Tales from the Trenches: Identity Governance Best Practices

By Kevin Cunningham President & Co-founder

Focus on value. That has been SailPoint's mantra for 2009, particularly as we help our customers address security and compliance challenges amidst constrained resources, tight budgets and increasing scrutiny. When I sat down to write this month's opening article for NAVIGATE, I thought about discussing how our company and product add value.

Instead, I thought it would be more appropriate – and dare I say valuable – to share advice and lessons learned from our own customers. Based on conversations with customers throughout the last few weeks, I'd like to share a couple of important lessons learned from companies proactively addressing IT risk with identity governance.

Marry compliance and security efforts.  All too often, companies are focused on proving compliance and on preventing security breaches, but they attempt to address both individually. Identity governance enables you to truly synchronize your IT security and risk management efforts with your compliance and IT audit processes, which was the initial goal of the regulatory mandates in the first place.

Take the case of a major insurance company that wanted to implement an identity governance solution to demonstrate proof of SOX compliance while reducing security vulnerabilities. The company is visionary when it comes to proactive risk management because its IT leaders were adamant that they improve security in addition to complying with the "letter of the law."

With SailPoint IdentityIQ the company was able to quickly and easily aggregate, correlate and cleanse data for high-risk applications, and fully automate review and certification by line managers for 45,000 users. Out-of-box reports now provide visibility and proof necessary for internal and external audits without the need for time-consuming data gathering and compilation. And equally important, the project has lowered risk and improved security through the elimination of orphan accounts, excess privileges and SoD policy violations.

Don't underestimate the need for "quick wins."   Even as the economy stabilizes, the enterprise IT buying process has changed. That means that you need to focus on proving the value of your technology purchases. This goes beyond rapid deployment of the technology and requires that you can demonstrate tangible results at varying intervals of any implementation. Fortunately, the very nature of identity governance tools makes these quick wins almost automatic.

One of the world's largest banks experienced immediate value from the enhanced enterprise-wide visibility into "who has access to what" and the ability to easily generate customizable, on-demand reports within IdentityIQ. The bank accelerated the rate of early results by leveraging a hosted version of IdentityIQ and reported that during the first review cycle, managers were able to identify and revoke 20% of existing user entitlements as unnecessary. By this action alone, the bank was able to significantly improve its accuracy in granting user access privileges while also reducing risk and increasing security.

Equally impressive, the time spent on access certifications was reduced from months to a few days.

It's important to take a step back from your identity governance initiatives to make sure you're addressing security and compliance challenges in tandem. It not only makes your approach more efficient, which is critical for teams with constrained resources, it ensures maximum effectiveness and value for your efforts and investment. At the same time, identifying the "quick wins" given your specific situation allows you to achieve the incremental progress needed to garner on-going executive support for your project.

I hope this advice resonates with you. My goal is to continue sharing tips, tricks and lessons learned in future newsletters, in the customers section of our website and via the SailPoint blog, Identity Quotient.

Sincerely,

Kevin Cunningham
President & Co-founder
SailPoint

For More Information

• Read Customer Stories
  To learn exactly how SailPoint is helping enterprises to succeed with identity governance, download some of our customer success stories. Learn more »
• Webinar: Global Insurance Firm Case Study
  Hear how a leading global insurance and financial services firm dramatically increased the accuracy of user and entitlement data and reduced the time spent on access certifications from months to days. View webinar on-demand »
• Webinar: Global Bank Case Study
  Learn how the bank launched a fully-automated access certification process across 29 SOX-relevant applications in just 60 days. View webinar on-demand »