Governance Platform : Risk Analyzer

Most organizations have no way to assess the business risk represented by user access to sensitive applications and data. As a result, they have no way to prioritize their compliance and security efforts based on risk to the organization. Leveraging SailPoint's risk-based approach to identity management, organizations can prioritize compliance activities using a risk model that assesses security risk by user and by resource across the IT environment rather than trying to apply compliance monitoring and controls to all users and resources.

The Risk Analyzer is a key component of the Governance Platform and it locates and identifies areas of risk due to users with inappropriate or excessive access privileges. It provides a dynamic risk model leveraging patent-pending risk algorithms to calculate and assign a unique identity risk score for each user, application and system resource. The base IdentityIQ risk model is created by assigning unique risk values to each application, entitlement, role, and policy. The risk score is updated continuously based on changes to the user's access privileges, as well as "compensating factors," such as how recently the user has been certified and whether a policy violation has been allowed as an exception.

Leveraging risk scores, managers or application owners can target highest-risk users or systems first, improving the effectiveness of controls of their departments, and ultimately, the security and compliance of the business.

Determine Areas of Greatest Risk and Respond Accordingly

SailPoint's unique risk-based approach allows organizations to focus certifications, prioritize remediations, and modify change management processes, including access approvals, based on the potential risk to the organization posed by a user's access privileges. Ultimately, the Risk Analyzer enables organizations to:

• Lower the cost of compliance
• Prioritize usage of resources and focus efforts on areas of greatest risk
• Reduce compliance exposure and liability by identifying areas of high-risk and responding appropriately
• Improve the organization's overall risk posture