1. Identity and Access Management
Jackie D’Amato

2. What is Identity and Access Management (IAM)?
The process of managing who has access to what information over time
IAM processes are used to:
Initiate
Capture
Record
Manage

3. Reasons for IAM Projects
Improved regulatory compliance
Reduced information security risk
Reduced IT operating and development costs
Improved operating efficiencies and transparency
Improved user satisfaction
Increased effectiveness of key business initiatives

4. Concepts IAM attempts to answer 3 questions:
Who has access to what information
Is the access appropriate for the job being performed?
Is the access and activity monitored, logged and reported appropriately?

5. Relationship between IAM and Key Concepts

6. Identity Mgmt v. Entitlement Mgmt
IAM Process: designed to initiate, modify, track, record, and terminate specific identifiers associated w/ each account
Entitlement Management: designed to initiate, modify, track, record and terminate the entitlements or access permissions assigned to user accounts

7. Access Rights & Entitlements
Access rights should be approved by the business owner and reviewed by IT department
Privileged accounts should be monitored
Access rights granted to all identities should be reviewed periodically
Organizations should document their access rights policies and procedures

8. Provisioning Process

9. Periodic Audits Should consist of:
Identification of highest to lowest risk ID concentration
Re-examination of process design
Examination of operating effectiveness
Review of provisioning process
Examination of enforcement activity effectiveness
Examination of administrative activity effectiveness

10. Internal Auditors Need to understand current IAM system:
Business architecture
Policies
Laws, regulations, mandates
Budget
Timeline
Business requirements
After audit, evaluate IAM and entitlement management

11. Questions??