Identity and Access Management Jackie D’Amato

What is Identity and Access Management (IAM)? The process of managing who has access to what information over time IAM processes are used to: Initiate Capture Record Manage

Reasons for IAM Projects Improved regulatory compliance Reduced information security risk Reduced IT operating and development costs Improved operating efficiencies and transparency Improved user satisfaction Increased effectiveness of key business initiatives

Concepts IAM attempts to answer 3 questions: Who has access to what information Is the access appropriate for the job being performed? Is the access and activity monitored, logged and reported appropriately?

Relationship between IAM and Key Concepts

Identity Mgmt v. Entitlement Mgmt IAM Process: designed to initiate, modify, track, record, and terminate specific identifiers associated w/ each account Entitlement Management: designed to initiate, modify, track, record and terminate the entitlements or access permissions assigned to user accounts

Access Rights & Entitlements Access rights should be approved by the business owner and reviewed by IT department Privileged accounts should be monitored Access rights granted to all identities should be reviewed periodically Organizations should document their access rights policies and procedures

Provisioning Process

Periodic Audits Should consist of: Identification of highest to lowest risk ID concentration Re-examination of process design Examination of operating effectiveness Review of provisioning process Examination of enforcement activity effectiveness Examination of administrative activity effectiveness

Internal Auditors Need to understand current IAM system: Business architecture Policies Laws, regulations, mandates Budget Timeline Business requirements After audit, evaluate IAM and entitlement management

Questions??