* Courion's survey about compliance and enterprise identity management
Courion last week, released the results of its survey looking into enterprise identity management. Many of the results of the poll, which was carried out at its recent Converge conference, were to be expected but there were one or two surprises.
When asked about the greatest internal barrier to implementing an account provisioning strategy, “Prioritizing Business Processes to Start With” was chosen by 59% of the 150 respondents. “Time Required to Achieve ROI” fell by nearly half compared to last year’s survey, and “Difficulty Justifying ROI” fell from 32% to 24%. Why the drop in the ROI barrier? My thinking is that the increasing automation of the provisioning process – from set up to roll out to maintenance – has decreased the “I,” the investment, while speeding up the entire installation lifecycle thus making the ROI positive in a much shorter period of time. And once the ROI is positive, the bean counters won’t be nagging you any more.
“Prioritizing Business Processes” is, I think, a euphemism and catch-all for the various “office political” problems that arise with almost every provisioning project. Those objections are much harder to overcome, and there is no technological solution.
Role management is becoming a more mainstream practice, as 65% of respondents indicated that they have either already begun implementing or are planning to implement role management solutions within the next 18 months. The surprise here, though, was that role management was cited by 28% of respondents as the No. 1 identity management solution with the greatest impact on compliance activities, followed by identity audit/attestation (26%) and user provisioning (25%). It’s numbers like this which make me wary of any survey. Actually, the survey is probably correct – it’s the respondents who have a problem. Folks, without audit there is no compliance. Attestation is required by some regulations so, again, there’s no compliance without it. Role management is useful for compliance, just as a fully functional provisioning system can make compliance monitoring easier. But if you don’t have attestation and especially if you don’t have audit, you aren’t in compliance, because you can’t prove you’re in compliance. That’s the bottom line.
Events: Next week is the annual Catalyst Conference put on by the Burton Group. I’ll be there, and you should be too. If you see me – say “Hi!” and let me know what you want to hear more about.
