AmeriGas automates identity security and moves to the cloud

When AmeriGas began using SailPoint IdentityNow in 2017, the largest propane company in the US had no access or identity management system in place. Despite having thousands of employees and contractors across its two brands, AmeriGas was using manual provisioning, spreadsheets, and screenshots for certifications.

The result was that it took as long as two weeks to add or remove access for users in the system. Following an audit and security assessment, AmeriGas recognized its need for an identity management solution and brought Christopher Martin, Manager of Identity & Access Security, on board.

“When I started, we had to check and provision every system individually, and that would generally be handled across multiple teams in the organization,” Martin said. “We needed a solution that would address the disjointed nature of how access was being assigned and governed, and one of my primary goals was to find a better solution for doing so.”

After researching solutions on the market at that time, Martin learned that SailPoint IdentityNow was the only software-as-a-service (SaaS) platform that was capable of Identity Governance and Administration (IGA). Martin recognized that AmeriGas didn’t need the complexity involved with an on-premises solution, and he knew SailPoint would provide a framework that would enable AmeriGas to maintain best practices in identity governance, while also modernizing its access processes to where they needed to be.

An identity evolution

Years later, much has changed about the way AmeriGas does business, and SailPoint has been there to support that evolution. AmeriGas now uses SailPoint for more than 7,000 identities and 600+ roles using both IdentityNow for provisioning, certification, and password management, as well as IdentityAI for access insights, role insights and role mining.

Part of those changes have centered around learning the best way to use identity and access management to address the seasonality of AmeriGas’s business. “If you think about the uses for propane, there’s a ramp up season driven by things like grilling and vacation activities during the summer,” Martin said. “And then there’s a home heating season in the winter months, so there’s a ramp up then, as well, to meet the need. Those seasons require us to onboard more delivery drivers, schedulers, admins and more. Then when those seasons finish, there’s the need to do something with those identities at that time.”

Moreover, the industry itself has changed dramatically during that time, becoming a more lucrative target for attackers, whose efforts have resulted in lost data, identities, money, and brand reputation for companies they’ve breached.

Likewise, the energy industry has had to absorb the changes wrought by the global pandemic. “Our industry was one of the last to the game in terms of allowing remote workers,” Martin said. “When COVID started, we as an organization weren’t supporting remote work, and then suddenly we were. It was a new challenge for us to solve because everything was being done and accessed remotely. Now we’re closer to a hybrid environment, which in some ways is even more challenging because you don’t necessarily know where people are accessing from – the office, home or literally anywhere else.”

Identity for today – and tomorrow

Throughout those changes, SailPoint has been a key partner that has evolved along with AmeriGas. Today, Martin says SailPoint isused by AmeriGas in several ways, including:

• Provisioning attribute-based access to assign most of the access for connected systems, as well as for required certifications
• Password management and password reset functionality to give users the opportunity to do so however they choose
• Onboarding users the same day, reducing the time to provide access from weeks in 2017 to a matter of hours today
• Simplified documentation that can quickly be sent to auditors
• AI capabilities within certifications to leverage recommendations

Martin says recommendations  is the backbone of what SailPoint’s AI system does for AmeriGas, essentially providing role information in much the way that a data science team would. “With SailPoint enabling us to understand the percentage of people in a department that have access, we’re able to quickly determine whether a user should have access or not. We can look at the analysis and determine if a person is truly an outlier who really needs access.”

For the future, Martin is eager to see how SailPoint’s solutions continue to evolve – and how AmeriGas will be able to utilize future functionality. “Some of the things that SailPoint’s solutions do now were things that we weren’t even thinking about five years ago. But now I can’t imagine not having a tool without those things. In a lot of cases, SailPoint operates behind the scenes without anybody knowing to get people the access they need to do their job as quickly as possible.”

Likewise, Martin is looking forward to further leveraging SailPoint’s AI functionality for things like risk-based analysis to make access decisions based on the best data possible. “We are continuing to improve our role governance as AI further expands. Doing so will create the actual governance of roles versus something we say we should do.”

And as AmeriGas increasingly makes use of the cloud, Martin expects the need for SailPoint’s Cloud Access Management (CAM) will play a significant role. “We are definitely looking to leverage those tools more for SaaS cloud apps so we can harvest that data into AI and get a really full picture of the real access a person has.”