Optimizing Identity Governance using Perseus IAM

A modern and cloud-native approach for identity and
access governance, data quality, and data accuracy.
This cloud-native approach in identity and access management
(IAM) includes IAM microservices that, once configured,
continuously extract, correlate, and normalize identity and
access data. This paper discusses the process by which you can
develop a high-performing, effective, and efficient IAM–IGA
infrastructure and use cases leveraging Perseus IAM and
industry-leading IGA platforms.
© Copyright 2018 Good Dog Labs, LLC

© Copyright 2018 Good Dog Labs, LLC | 2
Table of Contents
Summary 3
IGA Program Pain 3
Relying on an IGA Platform Alone Is Not a Strategy 4
Next-Generation IGA and IAM 4
Moving Toward an Automated IGA Framework 5
Nine Steps to an Automated IGA Framework 5
The First Six Steps in Establishing an Automated IGA Framework 8
Automate Application Onboarding 8
Continuously Baseline Identity, Account, and Access Information 9
Baseline and Catalog Your Current IGA Process 11
Collect Data and Assign Risk 12
Identify and Eliminate Bad Combinations 13
Feed the IGA Automation Engine 14
Conclusion 16
External Validation of the Perseus IAM Platform 16
Contact Good Dog Labs 17

Summary
Our modern approach to identity governance data management includes high-performing and
layered IAM microservices that, once configured, continuously extract, correlate, transform, and
normalize identity, system, application, device, and account data. This approach provides your
enterprise with the following benefits:
● Establishes high-performing, automated identity governance and administration (IGA)
data-processing pipelines and frameworks for bootstrapping IGA programs and
establishing ongoing identity analytics and access recertification processes across
disparate technologies and integrated business processes.
● Uses your current technology ecosystem of systems, applications, and devices in
conjunction with enterprise-grade IGA technology components, and includes new
components provided by Good Dog Labs™. (Contact Good Dog Labs for information
about Perseus IAM and its associated IAM microservices.)
● Allows you to implement an IGA Program in small, iterative sprints while establishing
asset interrelationships that simplify IGA platform integration and integration in a cloud-
native world. You can iteratively build your IGA capabilities over time, enabling you to
establish a risk assessment process that allows for fast data collection, correlation,
transformation, and normalization.
Implementation consists of nine main steps, six of which this paper describes in detail. By
implementing this new approach, you can better answer critical audit and business questions.
You can continuously and more easily identify toxic access combinations, accelerate your
project delivery, and automate your enterprise IGA framework and platform.
IGA Program Pain
There is an industry-wide consensus that an IGA Program begins with accurate and complete
data and is critical to a successful project delivery. Often, business stakeholders will claim there
are no issues with data quality, accuracy, and processes. Unfortunately, most often this claim
turns out simply not to be true, which is discovered either before project initiation or during the
requirements analysis phase of a project implementation. Generally, ensuring identity and
access data quality and accuracy is the most time- and resource-intensive task during an
implementation. Generally, organizations don’t have an appetite for “fixing” processes and
technology that produce bad data because of the time, costs, and cross-organizational
collaboration required.
Not fixing the data quality and accuracy problem generally leads to delayed project
implementations and highly customized IAM/IGA implementations, both of which affect project
budgets and probabilities of success. Not fixing the data quality and accuracy problem
effectively propagates bad data to downstream IAM/IGA systems, which leads to the granting of
inaccurate access or to inaccurate access recertification campaigns. This affects the

organization’s ability to comply with audits or leads to investments in manual reviews and
corrections. Fixing the data problem is generally not effective and is often a short-term solution.
Many questions still remain:
● How do you verify that problems are fixed?
● How do you know that the processes and technology in place will scale as business
requirements change?
● How can you react to real-time changes in levels of access?
● How can you automate the onboarding of data, systems, devices, and applications into
governance via the proper IGA platform channels and interfaces?
Overall, IAM/IGA return on investment is reduced, time to value is increased, and business
stakeholder dissatisfaction is rampant. This is generally the state in which we find our clients
today.
Relying on an IGA Platform Alone Is Not a Strategy
Although IGA systems are powerful and have robust capabilities, they often expect data in a
specific format. These systems often rely on inefficient means of performing real-time
transformations and quality checks on data, based on overarching business rules and policies.
Generally, IGA systems do not provide a means of applying real-time event management and
dynamic data policies to ensure data accuracy and completeness. In general, IGA programs
that rely on the IGA platform alone will experience difficulties and implementation hurdles
because of inflexible data models that do not adapt well to objects beyond identities and
entitlements. This also affects the overall solution’s ability to scale and support cloud-native
infrastructures, applications, and devices. Finally, IGA systems generally do not provide a real-
time view of data quality issues to security and operations teams so that they can take proactive
threat countermeasures.
Next-Generation IGA and IAM
As part of an overall cloud-native and modern IAM and IGA architecture, Perseus IAM provides
a real-time approach to ensuring identity, system, application, and device data accuracy and
quality. This allows organizations to take a systematic and modern approach to addressing
significant data accuracy and quality issues. Perseus IAM enables organizations to realize the
value of their IAM–IGA infrastructure faster and in a more cost-effective manner, all while
optimizing existing investments in IGA platforms and in-house technology. Here are a few key
capabilities Perseus IAM introduces into an IGA Program for accelerating IGA program success.
• Configuration-driven, real-time, and dynamic data filtering
• Configuration-driven data normalization
• Configuration-driven data inclusion/exclusion policies
• Dynamic JSON-based data model that scales across various types of identity,
application, infrastructure, and device data

• Real-time views into data quality, errors, and policies
• Real-time alerts when data is not of sufficient quality
• Real-time data transformations based on policies derived from Lua scripting
• Distributed IAM microservices–based architecture that leverages containerization for
faster deployment and updates to IGA capabilities
• Bridge between on-premise IGA systems, cloud applications, and cloud infrastructures
(i.e., Azure, Google Compute Platform, and AWS EC2)
• Bridge between IGA platforms, cloud-native infrastructure and applications, and real-
time cybersecurity alerting and threat response systems (e.g., SIEM)
Increasingly, the IGA industry is using these capabilities for accelerated delivery and adoption of
IAM services within an enterprise. Perseus IAM provided by Good Dog Labs, is the world’s first
IAM microservices–driven platform that organizations use to implement this new cloud-native
approach.
Moving Toward an Automated IGA Framework
This paper describes steps for creating and automating a modern IGA framework using Perseus
IAM and your existing IGA platform. Once you have mastered the steps, you can automate the
processes and tasks highlighted in this document, which include but are not limited to the
following:
1. Continuously baseline and collect your identity and account data from multiple sources.
Your sources can include non-traditional cybersecurity sources such as cloud access
security brokers, Tripwire, SIEMs, and governance risk and compliance platforms. You
can also use asset management or CMDB solutions for automatically extracting platform
information through the IAM services layer.
2. Continuously plan and run identity and privileged account certification campaigns with
real-time or near real-time data.
3. Automate Identity Lifecycle Management for cloud-native systems, applications,
devices, standard identities, and privileged accounts.
4. Perform real-time Integration into PIM/PAM and HashiCorp Vault Enterprise solutions
within actionable recertification processes.
5. Perform identification and remediation of separation-of-duty violations.
Nine Steps to an Automated IGA Framework
This section summarizes the guidance for successfully automating your IGA framework.
1. Automate Application Onboarding – Establish a “self-service” approach for delegating
application onboarding and integration into the IGA platform. In this use case, the
Perseus IAM platform performs the following tasks:
• Gathers application metadata, including configuration information for automated
connection and onboarding.

• Connects application identities, accounts, groups, and entitlements.
• Maps to the IGA metadata via the Perseus IAM normalizer, metadata, and IGA
services. This defines what users can access within the application’s landscape.
• Integrates into the IGA risk engines for assigning initial application risk scores.
• Aggregates and processes identity, account, and entitlement changes. Includes
issuing the appropriate identity lifecycle management events for provisioning and
• de-provisioning access.
• Creates a data quality and mapping report that identifies the level of adherence to
the IGA metadata model configured within Perseus IAM.
2. Continuously Baseline Identity, Account, and Access Information – Establish a
core foundation of “known and allowed” access for identities. It’s important to identify
all critical financial assets and key systems to baseline first. Once you have identified
systems and applications, prioritize the list of all applications currently under operation.
You can mine the resulting baseline information to determine the actual access and
identity behaviors for these assets. Resist the urge to spend time mining low-priority or
non-critical assets at first. Low-priority or low-risk assets do not contribute metadata
information for deciphering future roles and entitlements.
3. Baseline and Catalog Your Current IGA Process – Identify and document every step
of your current IGA process, from inception of access requests to manual or automated
provisioning. Leverage baseline periods to perform checks of current system and
application access. Record all findings in a format usable by future automated IGA
platforms, or leverage the Perseus IAM platform for storing the process metadata in the
IGA warehouse in a normalized fashion. You can then leverage these processes to
automate and orchestrate activities from Perseus IAM in conjunction with the underlying
IGA platform.
4. Collect Data and Assign Risk – Connect the baseline data with the current IGA
processes from the inception of access request to the manual provisioning and recording
of granted access. Define and assign organizational risk, create a risk-scoring model,
and score organizational risks on several factors. This is key for defining risk-driven
access certification and visualizing with tools such as heat maps. You can leverage
Perseus IAM for the automation of collection, correlation, transformation, and
normalization of data against existing IGA process definitions.
5. Identify and Eliminate Bad Access Combinations – Use the risk-based scoring model
created in the previous step to run “bad” or “toxic” roles, entitlements, and privileges
reports. You can also run data analysis pipelines within Perseus IAM. Perseus IAM is
specifically designed in conjunction with your IGA platform and program to use the
existing identity, account, and entitlements metadata to help determine what possible
toxic combinations currently exist. The value of doing this before sending data to the IGA
platform is faster analysis and definition of the higher-level IGA metadata relationships.
This helps provide a smaller, more focused superset of IGA data to the IGA platform for
processing and certification. It also significantly reduces the load on the IGA platform,

making it that much faster for business users. Execute the reports by highest to lowest
risk. Remediate any high-risk or critical findings immediately.
6. Revisit Your Separation of Duties – By creating a business activity–driven framework
and leveraging the risk model and reporting processes described in the previous step,
you can identify common and recurring SOD violations. You can then adjust your
framework for baseline data, current IGA processes, and collected risk information.
7. Feed the IGA Automation Engine – Via Perseus IAM, you can continuously feed
clean and normalized sets of identity and access data into your IGA engine, including
the models from the previous steps. Transition to and establish a business activity–
based access recertification process. By mapping simple-to-understand business
activities or processes to underlying roles and entitlements, business managers can
better understand whether an employee should have access to an application and
underlying system.
8. Implement a Continuous Recertification Model –Take time to implement a model that
yields the lowest operational maintenance time and cost and is easy to understand from
a business perspective. Technical IGA models are not popular and tend to be costly
from both time and operational support perspectives. Technical models drive high
operational staff costs. While looking for an automated IGA vendor, it’s important to
verify whether the vendor supports business-friendly campaigns based on business-
friendly activities and/or processes. In addition, IGA vendors should have key identity
and access management service and technology providers such as Good Dog Labs that
can implement a cost-effective, continuous, and iterative IGA model.
9. Make Your Recertification Model Actionable – Ensure that your automated IGA
platform and processes are actionable from within the automation engine. For example,
if a certification campaign identifies roles that should not be assigned to a person, the
business manager should be able to immediately revoke access. This also works in
reverse: if employees do not have the appropriate roles, they need to do their jobs, the
business manager should be able to immediately grant them access to the application or
system. The automated system should have pre-built connectors to or integration into
Perseus IAM for taking action on target systems and applications.

The First Six Steps in Establishing an Automated
IGA Framework
The following diagram and process descriptions provide additional details on the approach to
establishing a continuous IGA framework and automated access recertification process. These
processes are implemented in an iterative fashion and are listed in order of execution and
priority. The processes accelerate IGA for an organization that is currently based on manual
processes and non-enterprise–scale technology.
Automate Application Onboarding
This section includes the recommended initial steps for establishing a self-service automated
application and platform onboarding process to collect identity, account, group, and entitlement
information. This is an IBM Identity Governance and Intelligence example via Perseus IAM
SCIM API support.
A diagram of this process follows.
The process consists of the following steps:
1. Application owners and custodians access the Perseus IAM application onboarding
“self-service” user interface or API and post application metadata, including connection
parameters.

2. The UX or API posts information to the ETL (extract, transform, and load) microservice.
The microservice communicates with the family of microservices to begin the process of
orchestrating the onboarding process.
3. The IGA microservice creates the appropriate application artifacts in the IGA platform.
4. The ETL microservice automates the extraction of the identity, group, accounts, and
entitlements data from the application or platform. This information may also be provided
by an onboarding API exposed by the ETL microservice.
5. The IGA microservice creates mappings for the configured IGA metadata model.
6. Once data is normalized, a subset of the data is aggregated into the IGA platform for the
appropriate application and launches the certification campaigns and any other custom
IGA platform workflows.
Continuously Baseline Identity, Account, and Access Information
This section includes the recommended steps and questions to ask for establishing a
continuous baseline.
A diagram of the process follows.
Perform these steps to complete the process.

1. Implement fast, small, and efficient continuous identity and account data collection
Perseus IAM microservices that can accept data from any source. Key questions follow.
a. What types of sources can send identity event data? Here are some common
source protocols to identify:
• Syslog
• JDBC
• Network equipment protocols
• Firewall log export API (e.g., OPSEC/LEA)
• Intrusion prevention systems (e.g., SDEE)
• SNMP (all versions)
• Standard log files
• Microsoft security event logs
• Mail server logs
• Standard network services logs (e.g., DHCP, DNS)
• Standard web and application server logs
• Virtualization and containerization (e.g., docker) logs
• Database listener logs
• Network packet captures
b. Are the continuous audit services invasive to the source or network?
c. Do the continuous audit services support standard identity event and monitoring
protocols?
d. Can the continuous audit services feed identity-specific metadata to other event
collection systems?
2. Via Perseus IAM, collect audit and event information and provide it to the management
and security team via various methods (e.g., Splunk, Graylog). The team can run data
approval flows in parallel in a continuous and iterative fashion while flagging and
throwing out exceptions for handling. Tip: Exceptions will likely lead to pointers to toxic
access combinations.
3. Once both the IT security team and management agree on the “known access,” add the
information to the baseline for that period. Perform baselines within “baseline periods,”
as access is continuously changing. Compare baseline periods to determine access
differences as you are identifying “known access” to critical assets.
4. Store baselines to help in documenting the current IGA process. Store baselines in a
format supported by automated IGA platforms. You can use a platform like Perseus IAM
from Good Dog Labs to automate the extraction of the data and set up a larger IAM
metadata model that then feeds a subset of normalized identity and access data to an
IGA platform.

Baseline and Catalog Your Current IGA Process
This section includes the recommended steps for baselining and cataloguing your current IGA
process.
1. Analyze current application and system access request processes.
2. Build an application and system catalog. Your catalog should contain critical functional
and security metadata.
3. Analyze and automate your current communication process between the access
requestor, approver, and IT security teams.

4. Review your current violation checks, approvals, and access exception processes.
Record violation trends in addition to documenting why, rather than how, decisions
are made.
Ensure that the IT security team is adding decisions and entitlements into an
entitlements warehouse store. Send this data for secure record keeping and place it in a
format for future automated IGA frameworks and platforms.
Collect Data and Assign Risk
This section includes the recommended steps for collecting data and assigning risk.
1. Establish a continuous data collection mechanism while performing this phase. This
ensures that you can reuse these IAM ETL microservices to feed an automated IGA
framework and platform. Implement audit or data extraction IAM microservices for
custom or unsupported applications and systems. Audit or data extraction IAM
microservices expose a developer- and business application–friendly interface for
sending and collecting identity event messages for custom business applications.
2. Generate detailed identity and asset reports for management and auditor reviews. You
use these to develop a thorough risk profile.

3. The IT security and auditor review process then correlates and confirms the risk scoring
and rating with management and adds the risk profiles to a reusable catalog.
4. IT security stores the risk profiles for future automated access governance models and
platforms.
Identify and Eliminate Bad Combinations
This section includes the recommended steps for identifying and eliminating bad access
combinations.
1. Implement continuous “risk-aware” audit and security incident and event management
data collectors. Continuous-risk IAM microservices allow for a “risk-aware” business
application–, developer-friendly interface. You use this interface to ask risk-scoring
questions and for sending event data for automatic risk classification for custom
business applications. The IAM microservices, in conjunction with Lua capabilities, allow
for client application registration, risk category, and rating, and automatically classify
identity events received.
2. Leverage the store created in the “Collect Data and Assign Risk” phase to generate a
series of reports for management, auditor, and IT security review.

3. Identify “toxic” combinations in addition to actual toxic systems and applications.
4. Remediate and handle any emergency removals of toxic combinations if they present a
significant risk to the organization.
5. Store toxic profiles for future automated access and governance models and platforms.
Feed the IGA Automation Engine
This section describes the recommended steps for feeding the IGA automation engine.
1. Go through an automation readiness check before attempting to transition to a fully
automated system. Otherwise, you run the danger of automating bad processes and
data. Assess the processes that worked or that presented a constraint for automation.
When in doubt, do not automate a process. As you create the appropriate automation

rules, take the outputs, models, processes, and data stores generated from the previous
steps and systematically feed them into the automated IGA platform rules.
2. Analyze each of the following, which helps you complete an initial set of business
activities and roles based on known risk categories and levels:
a. Examine the application system catalog closely and note the system or
application risk score.
b. Review access request patterns – Understand the pattern of access requests by
examining the top 80 percent of access granted for 90 percent of user groups,
entitlements, and existing roles.
c. Review the risk profile for current access.
d. Define “toxic” combination and SOD rules. Import them into the IGA platform.
e. Import all identity and account baseline data that you have collected.
f. Review all identity analytic information.
g. Using the information, you have gathered, create a set of common business
activities and roles based on the system and application risk scores.
3. Create business-driven activities with associated roles and entitlements within the IGA
platform.
4. Perform a series of test campaigns to prepare business management, application
owners, and the IT security team for the real automated certification campaigns.
5. Record campaign results. Review them with business management, auditors, application
and system owners, and IT security.
6. Build continuous change mechanisms for easily adding or removing new applications
and systems to the IGA framework and platform.

Conclusion
Spend time upfront to implement a model that yields the lowest operational maintenance
burden, is amenable to change, and is easy to understand from a business perspective. Build
your access certification to be almost in real time if not in real time by leveraging Perseus IAM.
Think continuous implementation cycles and ensure that you enable your applications with
access governance capabilities. Implementations that do not emphasize business capability and
focus on technical-driven models are not popular and tend to be complex and costly from both
time and operational support perspectives. When looking for an automated IGA vendor, verify
whether the vendor supports robust SCIM API and business-friendly campaigns based on
business-friendly activities or process identifiers.
Ensure that your automated IGA platform and processes are actionable from within the
automation engine. For example, if a certification campaign identifies roles that should not be
assigned to a person, or if it flags a toxic combination, the business manager should be able to
immediately revoke access. This also works in reverse: if employees do not have the
appropriate roles, they need to do their jobs, then the business manager should be able to
immediately grant them access. The automated IGA system should have pre-built connectors
for taking action on target systems and applications. Ideally, the IGA platform has an integrated
identity and access Management platform for end-to-end management.
Finally, ensure that you are implementing an IAM microservices platform such as Perseus IAM.
Perseus IAM allows you to abstract the collection, correlation, transformation, and normalization
of identity and platform data for establishing a dynamic and configuration-driven superset
IAM metadata model that is applicable to your business. This high-performing layer is integrated
into your existing IAM, IGA, and cybersecurity platforms, directories, and databases in real time.
Consult with Good Dog Labs for details about Perseus IAM, which you can use as the platform
for accelerating implementation of your IAM microservices. (Find Good Dog Labs contact
information at the end of this document.)
External Validation of the Perseus IAM Platform
The Perseus IAM services platform approach to IAM is in line with industry analysts from a next-
generation IAM perspective.
Using our services platform, a global retailer has implemented remote-access two-factor
authentication services and has integrated identity lifecycle events with its IGA platform.
Additionally, Perseus IAM utilizes a next-generation microservices architecture for faster and
nimbler delivery of IAM services.
In conjunction with your IGA platform, Perseus creates a high-performing, resilient, and flexible
end-to-end IGA services offering. In combination, the platforms reduce overall longer-term costs
and provide your organization with the utmost flexibility in implementation styles.

Contact Good Dog Labs
Contact Good Dog Labs for more information on Perseus IAM.
Email: sales@gooddoglabs.com
Web Site: www.perseusiam.com
Good Dog Labs, LLC
6 Blackstone Valley Pl #205
Lincoln RI 02865
Good Dog Labs, LLC
801 Barton Springs Rd
Austin TX 78704
Authors:
Dino Pietropaolo, Chief Technical Officer & Co-Founder
dino@gooddoglabs.com
Aldo Pietropaolo, Chief Executive & Co-Founder
aldo@gooddoglabs.com
Good Dog Labs, LLC.
401-495-6888

Optimizing Identity Governance using Perseus IAM

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Optimizing Identity Governance using Perseus IAM

Similar to Optimizing Identity Governance using Perseus IAM (20)

Recently uploaded

Recently uploaded (20)

Optimizing Identity Governance using Perseus IAM