Skip Links

Making role management work for the enterprise

By Deepak Taneja, special to Network World
September 17, 2008 12:20 PM ET
This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter's approach.

Network World - Many IT security professionals still regard role-based access and identity management as hopelessly complex because the predominantly manual approach used to review and manage roles is not scalable and the dynamic nature of roles themselves often get out of sync with reality.

The challenge of discovering established roles, defining new roles, connecting roles to IT infrastructure, ensuring roles meet compliance requirements and managing roles through their natural life cycles has proved to be too complicated and cumbersome to be practical. As a result, many have written off the roles concept as a failure. But roles are essential for sound governance, and the right roles-based access governance systems can simplify an IT security manager’s job.

There are three key objectives to keep in mind for determining the success of any roles-based access and identity management initiative:

1. The people who manage roles should understand them. Role definitions should describe, in business terms readily intelligible to any IT security, audit/compliance or business manager within your organization, what a person assigned to that role does.

2. Roles should simplify users’ view of access. Everyone that uses the roles-based access governance system should be able to see easily who has access to what and understand whether that access is appropriate (entitlements fit the role or are out-of-role, or create a compliance violation).

3. Roles should make the management of access more effective. Roles should speed up access delivery because adding a user or making a change to user access is now expressed by what roles the person has, which simplifies administration. Additionally, leveraging roles makes compliance easier because clear visibility exists for what is appropriate and inappropriate access. When entitlements are added to a role, or roles are combined, decision support is provided to proactively identify potential compliance violations or risks.

The best way to accomplish these objectives and establish the best role set for your organization is to follow these steps:

* Engage key stakeholders who are involved with governing user access. Their input is essential to create a framework that drives what business abstractions will form the basis for representing access to information resources, as well as for role discovery and modeling. These abstractions are tied to business context -- such as job context, process context and compliance context -- or technical context scoped to a subset of the IT infrastructure. Collaboration on a role framework and role design between IT security teams and the business will ensure the best chance of success when roles are put into production.

* Determine the existing access entitlements of all users. It is critical to have an automated access-governance system that can collect data from every possible repository of user entitlements, normalize and aggregate the data, and then put it into a user-friendly business context.

* Effective role design, combining business and technical roles. An effective approach for modeling roles requires the creation of business roles (job roles, process or procedural roles) that are then layered over technical roles (such as application roles, system roles and network roles). This hybrid approach enables top-down business roles to be linked to detailed entitlements within various information resources, which creates a common language for access that can be clearly understood by all stakeholders in the access-governance process (IT security, business, compliance and audit teams).

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News