Latest / Identity at the Center / #49 - Role Mining Lessons Learned

Transcript

#49 - Role Mining Lessons Learned · Identity at the Center

0:08
Identity and access management welcome to the identity of the
0:22
center podcast I'm Jeff and that's Jim.
0:24
Hey Jim hey Jeff, how you doing? I'm good yourself living.
0:30
The dream baby. I can't believe it's already the
0:32
middle of June. I know we had weather in the 70s
0:36
this week. It was fantastic.
0:38
Yeah, that was an in see Georgia, right?
0:41
So and I'm in Chicago, are we had some fantastic weather too
0:44
so it's been quite nice. Yeah.
0:46
You don't get this every year. So you got to enjoy a volunteer.
0:50
Plus we're home because they're not really traveling right now.
0:52
So, you know, that's even better, I guess.
0:55
And I spent the last, you know, 15 of the last 20 years
0:59
complaining about I'm going to traveling I do, and now I'm
1:01
starting to really miss it. The heart wanders and yearns for
1:07
the airlines in the delicious airline food, thickener stake, I
1:14
will go with chicken. So today for a topic we have one
1:19
that's actually listener submitted, our friend Andrew.
1:22
See he writes as I was listening to your podcast and my current
1:26
everyday work. I was wondering if you guys
1:28
would do a podcast on lessons learned from past role mining
1:31
engagements. Craziest request.
1:33
For example, have to Figure out how to consolidate up to 400,000
1:37
role. Entitlement combinations, things
1:39
you could have done differently and tips for analysts like
1:41
myself and what to look for or approaches to take, which I
1:46
think sounds like an awesome topic.
1:47
What do you think? I think it's a great topic.
1:49
I mean, every client we work with, they want to achieve this
1:54
vision of our back. A couple ways to get there.
1:58
It's a lot of work. There's a lot of foundational
2:01
elements but eventually you end up in this place called roll -
2:04
Which we're going to get into pretty heavily today.
2:08
Yeah, and they helped us with that conversation.
2:10
We've brought in another member of the crack I'd entropy.
2:13
I am team. He's Helio Gomez.
2:15
I am architect extraordinaire. Welcome Helio a gym, Jeff.
2:20
Thank you for having me. Thanks for joining us.
2:22
Yeah, thank you very much. Hey, Leah, where are you?
2:23
Okay, right now you're in Florida.
2:25
I am in Tampa, Florida, just got back here.
2:27
Okay, so we're wondering the guest house in the spike in
2:30
cases. Now we know
2:44
Jim has been going around licking doorknobs.
2:56
Well, I'm glad you're able to join us because, you know,
2:57
you've been working on this stuff for a long time and I
3:01
think your insights going to be very valuable and hopefully,
3:04
Andrew gets But I, this and other people are listening as
3:06
well. But before we dive into that
3:08
topic, just want to make a note that identifier started this
3:10
week. I should be.
3:13
Let's see, today's Thursday actually.
3:14
So I was supposed to be flying to London today, because I was
3:18
going to cut short the trip because I was supposed to go
3:20
watch, cago Cubs, play the st. Louis Cardinals in London
3:24
Stadium in London, but that has obviously been canceled.
3:28
So quite disappointed about that this point, but I would have
3:31
been in Denver otherwise for the attend a conference.
3:34
But now it's all virtual. So it started this week.
3:37
Listen to a few of the different presentations so far, it's going
3:40
pretty well, Jim Have. You listened to any yet?
3:45
I'm tuned in anything yet but definitely planning to mean, you
3:50
know it, I love conferences not just for the sessions but for
3:55
the rubbing elbows this is we're not rubbing elbows with people
3:58
anymore. I guess we still have the
4:01
session so I'm gonna get in there and dive in.
4:04
Soon as possible. Yeah so check out Ian Glaser had
4:10
one earlier this week and his big pronouncement was that
4:14
Samuel was dead and I don't want to go into it because I want to
4:16
steal his Thunder but you made some good points around it and
4:20
give that a little tease in case someone wants to check that out.
4:22
On the adenovirus website sounds like we have a topic for a feel
4:25
so yeah. I mean I wish he had made that
4:28
pronouncement right before our last episode which was with Eve
4:32
and we're talking about sam'l and kind of why it's So
4:34
important. Well, that's why it's such an
4:36
interesting topic because it's a little of a quick baby headline.
4:41
So maybe we should have like a versus episode and get even Ian
4:45
on. Same time.
4:46
They can just you know duke it out.
4:48
Isn't there to are too much friends with each other to Duke
4:52
it out though, but it would be would be an interesting
4:56
dialogue. I think I'd like to do something
4:59
like yeah. Like a versus you know defend
5:01
your position. May be a debate or something
5:03
like that. I Be cool.
5:05
I think if, you know, maybe we'll put that out there for you
5:07
have a, some somebody who's listed in and wants to take part
5:09
in some like that or has an idea, you know, maybe we can put
5:13
something together. So like that, with maybe some
5:15
help from the listeners. And you know, if that's
5:17
something that you find interesting, email us at
5:20
questions at identity at the center.com and, you know, we'll
5:25
see what comes out of it. Speaking of emailing us, they
5:27
got a really nice note from Craig and New Zealand from the
5:30
future. So you Don't say he's a
5:35
listener. He's been listening for you
5:36
know, the last year or so which is great.
5:38
And we're coming up on our year anniversary and that was a nice
5:41
thing to her to receive especially when it comes from
5:44
the future - yeah I'm sure you meant it was time stamp June
5:48
19th when he sent it from his home.
5:52
Yeah. And as it traveled the
5:54
microseconds to a different time zone.
5:57
It landed in June 18th. Yes, I don't know if what
6:00
happened mean. I read it.
6:02
What happens to me? Do I like is this a Back to the
6:04
Future? Do I disappear from the picture
6:07
or you've broken the space-time Continuum?
6:09
That's it. All right.
6:11
Well why don't we get into don't bindle?
6:12
Yeah I'm ready man let's just an exciting topic so I think we
6:18
probably ought to start and get Helios started here.
6:22
We get him talking a little bit. So always start with just what
6:26
is roll my knee Helio. So I think of roll, Miley has
6:30
really analyzing the entitlements that you have
6:32
within your Or identity system across all of your applications
6:37
analyzing those getting a combination of what may possibly
6:42
be connected based on different features about the user
6:47
different attributes sets and what possibly could be a role.
6:51
And then once we take the output of that, we very simply can
6:55
build our rolls off of what we see from the mining help.
6:58
Yes, absolutely. So much kind of analytic driven,
7:03
you know, the the During the process to kind of come up with
7:08
hey this these combination of entitlements are held by people
7:15
who have this and comment. So maybe these seven accounts,
7:19
entitlements along to 95% of the people who are in the HR
7:26
department. Would you like to turn this into
7:28
a roll and then you can apply your human evaluation toward Or
7:34
not. That's a good idea.
7:35
Is that what you would say? Absolutely.
7:38
Yeah. And what I'd like to do is
7:40
contrast that with what I call roll engineering.
7:43
And so this is kind of a, so I consider role mining to be kind
7:47
of Bob's up using the data to determine a result.
7:52
And when I think of tops down, roll engineering, it's hey, we
7:56
know that people fit a grouping of, they work in HR, and we know
8:01
that everybody who works in h.r. needs access to these.
8:04
You systems and needs this level of access.
8:07
So let's create a role that when somebody new joins HR we
8:11
automatically give them that role or we start to say that you
8:15
know there are five different types of users that use this
8:19
application or these sets of applications and let's bundle as
8:23
create a role that bundles all that access together so that the
8:28
business users don't have to pick out all the individual
8:31
entitlements that they need to do their job.
8:34
They can. Just pick one role or two roles
8:37
that kind of the way you think of it as well.
8:40
Yeah absolutely. And one of the interesting
8:42
things about roll mining as well as those roles that you've
8:44
engineered when you go and do your role mining analysis, you
8:48
may find that what you thought was a role that you should
8:51
engineer really isn't, or what you thought wasn't should say.
8:55
It's really taking those to wait, like you said, taking your
8:58
human element and applying that to the output of your role
9:01
mining. That's really going to be the
9:03
most beneficial, right? Actually, our back as a
9:07
discipline is more of an art than a science.
9:10
Or maybe it's just the combination of the two that, you
9:13
know, I think between roll Mining and roll engineering, the
9:15
way that I like to describe it is, it's a technical way to
9:19
create a logical construct technical in the mining aspects,
9:23
logical in the engineering of how that would look at a
9:27
constant level. Absolutely.
9:29
So, Andrew asked us to point out kind of Crazy examples and he
9:36
said you know you looking for role mining to actually
9:39
consolidate 400,000 entitlement so I guess I'll throw it back to
9:44
Helio. Is that how roll mining works?
9:47
Is that actually consolidate entitlements, it does to an
9:51
extent. Really what?
9:52
I like to think of how roles are going to function in my system.
9:55
It's not so much. Consolidating the underlying
9:57
entitlements. It's obfuscating the so you take
10:00
those groups of entitlements that are they might be D groups
10:05
or some field in a column in a database or something along
10:09
those lines and permission sets of whatever applications.
10:14
Your typical end user is not going to have any understanding
10:17
of what that means. So building your roles is really
10:20
going to give you that end user facing like verbiage that's
10:25
going to be helpful to them to really understand what they're
10:28
dealing with what they're requesting.
10:29
What they're approving, what their certifying.
10:32
So building those As is really help you in that aspect more
10:36
than anything else I find. And consolidation, of course, is
10:41
one of the things that we're going to get from.
10:43
That is we're going to have 400,000 entitlements it.
10:46
We're going to maybe put those into maybe a hundred thousand
10:50
rolls or maybe 50 rolls, or maybe 500 rolls.
10:53
But really what you're trying to do is make it data that can be
10:57
consumed by your end user that can then be used in the other
11:01
processes that we're going to have in our I am system, that's
11:03
really important. I think, you know, an important
11:06
part of that is wrapping metadata around rolls.
11:09
So in other words, defining information, friendly, business
11:13
name, or friendly business description around the role or
11:17
defining an owner of roll. Who gets to decide, you know, be
11:21
part of the approval process or part of the review, process for
11:24
who gets that role. Went to make a another point
11:30
about roles because this is kind of one of the The internal
11:35
debates that I have in my head, a lot of our clients, one of the
11:38
first things we like to do is take a look at their information
11:43
security policies. And a lot of times, those
11:45
clients have, the principle of least privilege as one of their
11:50
security policies and if taken literally, that means that you
11:55
don't give somebody access that they don't need.
11:58
Now if the system does analysis and tells me that 95% of The
12:05
people in h.r. have these all these accesses you want to give
12:09
it to the other five percent of people say, if I follow least
12:13
privilege the answer's, no real Essence 100%.
12:16
I don't want to do it because they don't need it or they would
12:19
have already asked for it doing their job without it.
12:24
So part of me says if you're following least privilege, don't
12:28
do that. But then I also the counter
12:30
argument to that is, well, should they follow least
12:33
privilege for Every type of access or is it a burden on the
12:38
business now to manage access and really least privilege is
12:42
more applicable when it comes to privileged access or, you know,
12:46
powerful access. However, we wanted to find that.
12:50
And I think that's, you know, I guess where I'm coming down
12:54
recently is that I think is a more appropriate use of the
12:57
principle of least privilege has to apply it only for privileged
13:01
access or administrative access. In Jeff?
13:05
What are you? What are your thoughts there?
13:07
Yeah I think it's a risk decision, right?
13:09
If if the person doesn't have access to the cafeteria menu and
13:14
you know it's part of the role consolidation great.
13:18
If it's somebody who has you know admin access to the AWS
13:23
console. Okay.
13:24
That's totally different. Right?
13:25
So right I feel the second way there that you were talking
13:28
about Jim it's more of a risk decision you know.
13:30
Don't waste time fighting a battle over something silly.
13:34
And inconsequential and focus instead on the stuff that makes
13:38
makes you either more secure and you know reduces risk or greatly
13:42
improves the user experience or ideally all of them, right?
13:46
So Hélio would do organizations that you've worked with, how
13:51
common is it for them to use? Roll mining as a tool and and
13:56
how, how is that approach to the usually, like a whole project
13:59
around a, we're going to do roll Mining and it's going to several
14:02
months, or is it something that Just kind of get ingrained in
14:06
the operations of things will roll.
14:08
My name's really more part of your program than it is like a
14:11
simple process. So you can't just jump right
14:14
into roll Mining and say hey we're going to do roll mining.
14:17
You have to lay the foundation there.
14:19
So on my projects where we're implementing a new solution, we
14:24
have nothing to begin with. We're all my name's, not usually
14:26
even on the table for those kind of projects, it's the more
14:29
mature identity systems that are in place.
14:33
They've connected to A majority of their applications at least
14:36
they're heavy use applications and they're trying to understand
14:41
just move to that next level with identity.
14:44
I with their identity process. That's really where we want to
14:47
get and that's where we're going to get the role mining type
14:50
projects. Now, with as far as how many of
14:54
my projects at least at least 75 80 percent have that on their
14:59
road map for part of their? There's now are we there yet
15:04
with all of them. No, but we know that that's
15:06
where we want to get. So once we get all of our
15:08
applications in we're definitely looking down that path.
15:13
So it is a common thing. We all want to get to that.
15:15
Perfect are back world where we have everything going through
15:18
roles but it's not something you're going to get two on the
15:22
right. Yeah.
15:23
And you know, I feel like sometimes when we when we have
15:26
these conversations, you take such an identity and access
15:29
Management Consultant perspective to these things.
15:33
So actually, as you're talking, I was like, we might need to
15:36
even take a step back and talk about what our roles.
15:40
Because to me, this is one of those terms that we Jeff and I
15:44
conduct a lot of workshops together.
15:47
We get into these conversations in the word role is used so
15:51
differently in different organization.
15:53
I think this is one of the topics we discussed in a past
15:56
podcasts, but terms of our back and what we're talking about
16:01
with roles now is kind of the I think that the modern idea And
16:05
governance and administration review of a role which is that
16:09
it's a bundle of accounts and entitlements that can span
16:14
across applications if you have. You know, there's a if you took
16:19
like a an application Centric Focus.
16:22
So in other words, you have a centralized I am system.
16:26
That term role still gets used that I get a role to an
16:29
application. That's really what we're talking
16:33
about with role. Mining is By combining those
16:36
roll, those those types of roles or groups or I think we've been
16:42
referring to as accounts and entitlements and bundling those
16:46
into a role within the IGA or I am system.
16:51
It's kind of a grouping of a council entitlements and do a
16:55
bundle. I guess we use the term bundle
16:57
of kind of making that up and that's still that's the role
17:01
that we're talking about, right. Jeff.
17:02
Do you have anything to add to that?
17:04
Now I mean I think it's, you know, this is nomenclature
17:08
right? You have to make sure there was
17:09
speaking the same language so role could be an entitlement,
17:14
you know, within a system. It could also be a collection of
17:18
entitlements within a system. It can also be a collection of
17:21
entitlements across different systems and I don't think
17:25
there's any right answer because every organization has a
17:29
different number of rolls a different number of entitlements
17:33
and different number of applications.
17:34
It's you know I like to think about it to make it easier to
17:38
start at a top-down type of approach.
17:40
Where, you know, the question becomes much simpler to ask is
17:45
the person an employee or as a person not an employee.
17:48
That's usually a lot easier to answer to me from a role
17:52
perspective than to say is this person a level one programmer,
17:55
or a little to print programmer, right or something along those
17:58
lines. So I like approaching it from
18:01
two different angles because I feel like there are
18:03
attribute-based rolls Is attribute, based access control
18:06
or a back and then there's role-based Access Control,
18:10
right? Our back, which is typically
18:12
assigned more at the job function or, you know, job
18:16
family or job group type, and I like, kind of combined the both.
18:21
I'm an employee as an attribute, who works in Chicago as another
18:26
attribute who works in it, as part of security, right?
18:31
And the combination of those four different things.
18:34
Between those give me a collection of entitlements, some
18:39
based on roles because I have an employee in some based on roles
18:42
because I'm in Chicago and some because I'm part of maybe
18:45
information security, right? So I think it's important that
18:50
when you're constructing these. You think about it from what
18:53
makes sense of the organization. You know, a huge organization
18:56
with a ton of different departments locations and, you
19:01
know, user types, meaning employee contractor Intern
19:05
student. You know, however, that you
19:08
know, that you make all the different types of people within
19:10
the organization will drive. A lot of how complex or not
19:16
complex, Your Role structure needs to be.
19:18
If you need a lot of granularity, a lot of flex, the
19:20
flexibility you're going to need to drive it to be more, you
19:23
know, attribute-based along those lines.
19:25
And then, you start to look at the applications on the bottom,
19:28
up to say, okay, we had this new application and this is the
19:33
specific. Emissions or entitlement that go
19:36
for this specific role and then you start to do that across
19:39
applications Etc. So I like to tackle from both
19:41
sides but to me it's easier to start from the top down and
19:45
figure out what's Birthright. What do all employees get, do
19:47
not immune. Not employees or contractors?
19:49
They get the same thing. No, okay let's move on to the
19:52
next one. Speaking to the nomenclature
19:55
thing, one thing I found in a lot of projects is the word role
19:59
as mentioned means different things to different people, but
20:02
when you start talking to Ministers, using the sap as an
20:06
example, what we call an entitlement and in the identity
20:11
management systems in sap, that is what they call a roll.
20:16
So, in sap role is an entitlement and I, in and
20:20
identity management systems for the most part.
20:22
So you really need to set down that this is the jargon.
20:27
We're going to use in this conversation at the beginning.
20:30
Otherwise everybody will be on a different page than to be able
20:33
to explain the concept. Right, here's here's what we're
20:36
going for. Are we all on the same page
20:38
here? Yeah, I think that's why I was
20:42
kind of even pointing out, you know, we're using that term.
20:46
So from a nomenclature standpoint, we're using that
20:49
term. How it's typically used in the
20:53
IGA space, Jeff mentioned you know a my employee or my program
20:58
level 1 program level to do, I work in the Austin office or in
21:02
the New York office? Well, What I can have multiple,
21:05
I have different angles of things of where I work.
21:10
And what role I do within the company, I'm going to pull your
21:13
contractor, I have multiple roles as well.
21:15
I think what we're talking about here is, you know, kind of
21:20
provisioning of access roles that that's kind of how I think
21:25
within the governance faces. Bundling, it counts in a times
21:30
that I can be provisioned that access to the end systems that
21:34
are To access to this is something that I wanted to kick
21:38
back to Helio because you know, you've been spending the last.
21:43
I don't know how long you don't. Normally, we ask all of our
21:45
guests, you live, how they got into, I am and maybe we should
21:49
ask that of you, but also I wanted to point out that, you
21:52
know, you've been focused on this El Point technology for
21:57
what, the last decade. I've been working with sale
22:00
point for about six, seven years now, okay.
22:03
And You know, one of the things that I wanted to point out run
22:08
into a lot is what? Well, first move, maybe you can
22:12
do for me real quick. Would be to Define.
22:16
I think they use the terms. It roles and business rules.
22:19
Were the difference between those two?
22:21
Yeah. So an IT role is a collection of
22:23
entitlements. So you have your various
22:26
adgroups your sap roles privileges from all of your
22:30
other applications all combined into an IT role.
22:33
Where, as a Business role is more of a collection of
22:37
identities, so that could be based off of.
22:40
To use Jeff's example, you have employees business role, you
22:45
have contractors, they're a business role, you have people
22:49
with the location of Chicago. That's a business role in
22:51
Atlanta and Tampa and wherever else.
22:53
So your business roles are collections of people.
22:56
Your, it roles are collections of entitlements, you can assign
22:59
the, it roles to the business roles.
23:01
You're going to sign the business roles the Identities.
23:05
And then people write things about I am, is that there's so
23:15
many different ways to take all these words, right?
23:18
That's the way that sale Point, does it absolutely another idea
23:21
of under does it who know figure it out right now?
23:26
It's there is no standard. I don't think when it comes that
23:30
kind of thing, right? So you have to be able to
23:32
understand the construct. Glee of what it is you're trying
23:35
to do. And then how was the technology
23:38
going to help you get there? Write whatever they call it.
23:41
This, you know, the end goal is to provide access to the right
23:45
person at the right time. You know, for the right systems
23:48
and if you do it more efficiently through groupings,
23:52
right? That's another, you know,
23:53
sometimes it's a group, it's used is the terminology.
23:56
That's, that's really kind of the end goal.
23:57
So so here's one thing, I wanted to point out, so I want to stay
24:02
on this airplane example, because I'm sure that it works.
24:06
I know that it works this way. So one thing is, let's say we
24:09
take that role mining example. We talked about for Andrew
24:12
where, you know, runs a data analysis and minds and says you
24:17
know, 95% of the people in h.r. Have these three adgroups would
24:23
you like to just give that to a hundred percent of you?
24:26
Say yes. So now all the people in h.r.
24:29
have these three adgroups and Southpoint considers that and I
24:33
tiro Alright, those three groups now, wouldn't it also be true
24:38
that if I was assigned those three adgroups that sell point
24:44
would Mal? Think I'm in that role?
24:47
Even if I can use those groups by other methods.
24:51
Yeah, so point will detect that you have those three adgroups
24:56
and that you are assigned to that role, which is actually
24:58
quite helpful. When you come to do, say a
25:02
certification is instead of Showing the certifier.
25:06
Hey, they have these three adgroups that you have no idea
25:11
what they actually do. They show.
25:12
Hey, they have this role. Does that make sense?
25:15
Now, you can also get to the entitlement level 2 in a
25:17
certification if you wanted to so you could see those.
25:21
But yes, absolutely. We will in sale Point detect
25:25
that you have the real. Even if you were not directly
25:27
assigned the role through like a request or through a Birthright,
25:30
nice hot one, one client who actually if that was the A case
25:34
they collected, those three the bundled.
25:37
Those three roles they would add a fourth element, fourth
25:41
entitlement, which was kind of like, what we call it a fake
25:44
entitlement. So that it wouldn't be detected
25:48
in that it wouldn't be, you know, somebody who got those
25:52
other three. My, some other method, not by
25:56
assignment of the roll, it wouldn't be detected by cell
25:59
Point as them having that role. Have you ever seen that before?
26:03
I have not But I'd be interested in looking at that system, okay?
26:09
We have a little bit of homework to go into because that makes a
26:12
lot of sense or as a terrible idea.
26:15
I'm not sure what are the things I'll say is, we get all kinds of
26:20
different requirements and sometimes we have to do a little
26:23
bit differently. Yeah.
26:26
So Helio um when's it to shift the conversation to roll
26:31
governance, you know? Surf.
26:34
Occation of the, what a, what a role gives somebody and then who
26:39
is in their role, what have you seen?
26:41
What are the typical processes you see with your clients in
26:45
terms of, you know, what role governance routines are in
26:48
place? Well, so in using the sale Point
26:52
example as well. So one of the things that we're
26:55
going to want to do is to your point maintain that role.
26:59
Like I build this roll through roll mining today.
27:03
That doesn't mean that in Months that role is still going to be
27:06
valid. And in three years, it's
27:09
probably not going to be valid. So there are tools to allow us
27:14
to do that. We can continue to run the role
27:16
modeling analysis has analyses. It's go with analyses.
27:20
So we can continue to run the role mining analyses so that we
27:23
can validate our roles that way. But we also have the ability to
27:28
certify the contents of the Roll.
27:31
So we could do it. What's called a roll.
27:34
Ian certification which is typically performed by the roll
27:38
owner will get a list of all the roles that we own and the
27:42
contents of those roles and say, hey, yeah, we don't need this ad
27:46
group in this role anymore because whatever reason we don't
27:50
need it. Yet that application is no
27:52
longer a thing. It could be that we don't want
27:56
to give that access to people in h.r. anymore, but we want to
28:00
maintain those roles so that we're not proliferating
28:03
incorrect. Idle moments to everybody.
28:06
So that's a very important concept.
28:08
Yeah, I think that is key part, right?
28:10
Is roles change over time. So you need some way in some
28:13
process to make sure that the contents of that role are still
28:17
accurate. Especially if you're relying on
28:21
roles to Grant access to, right? Otherwise now, the mistakes you
28:25
make are ones you choose. He's there macro in nature,
28:27
right? Oh great, 4,000 people right
28:30
now. Have accident thing that they
28:31
shouldn't have access to any more because nobody was seeing
28:34
the roll itself and the construction or composition of
28:37
it. So I think that's a really
28:38
important thing. This was the reason that I say
28:41
that, that your identity system is not a one-off.
28:45
It's a program. It's a process.
28:47
You have to keep maintaining it. You need to get that That Never
28:50
Dies preach on brother. Yeah, there's one thing that I
28:53
think that's important is when you're going to, you know,
28:57
speaking kind of the governance of roles is that it's a lot
29:00
easier to not only create but mandrels is Or cleaning up data.
29:05
As you're going along, right? Getting rid of things that you
29:08
don't need anymore. Adgroups that I have no members,
29:12
you know, roles that don't have any members things like that.
29:15
So that's another way to help kind of streamline.
29:18
The system itself not only from performance perspective, but
29:21
from a just a reducing, the quantity of things to manage is
29:25
take a look at the data itself and make sure that you're
29:27
keeping it clean as you go along or even before you even get into
29:30
rule doing a cleanup exercise first before you start building
29:34
out. Out roles for things that don't
29:35
exist, right? I'll tell a lot of my customers.
29:38
Hey, we don't want to do roll mining until we've done at least
29:40
one certification campaign to know that the entitlements they
29:44
users have now are the right ones.
29:47
Nope, there's no point to mining the entitlements that the
29:50
entitlement to the wrong entitlements.
29:52
Yeah, great Point. Yeah, the thing I was going to
29:54
add, you know, I think that you guys just moved made the point
29:58
of garbage in garbage out, that's spot-on.
30:01
I think the other thing is, you know, The business has got to be
30:06
a part of this. So if you think that roll, roll
30:10
Mining and roll, engineering, can be an it only job or it lead
30:17
and the business isn't really taking ownership.
30:20
It's only going to go so far. I think you can you know,
30:23
provision basic Access VPN email stuff like that.
30:28
Based on, you know, very simple roll patterns.
30:32
However if you want to get into Do you know what people do in
30:36
the business and really making access management more
30:40
efficient? You got to get the business
30:42
involved and then you've got to get the metadata on the rolls,
30:46
right? You've got to have good
30:47
descriptions, you've got to have owners for roles and it's it's
30:52
not a once and done thing. It's something that's going to
30:56
have to be Revisited pretty often so it requires a little
31:00
investment upfront, it's like changing the oil in your car,
31:03
you know, you Have to all the maintenance on your car.
31:07
You do the maintenance so that the car doesn't blow up.
31:11
And I think that kind of the same principle with with roll
31:15
governance. We made the point earlier that
31:18
you really want the names of the roles, you really want the
31:21
descriptions of the Rope to be right?
31:23
Because those are going to be and user-facing, that we'd be
31:25
correct. That people understand what
31:27
they're doing. No good saying, hey, can you
31:29
approve access to this? If when I look at it I go I
31:31
don't know what that is. Okay, approved.
31:35
I think this is really weird. We're a good.
31:37
I am program manager steps in because it's the business.
31:42
It's their data, right? And the technology and the roles
31:46
and all the stuff that goes around, it is typically provided
31:49
by it or an IT person when, you know, maybe even with them.
31:53
But there needs to be structure and order to the way things are
31:57
done. You know, when I've done roll
31:59
catalogs in the past, for example, you know, I would
32:01
develop here is here is the minimum acceptable level of
32:05
quality that I will take you know for a roll named a role
32:09
description you know anything like that and if it didn't meet
32:13
at least you know that minimum level of quality then it would
32:18
get sent back right either. I would work directly with the
32:20
business and say, hey we need a better name for this or, you
32:23
know, are you sure your users will understand what this means,
32:26
right? Things like that rather than
32:28
just kind of taking the easy way out where you dump all the 80
32:31
user, all the ad group names, you know?
32:34
Are probably not reader-friendly.
32:38
We don't want to play. We don't want fqdn is in there,
32:41
right? Yeah, exactly.
32:42
So it gets important because this is part of this.
32:45
The opposite is just better. If you just call a roll the
32:47
accounting role or the Accounting Group like times, do
32:52
you see that the Accounting Group in AV and then it gets
32:55
used for so many things that you know you're afraid to or maybe
32:59
it's called you know, accounting finance and like it was
33:03
basically set up For some project, nobody remembers
33:07
exactly what it was originally intended for.
33:09
But been used so many times and now they can't delete it or
33:13
clean it up or identify an owner because it's just, it's just a
33:18
mess. So it's been really all it.
33:20
Does is give you access to do your time card.
33:23
Well, maybe that's what it was originally and now it's like
33:26
everybody. If you don't the structure and
33:35
order, I mean, you have to think about how do you want to present
33:38
the data to your users and then tackle it backwards from there
33:41
and say, okay, you know what are the capabilities of the IJ
33:44
platform that we're using to present this?
33:45
Or, you know, it could even be in your itsm tool, right?
33:48
A lot of organizations may use service.
33:49
Now, for example, to present the request to the user.
33:54
So you need to take into account what can the Technology support
33:58
and then design access catalog? That is user-friendly off of
34:01
that. But I still feel the business is
34:03
part of that. Italy.
34:04
They own the roles. They should be part of the
34:06
sign-off process, as part of here's what's going to be named.
34:10
Here's the description. Here are the specific
34:13
permissions associated with that and then periodically, they
34:16
should be asked to review that to make sure that still
34:18
accurate, you know, maybe it's yearly, you know, maybe it's
34:21
shorter. If it's something that may be
34:22
privileged access or sometimes, but I don't feel like this is
34:25
something that to do it, right? Is fair to just toss it over the
34:29
it wall. And say here, itu deal with it.
34:32
The business needs to be part of this process for it to be
34:33
successful. Yeah, absolutely.
34:35
That's right, when everybody agrees.
34:40
It's also important to it, you know, I think a lot of
34:42
organizations want to get to our back 100%.
34:46
It's really hard, right? If it wasn't hard, everyone
34:48
would be doing it. So I think it's a goal to get
34:52
there but I don't think that you should shoot for 100 percent.
34:54
I think you should shoot for something far more attainable,
34:58
you know. However you want to define
34:59
success and maybe it is at the macro level like employee or not
35:03
employed Yeah, and maybe that's is as good as you think that is
35:07
realistic and the first year or maybe even two years, right?
35:10
And then from there as your I am program develops, becomes more
35:15
mature and you're getting all this data back from tools that
35:18
you've been working on implementing.
35:19
If you didn't have an IJ system before, you can start to, you
35:23
know, do some more rolls off that or even attribute-based,
35:26
you know, will actually cough that.
35:27
But I don't think 100% is a realistic goal.
35:30
I think shooting for somewhere on the lines of, you know, 80%
35:34
Percent is good. Enough is a good Target to hit
35:37
because you what you don't want to do is spend an inordinate
35:39
amount of time trying to, you know, address a 5% problem,
35:45
right? Or even, well, I think it's a
35:46
program manager. My attitude would be all right
35:50
for the it rolls. I need to, I need to get this,
35:53
right? I need to have this, be the
35:55
gold, the gold standard, and then I have to create a
35:59
capability so that the business can also You know, come up the
36:05
level of gold standard, but I'm not going to drag them Kicking
36:09
and Screaming into the are back future.
36:11
If they're satisfied with, you know, doing entitlements are
36:17
going through. The Grog don't want to invest
36:19
the time. Then you know, my My Philosophy
36:24
at all. This is that I tease
36:25
responsibility is to provide the tools and provide the processes
36:31
so that business can manage access.
36:34
I think by having to go Center having the tools and having a
36:37
process for, you know creating roles and assigning roles.
36:41
And recertifying roles you're doing, your job is and I am a
36:45
program manager. Drying, people, kicking
36:47
screaming is not going to work or not going.
36:49
If they're not taking us seriously, you're fighting a
36:52
losing battle and you're going to get into that area where they
36:56
just think of somebody else's job.
36:59
And it's not like I say it's a lot easier to dance with two.
37:04
Dance Partners than just one. Yeah, the other thing that you
37:07
don't want to do to go back to Andrew sees question, we had
37:12
400,000 entitlements. We don't want to get so granular
37:16
with our roles that we end up having five hundred thousand
37:18
rolls to maintain. Yeah, that's a great point.
37:22
There has to be some level of. Hey, this is, this is what we
37:26
want to maintain, and if we get to to granular with it, that
37:30
we're going to have a role for every entitlement.
37:32
And then some roles for every other thing, And then you end up
37:35
with 500. 600 700 thousand rolls to maintain and you just made a
37:39
bigger mess for yourself. Yes.
37:41
I don't believe that but it's so many of the organizations that
37:45
we work with and I go in and ask them how many 80 groups they
37:48
have? It's more than the number of
37:50
users that they have really what?
37:52
That tells it and I'm trying to security groups not just
37:55
distribution lists. That tells me that they've got a
37:58
lot of groups that somebody created.
38:00
Nobody loves. Nobody cares about Emily's.
38:03
Keeping them know. You feels like they own them and
38:06
that's a problem. If you get in the same position
38:09
with rolls, you just going to create another nightmare
38:12
scenario and that's where our cleanup campaigns come into
38:15
place, whether it's through access certifications or whether
38:19
it's through. Just looking at the groups and
38:21
say Hey, Nobody's in these groups do we actually need our
38:23
is really going to help Nets hurt.
38:25
You got to do that up front. Gotta get that, gotta put in the
38:28
legwork, to get to where you want to get.
38:30
I kind of always felt to that with cleanup campaigns.
38:34
There's some cleanup that you should just do even before you
38:37
put in, I am system and then there's other clean up that the
38:40
IM system through the certification campaigns.
38:44
For example, can really help you out with, but some of the things
38:47
like just cleaning up, all the empty adgroups doesn't seem like
38:51
you need an expensive. I am system to do that.
38:54
You can just go through and clean them up.
38:56
Yep. Yet.
38:56
Here's a script to go, pull back.
38:58
All the groups that have no members and, and if you have an
39:01
attribute on the ad group, for owner, And half of them are
39:05
empty. You know go through and start
39:08
filling them in otherwise we can even send the kid.
39:11
Who you gonna send the recertification campaign to?
39:14
Yeah, absolutely. Having that ownership level
39:16
whether it's just for certification campaigns or it's
39:19
for Access reviewer. Access request having an owner
39:23
up front in a river. Whatever other application we're
39:27
talking about is very, very helpful.
39:29
Yeah. It's usually one of the first
39:30
things that, you know, gets asked, as you know.
39:33
Okay, who owns this This right, and no time like the present to
39:37
figure out who owns it because you're gonna need it down the
39:39
road anyway. So it's a, it's a cheap easy way
39:42
to get started. Might not be, maybe not be easy,
39:44
if you have a lot of them. But you know, it's a cheap way
39:47
to get started right look through, figure out who owns it,
39:50
you know, assigned, de-facto ownership, if there isn't any
39:53
historical record, maybe it's based off a ticket, whoever
39:55
requested it, you know, becomes the owner.
39:58
And then everything to is maintaining that ownership to
40:00
over the over the group, for example, if someone leaves your
40:03
organization, You know, I had a role in the past where if an
40:06
owner left their manager would receive would become ownership
40:10
inherit it automatically, until they decided to, you know, who
40:13
they wanted to go out, get it to that way.
40:15
We always had an owner and for a given group or given
40:18
entitlement, and if we can't figure out who the owner is,
40:21
it's Jim. That's right.
40:24
Senate Senator Jim, we'll figure it out.
40:25
First in the Mailroom, just pick the person who runs the mailroom
40:28
and assign it to them. All right.
40:32
Did we cover everything that that we Want to cover today.
40:35
Feel like they covered a lot of ground.
40:37
I hope we answered Andrews question.
40:39
Yeah, I hope that Andrew feels that way so I'm sure he'll let
40:44
us know if not. It will be happy to tackle it
40:45
again. Absolutely.
40:48
All right, well I think we're going to go ahead and leave it
40:49
there for now. Is there any final words of
40:52
wisdom that Helio you? Or Jim wanna bring up before we
40:56
wrap up? I'm not a very wise person.
41:01
No, just thanks to everybody. Who's been listening is sending
41:04
out. Mel, you know that likes the
41:07
show or questions and keep them coming, because it makes it
41:11
really easy to figure out what to talk about when we get these
41:15
types of notes, really appreciate it and it's more
41:18
interesting for you because we're talking about what you
41:20
want to talk about. So rather than, you know, Jim
41:23
and I put our heads together, you know, we'd rather talk about
41:25
things that are important to folks out there.
41:27
So be sure to take advantage of that email questions at identity
41:31
at the center.com, or look, Jim or II.
41:34
Up on LinkedIn and she just a note there, you know, we're
41:36
happy to engage and, you know, we're in the I am world just
41:39
like a hope most of the folks listening, you know, here are so
41:44
we appreciate it and I think with that, we're going to go
41:47
ahead and call it a wrap and hope everyone stays happy and
41:52
healthy and we'll talk with you all in the next one.
42:04
You've been listening to the identity of the center podcast
42:08
for more episodes of visit identity at the center.com.