Are you tracking metrics from our IDAM implementation…..? Here are a few that may help identify areas for improvement.
Within the IT security initiatives of Identity and Access Management, systems and projects are typically considered high value. Addressing corporate risk, providing ROI, and meeting requirements of compliance; but not uncommonly have challenges with deployment. Not uncommonly these challenges have root causes from having to reconcile the very people and process breakdowns IAM automation is meant to solve. Dirty data, inconsistency of process conformance, too many people involved in authorizations, lack of documentation, lack of training, lack of change management, which all lead to a new trend and call for the need of Identity Governance, with performance metrics, and continuous metrics.
Identity governance involves defining and executing the identity related business processes that are most critical to the organization. For example, a systems engineer needs root / systems super user access to the server hosting an ERP system. Who needs to approve that request? Who is the one who actually takes the action, who grants that access? How does that process get documented? Where is it stored, and for how long is the information saved? What information should be continually be monitored?
Getting an IT governance process started can be a challenge, maturing that governance process is where the return on investment is at. But how to mature your Identify Governance takes information. Information you can track, trend and monitor to identify effectiveness, trends to show impact or opportunity, and which identity-related processes are most in need of attention. Below I have collected some of the more fundamental data elements I have seen to offer insight and comprise a fairly solid system of monitoring.
ü Number of uncorrelated or “orphaned” accounts. These are accounts that have no owner, and occur most frequently when a change happens, such as a promotion or a termination, and that person’s accounts were not transitioned, or de-provisioned properly. Defining what too many of these accounts can be a challenge, but consider each one of these accounts represent a risk. They are open, live accounts that can be easily hijacked, or simply used for un-authorized purpose. These may be thought to be not de-provisioned or even temporary accounts open for hack, hijack, or inappropriate reassignment. It’s like leaving your keys in the car when you go on with your daily business. How important are orphan accounts? Ask Intel, their famous case resulted in an estimated $1 Billion in theft of intellectual property.
ü Number of new accounts provisioned. This number should closely follow the number of new users/employees/or a simple calculation. For instance (new employees + new contractors + new transfers) – (terminations + resignations + transfers out) = new accounts provisioned. An effective IAM program should always account for any new user who needs to be granted access to systems and applications. If a discrepancy or a significant lag between the number of provisioned accounts and the total number of “new” for a given period, could be an indication inefficient processes, poor identity data, or a deficient tracking of identify data. Most likely this would require detailing and resolution during the next audit. Additionally this is an area for enhancement, and opportunity for possible ROI to the business.
ü Password reset count per month. This is normally a metric justification of investment in automation of provisioning. It’s a key metric to continue to monitor in both the use of automated methods of password resets and any administrative intervention to reset passwords. This can be the help desk calls, or the request to reset via automated means. This metric is a good indicator of password policy effectiveness, password policy change management and user acceptance, and in general this metric should be something that trends downward over a period of time, allowing for peaks and valleys for events like enforced resets. Monitoring this metric will provide a number of insights to help closely align password and identify governance processes and effectiveness of the tools and automation processes in place to service the business users, and impact of the those tools and automated processes.
ü Time for Identify (Insert/update/delete) of identities. This is a group of metrics that are huge for tracking and understanding of risk, effectiveness of governance processes, effectiveness of automated processes, and service levels you should be delivering to the business. It also helps to unveil deficient business process that needs review, and adjustment. Tracking how long a new user waits to get access is key for Service levels, it has implicit ramifications to productivity, and ROI opportunities typically used to justify identity automation efforts. But often times gaps represent short comings of process in the business side, data, or missed assumptions in process or data. Additionally what assumptions are built into the approval processes (automated or not). This is assumption is something commonly in Identity governance or any workflow application typically is missed in estimation and built in as a dependency to the systems and processes. These groups of metrics prove to monitor risk, days or hours of access to systems that are potentially open to misuse, days or hours of missed productivity. Both lead to rationalization of the governance processes against the business realities of dependent process, data, process bottlenecks, and assumptions about authorizations and time for manual / people intervention.
ü Number of Exceptions: This is another group and/or multi attribute type of metric. First the number of reconciliation exceptions. This is typically that first cut at data issues, either from entry, manual process, or something breaking the rules like a backdoor account creation capability or other. Tracking exceptions for reconciliation should trend or achieve zero over a relative short time once and will provide the key proof that you’re IT Identity Governance is in place, and being confirmed. Additionally to reconciliation the access re-certification exceptions are also important. New applications or lifecycle expansion to include additional applications over time may cause this number to reflect issues with specific groups of users and systems. But again over time this metric should trend toward zero. Not trending toward zero will identify identity data quality issues or of process problems. Either way review of the process, automation and possible backdoors and any manual processes not conforming to Identity Governance need attention or at very least need documentation proper notations.
ü Number of credentials: Here is a metric I would recommend that collecting more information on and maintaining or collecting metrics of could be of benefit, as without a doubt future needs will ask for performing some type cross analysis on this data and having the fine levels of granularity of data will be important. As a key metric that drives Single Sign On “SSO” what are the unique accounts, users have? What is the average number of user accounts for all users, for users within certain organizations/teams, and what are the unique accounts/ averages for certain levels of employee. These metrics enables companies to review why the numbers for certain groups are higher (identify systems for tighter integration and use or leverage of Identity Management tools and services which are created for the enterprise.) Additionally where some opportunity exists for removing non-compliant systems access management with systems that will conform to Identity Governance compliant methods. My thoughts on minimum cross analysis is:
- Unique Credentials Per User and for:
- Average for all employees
- Average for all contractors
- Average for all employee(s) per job classification
- Average for all employees(s) per cost classification or department
- Average for non-Employee/Contractor type
- Average for Mobile users
- Mean, and Range also per (employee, contractor, job class, department, etc.)
ü Violations: This might be a difficult item to monitor but can also be fairly straight forward if your organization has role management in place. Separation of Duty is now a fundamental aspect of Identity Management, and although I still see several companies struggle to justify implementing user group role management, and create governance for separation of duty it is a requirement that most companies cannot do without. Monitoring violations to separation of duty policies is key, and given goal of Identity Governance, and the Identity programs need to be carefully be monitored and incrementally matured. Let’s take a case scenario, of a manager who approves raises can also trigger an event to print checks. This very deficiency can create legal ramifications, not only because of possible fraud, and theft, but for the company and it’s officers your promise of compliance, your possible damage to brand value in a disclosure event, and so on makes this an essential metric to track, trend, examine and re-examine to mature and make sure you continue to also mature your SOD policies for.
ü Time and Cost of Remediation: Initially this will be a challenge but once the knowledge of the data, and process is understood the orchestration and possible automation and reporting of standards for remediation can be structured and have normal governance reporting and prove as another and on-going ROI often not measured and forecasted at benefit to the Identify Governance and Management program.
It is often hard to understand the scope and impact of these kinds of people and process breakdowns. Additionally it’s difficult to understand business impact and what the ROI opportunity can be. The importance of monitoring key items from your identity management programs are more than about doing justifications with well defined items for return of addition investment but this will certainly help with the incremental program, it’s maturation, an investment in maintenance and take a corporate Identity Management Program/implementation from an essential compliance only reporting tool toward a governance program providing value and continued insights to impact, risk, and benefit.
