IBM Security Identity Governance and Intelligence IBM Internal Use Only Foundation Offerings IBM Security Identity Governance and Intelligence IBM Security Product Professional Services Identity Governance Foundation

IBM Security Identity Governance and Intelligence (Foundation Add-On) This service offering provides a foundational implementation of IBM Security Identity Governance and Intelligence (IGI) in a non-production environment with basic integration to an existing IBM Security Identity Manager deployment and basic governance configuration and transfer of information. IBM Security Product Professional Services IBM Security Identity Governance and Intelligence (Foundation Add-On)

Organizations struggle today in effectively managing the user identity and access processes 13% 40% of companies have implemented a centralized approach to identity compliance of applications that employees have access to are not shut down upon termination minutes per day is what the average user spends logging on and has15user ID’s and passwords all expiring at different times 16 58% companies use mostly manual processes for monitoring and testing identity controls Sources: Meta Group, Ponemon Institute, Gartner, Burton Group IAM CHALLENGES CIO’s recognize that an inadequate identity management program can leave otherwise secure systems open to risk How to manage users and their access rights throughout lifecycle and flag expired accounts and role conflicts How to demonstrate compliance to regulatory mandates and monitor and correct security violations How to streamline user access to protected resources while retaining strong authentication How to reduce costs of managing identity and access without sacrificing necessary control IAM Operations Improvement Discussion Guide

Identity Governance Pain Chain Application Manager CFO, CEO, COO Are we properly managing user access? Will our security controls pass the next audit? Can you confirm that John Smith has the proper access? 3 IT Security I can tell you what access John has – I can’t tell if it’s appropriate 1 4 2 5 Internal Auditor Business Manager Can you confirm that John Smith has the proper entitlements? Could you prove that John Smith has “appropriate” permissions for his job? 6 I could… If I was technical enough to understand all these IT details…

IAM & Governance covers all accounts with access to company’s network Identity Governance Too much investment on IAM Technologies, while business complaints still increase from too many manual processes and unfriendly user experiences. Common Challenges Common Users Access recertification is difficult for reviewers/ business managers as: entitlements are not easy to understand too many accesses to review, very time consuming (results in rubber stamping) feels uncertain about the decisions but still finish the review under time constraints UI is not intuitive and difficult to navigate Difficult managing onboarding and off-boarding of contractors and partners who have access to critical systems and privileged accesses in the environment Still live with hybrid model of recertification using technology and manual (spreadsheet) processes Difficult and expensive to keep up with vendor technologies with changes, upgrades, new versions, migration, especially for custom developed modules requiring maintenance Increase in demand for compliance proof and evidences Internal Users (employees / non-employees) Business Partners & Customers Technical / Non-Human Accounts IAM & Governance covers all accounts with access to company’s network Identity governance and administration

Expand Identity Solution into the Business (Ticketing systems are not the solution) Business Centric Identity Dashboard Business to IT Bridge Identity governance and administration

Identity Governance – Successful Programs Less about technologies, but business oriented solution is what drives the IAM & Governance Programs successful Lessons learned from successful programs Common Users Business oriented solution enablement, including: business friendly entitlement glossary definition business role discovery & engineer business oriented recertification campaigns alternate tool availability with much better UI and migration path Comprehensive user identity lifecycle process enablement and “just-in-time” access management services for privileged users Prioritization of business and applications adoption, with the proven factory-model adoption methodology Merge and simplification of technology capabilities and streamline the processes and operations model Flexible and thorough reporting of access governance results and proof Continual partnership to share experiences, leading practices, & bench-marking across the industry Internal Users (employees / non-employees) Business Partners & Customers Technical / Non-Human Accounts IAM & Governance covers all accounts with access to company’s network Identity governance and administration

Identity Access Governance and Administration Delivery Methodology… We bring highly skilled resources equipped with proven delivery methodology and assets. We have optimized delivery approach for each offering to bring benefits and quality assurance. Governance adoption strategy Accelerated IGI deployment Identity governance advanced integration Information Gathering Planning and App/ BU Prioritization IGI Service Planning & Prioritization As-is & To-be Process Definition IGI Foundation Deployment Application Onboarding Business & Security Prioritization Application Onboarding IGI Service Development Architecture & Migration Plan Access Recertification Enablement IGI Service Deployment Delivery Methodology Delivery Methodology Delivery Methodology Identity governance and administration

Governance Principles – Policies - Practices Foundation Lean Conceptual Architecture CMMI Upgrade Services Business Analysis Base Deployment Expansion (add-on) ITIM ISIM IGI (Governance) Add-On Governance Principles – Policies - Practices Foundation CMMI and Vision Workshop* Vision ITIM Migration Lean Conceptual Architecture IGI Foundation (Add-On) Step ITIM to ISIM Migration Assistance IGI Foundation Deployment (Add-On) Leap * Can be added to any Foundation Offering IAM Operations Improvement Discussion Guide

Key Points Existing ISIM 6 or 7 Single Deployment if IGI and Data Layer with Bridge Single data sync (as is) Gain Access Insight Sample Access Recertification Demonstration Sample Role Mining Exercise Gain Hands on Experience Ability to “show and tell” to the business Ability to prototype and evaluate business processes Ground work for follow on activities IAM Operations Improvement Discussion Guide

Case Study and Method

A loan provider based in the U. S A loan provider based in the U.S. and Mexico, USA engaged IBM to deploy access recertification capability. Client Situation : All processes were manual and time consuming leading to possible missed steps, inaccurate entries and inconsistency. Audit findings required manual and time consuming remediation. Selected IBM business partner (PathMaker Group) for implementation. Phase 1 was to complete full access review campaign. Phase 2 is to review and redefine roles. Phase 3 is to implement a fully-automated account setup based on roles. IBM Solution : Running IGI 5.1.1 on DB2. Integrating with ISIM as provisioning engine with bi-directional adapter. Major applications being integrated include PeopleSoft HR, PeopleSoft FS, Active Directory. Bank Benefits: Moved away from manual access review process to leverage UI access review tool using more meaningful business roles rather than low-level entitlements. Profile 7300 internal employees. a leading provider of pawn loans in the United States and Mexico and consumer loans in Mexico. At our pawn stores, we also sell merchandise, primarily collateral forfeited from pawn lending operations and used merchandise purchased from customers. Identity governance and administration

Identity and Access Governance Systems Integration – Method Summary Master Draft 1 Identity and Access Governance Systems Integration – Method Summary Delivery Phases Key Activities Pre-Data Collection Client Environment Macro Design Implementation Planning Project Closure Solution Build Method Adoption Workshop Solution Outline Micro Design Solution Testing Project Delivery Solution Deployment Deliverables Data collection checkpoint Project work plan Client environment Solution outline Use cases Macro design Micro design Implementation plan Procedure documentation Interface programs Development environment Test environment Test summary report Production environment Project evaluation report PHASE 1: Project Initiation PHASE 2: Plan PHASE 3: Design PHASE 4: Implement PHASE 5: Closure Identity governance and administration Master Draft 1 13