Identiverse 2021 - Field of Dreams is a Myth – Supporting Digital Identity Beyond the Project
•Download as PPTX, PDF•
0 likes•192 views
A lesson found far too often in identity & cybersecurity programs: buy the tools, we'll worry about support & operations later. Far too often, enterprises allocate budget to acquire technologies to support digital identity initiatives, failing to consider the people and processes that will need to be added or changed to make the initiative a success. I call this the, "Field of Dreams - Build It and They Will Come" model. In this talk, I'll share the lessons learned in building digital identity solutions at 3 very different companies, with 3 very different outcomes. We’ll explore wisdom gained across 3 different digital identity service domains including: privileged access management, identity governance & administration, and access management.
Recommended
More Related Content
Recently uploaded
Recently uploaded (20)
Featured
Featured (20)
Identiverse 2021 - Field of Dreams is a Myth – Supporting Digital Identity Beyond the Project
- 18. • • • • • •
- 20. • • • •
- 21. • • •
- 22. • • • • •
- 23. PAM Reference Architecture 23 Access Certification Identity Management Non-person Credential Management Identity & Access Management SRM/Ticketing Workflow Policy Store Logging & Audit SIEM CMDB / Change Management Information Technology & InfoSec Resources **Analytics/ AI/ML SOC Credential Vault Session Management & Recording PAM Policy Management Discovery & Policy Enforcement Session Review Privileged Access Management Secret/Key Management EPM*
- 24. • • • •
- 25. • • • • • •
- 26. • • • •
- 27. • • • • •
- 28. • • • • •
Editor's Notes
- This talk is about an idea, one fairly common to identity projects, though by no means exclusive to them. We call this the ‘Field of Dreams’ fallacy, the idea that if you simply build something, an identity platform in this case, business problems will be solved by the very nature of deploying the technologies that support them. The origin of this myth is from the movie of the same name, Field of Dreams. In it, Farmer Ray is told that if he builds a baseball field in the middle of his cornfield, storied ghosts of baseball will return, including his father. “They” will come. Setting the story of the movie aside somewhat, let’s dig deeper into this idea.
- But does that really work? Let’s find out by playing with the stories premise a bit…
- So it is June, the heart of baseball season and I happen to be a huge fan, so let’s do like Ray did in the fabled movie, and let’s build a ballpark
- This is Segra Stadium, build in 2019 as the home of the Fayetteville Woodpeckers, a Single A team in the Carolina league. One thing I love about living in the Carolinas is the abundance of minor league baseball throughout the region. So after this ballpark is built, what other things do we need?
- Yes, you need fans, but you need someone to let them in and better yet, allow them to experience the glorious security theater that comes being being inspected mercilessly
- So yes, we add fans, with the obligatory cornhole game, what else?
- Concessions? Of course! You can’t do baseball without hot dogs and craft beer
- Then there’s the famous 7th inning stretch Ok, full disclosure, this image is not Segra Stadium, it is the home of the KC Royals. Wait, did I forget something?
- Oh yeah, players! Can’t play a game without players!
- Build-advertise-run, but what is running a service? More specifically, what is running an identity service like? Let’s find out…
- First, you need an architect… Ok, no more pop culture jokes, I promise, not really. We’re not ready for him just yet. My plan here is to share some of the lessons I’ve learned through lens of identity projects that have spanned decades. So Let’s set the stage…
- Company 1 – Large food services company with about 250k employees, but only a small fraction of them are knowledge workers. Very large, very decentralized customer base Company 2 – Fortune 100 Health Care company 65k employees, large collaborative requirements, large but largely disengaged customer base Company 3 – Med sized financial services company, 15k employees, large customer base I helped build and/or manage identity services for all of these companies at varying stages of maturity in their IAM lifecycle Full disclosure, though, a lot of these lessons are from the workforce IAM perspective. Customer/Partner IAM may shift some of these recommendations considerably
- If possible, make maintenance of data a critical business process. If you can’t achieve it within your org, which is not uncommon, partner with your business or IT org that can. 2nd, when examining Lifecycle management processes, keep process re-engineering in your quiver.
- The elements of the reference architecture are never meant to be all inclusive. You can add capabilities or leverage them as your practice matures.
- Begin with the end in mind – end is the sustainable state of identity