management, user-centric identity, virtual directories, and Web single sign-on.

Gartner tracks vendors in three different categories related to identity management: single sign-on, user provisioning and Web access management.

When implementing an identity management system, organizations need to agree on what is necessary to meet business needs, a process that starts with determining what you have in place. That review should include policies, procedures, workflows, hardware, data sources and software, and it must include all departments.

“A lot of people are coming to realize that ID management is, first and foremost, not a technology problem,” said Paul Donfried, vice president of identity and access management at Science Applications International Corp. “It is an issue that permeates organizations, and you tend to find certain functions that had to historically manage identities.”

A human resources department typically will run an employment eligibility check on applicants before hiring them and might already have the organizational structure, chain of command and employee roles loaded into a human resources management system. That data can serve as a basis for creating the identities, roles and authorizations in the system.

For example, when the Agriculture Department needed to implement HSPD-12, it used the department's PeopleSoft EmpowHR system as the authoritative starting point for employment status and then expanded it to cover contractors and state and local government employees who also needed access. Procurement employees know what vendors should be included. Payroll and security staff members can contribute other information that the system should incorporate.

Next, find out the business needs of the stakeholders. In addition to IT access, be sure to consider additional functions that might be needed, such as verification of electronic signatures. From there, design an implementation project that meets those needs and will engender support.

“You need to think about the business needs of agencies and not think of it as purely an exercise in deploying technology,” said Gerry Gebel, vice president and service director of Burton Group’s Identity and Privacy Strategies. “This will result in a more successful deployment, happy customers and increased likelihood that they will invest in future identity management improvements.”

Selecting products

After determining the business needs, you can start looking at the software available to automate the processes. As with other types of enterprise software, the initial choice is between buying an identity management suite and taking a best-of-breed approach. However, with identity management software, software packages could be composed of products that other vendors recently acquired because the market is rapidly consolidating.

“Sometimes, these products have been integrated seamlessly, but with others, it is an ongoing process,” Nagel said.

There are five main vendors in the identity management field: CA, IBM, Novell, Oracle and Sun Microsystems. Although Oracle recently acquired Sun, Nagel said there is significant redundancy between the two companies’ identity management offerings. It isn't known yet whether Sun's suite will be able to improve the strength of Oracle's offering, which is already ranked No. 1 by Forrester and Gartner.

In addition to those five vendors, dozens of other large and small companies offer niche products. Donfried said that when selecting a product — whether it's a suite or best of breed — the first thing to look for is flexibility.

“More than anything, you want to avoid locking in to any single vendor or any type of proprietary solution,” he said. “Whatever we view as the right standard and the right solution today, by the time we have it installed, configured and operational, it is outdated.”

Oltsik recommended keeping an eye on the emergence of what he calls Identity 2.0 technologies, such as the open-source, Web-based single-sign-on systems OpenID and the Shibboleth System, in addition to Microsoft's CardSpace. Those technologies provide users with claims-based authentication, single sign-on and data privacy.

“It is too early for agencies to 'buy' an Identity 2.0 solution, but they should be paying attention to and supporting standards and product development,” Oltsik said. “Since ID 2.0 is built to support anonymity and privacy, it may be a perfect fit for e-government initiatives like online voting and health care reform, enabling cost-saving e-government initiatives without violating the legislative or regulatory requirements around privacy.”

Gradual implementation

Fully implementing an identity management system is a multiyear project involving more than just IT.

“The biggest mistake is not having a vision of the end state right at the beginning and not having full commitment to go through the process,” Forrester’s Nagel said.

After agreeing on a vision, it is a matter of selecting which aspect to implement first and carrying that through to completion so there is an observable improvement and return on investment. Targeting commercial and Web-based products will make for quick success before tackling the more complex problems of integrating existing applications.

“When we look at the larger agencies, it tends to be their legacy applications and their legacy environment that becomes very complex,” Donfried said.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.