Develop a Comprehensive IAM Improvement Strategy

A successful identity and access management program is built on solid foundational processes.

EXECUTIVE BRIEF

Analyst perspective

Build a foundation for success.

A comprehensive identity and access management (IAM) program can enhance an organization's security and operational efficiency. However, IAM programs are challenging to implement. Practitioners must collaborate with stakeholders to integrate systems, applications, and directories; address technical debt and outdated infrastructure; and balance robust security measures with a seamless user experience.

Automation and self-service are often seen as solutions. Automate user provisioning with predefined roles and automatically deprovision access when activity falls below a threshold or upon employment termination. Empower users with decentralized identity (DID) or self-sovereign identity (SSI) solutions.

These are solid options, but organizations must understand entitlements, access policies, functional roles, and how to adjust entitlements accordingly. Build a clear IAM strategy to evaluate existing processes, systems, and controls; identify strengths and weaknesses; and build a clear roadmap to prepare your organization for automation and self-service.

Michel Hébert
Principal Research Director, Security and Privacy
Info-Tech Research Group

Executive summary

Your Challenge

• Immature IAM programs introduce significant vulnerabilities, which can lead to unauthorized access, data breaches, and compliance issues, threatening the security and integrity of organizational assets.
• IAM tools provide capabilities that can improve program maturity, report on identities, automate lifecycle management processes, and administer access to business functions. However, these tools require organizations to understand and adjust entitlements according to access policies and functional roles.

Common Obstacles

• Complexity: Implementing IAM often requires integrating multiple systems, applications, and directories, which is particularly challenging in large and diverse IT environments.
• Collaboration: Implementing an IAM lifecycle requires coordination across different departments. Aligning the goals and processes can be challenging, particularly in complex organizations.
• Resilience: The IAM lifecycle should be scalable. As the organization evolves, IAM systems should support more users, changing access needs, and new technologies like cloud services and mobile devices.

Info-Tech's Approach

• Develop a comprehensive IAM strategy: Define a clear IAM strategy that aligns with the organization's security objectives and regulatory requirements. It should outline the goals, roadmap, and desired outcomes of the IAM program and consider user populations, existing systems, and scalability needs.
• Implement IAM lifecycle processes: Establish standardized processes for user onboarding, provisioning, deprovisioning, and access changes throughout the user's lifecycle. Align them with security, compliance, and business requirements, and automate them to reduce manual efforts, improve efficiency, and minimize errors.

Info-Tech Insight

Security leaders find modernizing identity security daunting and focus instead on seemingly simpler challenges like implementing single sign-on (SSO), multifactor authentication (MFA), and privileged access management (PAM). However, this reactive approach can be more costly over time. Developing a comprehensive IAM strategy and roadmap is a proactive, high-value initiative that will drive the effective modernization of the identity management program.

Your challenge

Immature IAM programs pose a direct risk to the enterprise.

Identity-related incidents are on the rise. They can lead to unauthorized access, data breaches, and compliance issues, threatening the security and integrity of organizational assets.

The 2024 trends report from the Identity Defined Security Alliance (IDSA) paints a jarring picture of the growing frequency and impact of identity-related attacks.

90% of organizations experienced at least one identity-related incident in 2023.
84% of identity stakeholders who incurred an identity-based breach in 2023 said they suffered a direct business impact as a result.
48% of organizations involved their security incident response plans more than once in 2023 for an identity-related incident.

IDSA, 2024

Your challenge

Common obstacles

Common pitfalls can affect the value of IAM implementations.

• Lack of stakeholder support: Without strong executive support, IAM efforts may lack the authority to align departments and secure the necessary resources. Take a deliberate approach to modernizing your IAM program and discuss business, security, and compliance requirements with stakeholders.
• Viewing IAM as a project rather than a program: Organizations that view IAM as a one-time product implementation often struggle. IAM is a multiphase, multiyear initiative requiring continuity, context, and sustained effort. Build a strategic roadmap for the program and clearly communicate the priority and benefits of its initiatives.
• Identity sprawl: The proliferation of user identities across multiple systems complicates identity management and security. Design well-established, standardized processes for user onboarding, identity changes, and user offboarding as a foundation for the IAM program.

Info-Tech's approach

A successful IAM strategy must balance security and usability

• Security: Ensure that the IAM program protects the organization's systems, applications, and data from unauthorized access, breaches, and other threats. This includes implementing robust authentication methods, enforcing least privilege access, conducting regular access reviews, and maintaining comprehensive logging and monitoring.
• Usability: Ensure the IAM program is user-friendly and does not impede user productivity. This involves creating intuitive processes for authentication and access requests, minimizing the complexity of password requirements, providing efficient methods for password resets, and ensuring that the access management tools are accessible for both end users and administrators.
• To achieve this balance:
  • Gather careful requirements.
  • Conduct a comprehensive gap analysis.
  • Design foundational policies and workflows.
  • Communicate program priorities and benefits in a multiphase roadmap.

IAM Program Capability Model

IAM has evolved significantly in the last decade

The anatomy of an IAM program

Info-Tech's methodology for maturing IAM programs

Insight summary

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

IAM Program Requirements
IAM RACI, Identity Architecture, and Information Security Pressure Analysis tools

IAM Gap Analysis Tool
Current- and future-state gap analysis, initiative prioritization, and roadmap

Identity Lifecycle Workflows
IAM joiner, mover, and leaver workflows

IAM Improvement Strategy
IAM roadmap, strategy, and communication deck

Key deliverable:

IAM Improvement Roadmap
in the IAM Gap Analysis Tool

IAM is a multiphased program that may not benefit all stakeholders immediately. Without clear communication about prioritization and planned capabilities, stakeholder support can fragment.

Build a roadmap to outline how and when the IAM program will address specific capabilities.

Keep your organization safe

Measure the benefits of a robust IAM program

• Baseline your organization's performance against key metrics before proceeding with the IAM program improvement project.
• Organizations with a successful IAM program:
  • Reduce security risks to the organization.
    The number and severity of identity-related risks decrease over time. This includes tracking resolved vulnerabilities and mitigated threats. Expect an initial increase in the number of identity-related risks identified.
  • Improve end-user experience.
    The effectiveness of IAM processes improves over time, including the average time to onboard a new hire, the number of stale accounts, and the average time to deprovisiona user.
  • Are more likely to be compliant.
    Regular audits and assessments are more likely to show the IAM program adheres to relevant security and regulatory standards.

Measure the value of the IAM improvement project

Info-Tech's approach will accelerate your success. Estimates reflect advisory and workshop experiences.

Time Saved: 1 to 4 weeks
$ Saved: $6,499 to $16,899

The project's value comes from the initial strategy and roadmap design, but you will experience benefits over time as you implement IAM initiatives on the roadmap and communicate your approach more effectively.

Executive brief case study

INDUSTRY: Manufacturing
SOURCE: Info-Tech Workshop Engagement

Anonymous

The client organization was a parent company specializing in manufacturing petroleum additives through a network of subsidiaries.

Identity and access management drove this company's maturity in information protection. The company required an assessment to better understand its current IAM landscape, reduce business risk, and ensure the cost of its program aligned with industry best practices.

In addition to the security standards driving best practices, the organization also wanted to ensure that its IAM processes were usable and allowed its diverse workforce to receive the appropriate access they needed from any device.

Results

Info-Tech Research Group developed a comprehensive strategy that identified core areas for IAM maturity improvement and aligned them with the company's vision and business drivers. Furthermore, Info-Tech ensured that the strategy, recommendations, and roadmap supported the organization's identity management lifecycle.

The IAM Maturity engagement included the following components:

• Program Requirements
• IAM Program Gap Analysis
• Identity Lifecycle Workflows
• IAM Program Roadmap
• Next Steps

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

Workshop

“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

Consulting

“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

Diagnostics and consistent frameworks used throughout all four options

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is 8 to 12 calls over the course of 4 to 6 months.

Develop a Comprehensive IAM Improvement Strategy
Workshop Overview

Contact your account director for more information.
workshops@infotech.com 1-888-670-8889

Recommended workshop participants

Phase 1

Assess IAM Program Requirements

This phase will produce the following deliverables:

• IAM program requirements
• IAM program RACI
• IAM repository inventory
• IAM program target state

This phase involves the following participants:

• Senior Management (CIO, CRO, CISO)
• Senior IT Team Members
• IT Security
• IT Infrastructure & Operations
• Risk Management

Build a solid foundation for the IAM program

Time spent on reconnaissance lays the groundwork for informed decisions and strategic action. Gather requirements for your IAM program, including roles and responsibilities, regulatory needs, and the risk scenarios that matter most to your organization.

The following exercises will help you assess the goals and scope of your identity and access management program, identify process roles and responsibilities, inventory identity repositories, and assess your threat landscape.

At the end of the phase, you will have a completed gap analysis of the IAM program, including a set of improvement initiatives for further consideration.