Latest / Identity at the Center / #81 - RBAC with Jim and Jeff

Transcript

#81 - RBAC with Jim and Jeff · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
center podcast, I'm Jeff and that's Jim.
0:28
Hmm. Hey, Jeff, how's it going?
0:30
That's a bad yourself. Good.
0:32
Good, you know, I feel like a big complainer.
0:34
We always one of our favorite inside jokes is, oh, you bet
0:38
sounds like a personal problem. Well, I've got good weather
0:42
problems, right? I'm I'm sitting here
0:44
complaining, because his mid-40s, and the rain has
0:48
finally stopped. It has been rainy and, and cool,
0:52
and have the United. It's is under some kind of
0:56
blizzard warning or digging out us know.
0:59
I know you're in Chicago, you haven't had the best, whether it
1:02
has been difficult. So, you know, I think for a
1:04
large swath of the United States over the last several weeks and
1:07
yeah, Chicago has been pretty snowy.
1:10
I think. I think we're close to setting a
1:11
record for like number of consecutive days with, with
1:15
measurable snowfall at least in the Chicago area, which is where
1:19
I'm at. So, you know, and then obviously
1:21
our friends down in Texas are certainly having some struggles
1:24
with Power issues. So for those who are listening,
1:26
it is Friday, February, 19th as Jim and I are sitting here kind
1:30
of talking about this. So if you want to look back in
1:32
the and The Archives of the internet, right?
1:35
You can probably kind of figure out what was going on in the
1:37
world back then but yeah it the weather has been challenging but
1:42
I am hopeful. I'm seeing above freezing
1:44
temperatures on the radar and on the forecast as soon as maybe
1:47
even this weekend or maybe next week, always plan a trip down to
1:50
Cancún. I don't think anybody will
1:52
protest outside for your house. Old, man.
1:55
Oh, was that, that's not what you meant by the power issues,
1:58
in Texas. Oh, you meant something else.
2:01
Sorry we usually don't go there on this show.
2:03
We usually don't get political but yes, that that was not a
2:06
good look for a certain individual and the the Texas
2:10
political Spectrum, which is put that way.
2:13
So what I'm going to talk about today I'd like to talk about
2:16
role-based access control and all things associated.
2:20
What do you think of that? I think that as a gigantic can
2:23
of worms and I think we you should do it because roles are
2:26
something that we hear a lot from our clients as something
2:29
that they want to get into. And it can be a little bit
2:32
confusing sometimes because there's a lot of, you know,
2:36
different competing directions that maybe things want to go in
2:41
from a role perspective, right? You've got role-based Access
2:44
Control, you've got attribute based Access Control, you've got
2:46
policy based Access Control. There's a lot of acronyms and
2:50
we're going to get into that today.
2:52
So I think what we want to kind of start off with the Is, you
2:55
know, this is our thoughts and how you get started to eat this
2:59
elephant, one bite at a time because it is, certainly a tends
3:03
to be a rather large project for a lot of organizations.
3:05
And a lot of times you are starting from, maybe not the
3:09
best from a data quality perspective.
3:11
And you may have to, you know, have a lot of kind of push and
3:14
pull to kind of get things up hill.
3:15
Yeah, I mean it's what complication topic the most for
3:19
me is that there's not a industry standard definition
3:22
like we, if you ask somebody who's As in, there's a I am
3:26
practitioner. What is multi-factor
3:27
authentication mean? You get the same answer every
3:30
time. You ask somebody what a role is
3:34
you get a different answer every time and that's because a couple
3:37
things from an organizational standpoint.
3:40
We talk about roles differently application, even within an
3:44
organization, you might have application teams talking about
3:47
roles within their applications and then you talk to the.
3:50
I am team or the active directory Gene and they're
3:53
talking about roles that. Totally different level.
3:56
And then from an authentication, side of the house or this is an
4:00
identity management side of the house, whether that you're using
4:04
roles to drive provisioning to apps, or you're interpreting
4:08
those roles at the time of authentication to confer access.
4:12
And I think we had a an episode one of our original episodes
4:18
back when we used to do a lot of Jeff Jeff and Jim episodes where
4:22
we talked about kind of some of the most Confusing terms and
4:25
identity access management and roles was probably number one.
4:29
Yeah, that that highly liberal use of the word roles.
4:34
You know, can certainly complicate the way that things
4:37
get defined. So we're going to dive into it
4:40
here and I think it's probably important before we get too far
4:42
along. Here is really when we're going
4:44
to talk about role-based access control or our back is that
4:49
we're really focusing on the provisioning side of things not
4:52
necessarily the authentication side of things because like
4:54
There are sometimes some definition of roles being
5:00
assigned at the authentication level.
5:02
What we're really talking about provisioning and really more
5:04
authorizations. So why don't we dive right into
5:07
it? And why don't we start with what
5:10
is a rule Jim Murray. And so I'd say like if we're to
5:13
give it a dictionary definition, it's really the collection of
5:17
one or more entitlements or groups, bundled together and
5:22
assigned to one or more. People in order to confer access
5:27
to a system. So there's a couple elements
5:29
there one is that it's a grouping of access rights and
5:36
it's assigned to people or it could be to non-human account.
5:41
So maybe people isn't the right term, it's identities, but it
5:46
confers access. Right?
5:47
So the point of putting a roll together is to bundle access and
5:53
so when we talk about Even Frameworks.
5:55
We look at that. It has an access pattern.
5:58
Yes, or no, right. That's an important piece of.
6:01
There's not an access pattern around a roll.
6:04
Then there's not much sense in developing a roll.
6:07
Yeah. And I think one of the ways that
6:09
I've heard it described in the past that I kind of like it
6:11
really, it maybe oversimplifies it, but I think it's okay for
6:13
this conversation is think of roles as a bundle of sticks.
6:18
Right? Each stick kind of has its own,
6:20
maybe unique properties, and you might pick up and have different
6:23
bundles of sticks. And you might have just one
6:26
stick in your bundle, right? But, you know, each of those
6:29
things, could essentially be an entitlement and that bundle ends
6:32
up becoming what we kind of refer to commonly as a roll.
6:36
So now that we kind of set the stage of what is a roll, why
6:40
would someone who want to go down this?
6:44
This hellscape that it's sometimes be of setting up
6:48
access rules for their organization.
6:50
When I think about roles, I generally, think of, you know,
6:53
the kind of the framework that You think about this is there's
6:56
two types of roles and we're going to use some terms, right?
6:58
And some of these terms are used or not used by different vendors
7:02
organizations, but the two main ones for me, our Birthright
7:07
roles and requestable roles. And when you think about
7:09
Birthright rolls, the idea is that you can automatically
7:14
assign access to a person based on something about them.
7:18
Some attribute about that person they're an employee.
7:22
They work for a certain department or they work in a
7:24
certain Certain location. Usually this is going to be an
7:27
attribute that is stored on their profile, whether that's in
7:31
the HR System or something. That's maintained outside, the
7:34
HR System but it's data-driven that they are all this
7:39
classification and because of that they should have this
7:41
access and that whole process can be automated.
7:44
However, request will roles are something that we don't have
7:47
that that driver of some attribute.
7:49
That's going to say whether or not the person should have
7:51
access and is ultimately a bundle that bundle Sticks that
7:55
we want to make available and it's for convenience sake.
7:58
And so having that bundle of sticks.
8:01
Now, somebody in ideally in the business is going to have to
8:06
either request or approve or both that access for a person or
8:11
for like we said a non-person identity.
8:13
You know the more you try to narrow size these definitions
8:18
the more it just sounds like a bunch of words so I'm probably
8:20
going to stick to more the simple definition but If you
8:24
have a request for roles that bundle of sticks that you're
8:27
going to give to a person, you're doing it in a way that
8:32
the business can understand what that that bundle is our.
8:37
You're either going to tie it back to some job function or
8:39
maybe to a job overall. Yeah, I think you know, maybe
8:42
let's stick with the bundle of sticks concept here is, you
8:45
know, if you think you're on you're walking around and you
8:47
know whatever Village and when you're born you're given a
8:50
bundle of sticks, right? That's just what you get, that's
8:53
a Birthright roll. It could be, you know, whatever
8:55
that little sticks might look like and then maybe you go to,
8:59
you know, the shop inside your village and you see a bunch of
9:03
different bundles of sticks sitting behind the counter and
9:07
you say to the shopkeeper. Hey, I want that bundle of
9:09
sticks, right? So that would be more of the
9:11
requestable role. So maybe we can, you know, that
9:14
maybe a little again, little bit too simple, but I kind of like
9:17
it, at least for the purpose of this conversation.
9:19
And, you know, it's important to mention the business look like
9:23
he just did because it's Very difficult to do rolls and it's
9:27
compounded. If you do not have the business
9:29
involvement as part of the definition of what those roles
9:33
look like, who can have them, who's going to approve them,
9:37
right? How do you make things that are?
9:39
You know, appropriate for the business to understand because
9:42
really at the end of the day, it's the businesses data and
9:45
it's the businesses rolls it. And by extension, the identity
9:50
access management team or technologies that are associated
9:52
with that team are there to kind of Port the business and to make
9:56
them make help them make more informed decisions.
9:58
So it's important to understand that this is not an easy task,
10:02
it is something that a lot of organizations struggle with.
10:04
They are usually year long or multi-year projects depending on
10:09
how complex the access Matrix might look like within an
10:13
organization. So, that's something to
10:14
certainly consider as part of this is not easy.
10:17
And that's okay, right? We mentioned, it's an elephant.
10:19
You got to start eating, that elephant, one bite at a time.
10:22
And this is this, these are some ideas.
10:24
On how we want to get started on that contrast.
10:26
What that, what we just talked about with the organization that
10:29
doesn't have roles, and they really struggle to get identity
10:32
and access management into a good place, where the business
10:35
can make informed decisions about who should have access to
10:39
what, and they're looking at, you know, a list of groups are,
10:43
you know, entitlements that are not put in plain English and not
10:48
tied back to business functions. For example, it's hard for them
10:52
to decide who should get The access and then part of doing
10:56
role management. Effectively is reviewing roles
11:00
reviewing the access that people have on a periodic basis and if
11:05
you're reviewing and you don't understand, you're probably not
11:09
going to start removing access that you don't understand what
11:12
it actually is and since we have your employee, not have the
11:17
access that they need to perform their job.
11:19
So what ends up happening is that people rubber-stamp during
11:23
the access Requests and reviews. So that's a place that roles can
11:29
be. Very valuable, especially roles
11:30
of gun. Right?
11:31
Are you name them in a way? That makes sense.
11:33
You write descriptions descriptions should tie back to
11:38
what, you know, what access this role confers and you have owners
11:44
of those roles so they can do roll reviews effectively.
11:48
So we've talked a little bit about our back or role-based
11:51
Access Control. What does that mean?
11:53
I think we For my money, when I talk about our back, it's the
11:57
overall process of role management and how roles Drive
12:03
the access that people get. So it's, it's looking at it from
12:07
kind of a 360-degree perspective from how you get the rolls, how
12:11
those roles help Drive access, how people interact with those
12:16
roles. Again.
12:16
Like we've been talking about its kind of we touched on a lot
12:19
of the different aspects of what makes a good role and it's
12:24
something Thing that the business can understand, they
12:26
can assign to people. And then those roles really
12:29
become the basis. For the assignment of who gets
12:32
access to what what would you add to that?
12:35
You pretty much covered everything.
12:36
You know I think if we go back to the bundle of sticks,
12:39
role-based access control is, how do you create that bundle of
12:42
sticks, right? Which sticks are going to go
12:44
into the bundle and does that bundle make sense?
12:48
Do the owners of those individual sticks agree to
12:52
become part of that bundle, right?
12:54
And this is an area that that does take some finesse.
12:58
This is more of a this is not necessarily technology problem.
13:02
This is more of a business process and trying to make sure
13:06
that you convert the Active Directory Group that is labeled,
13:10
you know, I T Dash PR D Dash, you know, a PP 004, you know,
13:17
translates into something that actually makes sense.
13:19
Oh right, that is the server or the application that controls
13:23
the cafeteria. You.
13:25
All right. So being able to make that
13:27
translation and put that in front of people to have them
13:32
make those informed decisions. As we're really role-based
13:35
access control and the Frameworks that go around it.
13:37
I think make the most sense, I know we've also talked a little
13:40
about a back or attribute based Access Control.
13:44
How is that different from role-based Access Control?
13:48
One of the things we said early on is, we're going to focus more
13:50
on the provisioning side. And so I think we're talking
13:53
about a back. In provisioning, we're talking a
13:55
lot about that. Birthrate automation of access
14:00
accounts where I really see a back as where I see
14:06
organizations using it as more on the authentication side.
14:09
In other words, applications are being given rather than here's
14:13
the access to person has a given profile information about a
14:16
person with a lot of attributes and that the applications that
14:20
can then interpret those attributes.
14:22
However, they see fit in other words.
14:24
The the decision point is that the application in terms of what
14:29
access those attributes confer. So very much like, you know,
14:34
policy-driven again, kind of on the provisioning side of the
14:39
house I think is really the interpretation of those
14:42
attributes for automating the provisioning of access.
14:46
Yeah, I think you hit it right there.
14:47
You know sometimes a back is also known as P back or policy
14:50
based Access Control. It's more of a runtime or Time
14:56
assignment of access. What's interesting to me is that
14:59
it really kind of layers on top potentially of role-based Access
15:03
Control right if you're driving data into the application?
15:07
Say, you know, here is Jeff and he's in Chicago that attribute
15:10
of me being in Chicago. May actually map back to a role
15:14
within the application, but it's not being granted to me ahead of
15:18
time because the application is determining determining, you
15:22
know, in a more real time based on the With indication the
15:25
authorization streams, what I should have access to versus
15:30
something that I've always had access to, which might be, you
15:32
know, that role that kind of sits behind it.
15:34
I think, what's similar in both Concepts is that you have
15:38
centralized management of that data, which is going to
15:42
ultimately Drive the access in role-based.
15:44
You're determining what data drives people to be in what
15:50
roles and then you're telling the applications put people in
15:53
these roles Versus you just handing the data to the
15:57
application and the application is deciding what access that
16:00
person should have based on those roles and so.
16:04
But in both cases, you're centralizing that authorization
16:07
data there is a scenario also where applications are
16:12
completely doing their own authorization Management Group
16:16
managing, enrollment or whatever you want to call.
16:18
You want to call it or they call it.
16:21
What I think is, that's usually a very early.
16:24
Maturity step. That's where you have a lot of
16:27
applications that kind of grown up on their own.
16:30
And maybe you've done kind of a level 1 integration, where
16:34
you're doing single sign-on between the application.
16:37
But you haven't really started to pull the authorization out of
16:40
apps and manage it at least manage the data centrally.
16:45
And so, that's kind of a, you know, step two or Phase 2 in
16:50
kind of centralized in your applications, is that
16:52
centralized management of offer. Relation.
16:55
But Jeff, my could I mean one thing I wanted to do earlier was
17:01
my little rant as in my rent, goes back to when we talk about,
17:06
what is our back, right? And kind of, how do you get that
17:08
bundle of sticks? And you know, that the two
17:13
methodologies that have gotten the most thought are around role
17:20
mining. So kind of the Starting with the
17:25
data and kind of building roles that way and roll engineering.
17:28
So kind of the top down approach in other words, a business
17:31
saying, you know, we need to roll that does X, Y, and Z and
17:35
then kind of building a roll around then and, you know, my
17:40
ran, I'll just, you know, put it in black and white terms.
17:43
I think role my role. My name doesn't provide a lot of
17:46
value at least when I've seen it in and, you know, I'm sure this
17:51
will get a lot of heat of. We had a forum where people who
17:53
just a winner. Stupid.
17:55
You know, we got in so much value out of it, but, you know,
17:58
when I've seen examples of role mining working, it's, you know,
18:03
taking that data that you have about users entitlements and it
18:07
saying looks like you've got an access pattern here that 80% of
18:11
the people in this department have why not give that access to
18:15
a hundred percent of people? And so my thinking is because we
18:21
don't want to give people access that they don't need, right?
18:24
It's funny. Percent of the people don't have
18:25
that role. That they're not banging on our
18:27
door saying, we need that roll. Why would you create that
18:30
rolling? Give that access to those 20% of
18:33
the people. What are your thoughts on that?
18:36
I mean, principle of least privilege.
18:37
Every time you go into an organization, it seems like
18:40
let's say 90% of the time. They've got a principle of least
18:44
privilege baked into their policies and standards around
18:47
information security. So I don't see why you would
18:50
want to give anyone access that they don't need.
18:53
Let's take a couple parts here. I want to get into this because
18:57
that was literally next question was are back and compete against
19:02
that concept of least. Privilege.
19:05
They are competing Concepts. So what we're, you know, we're
19:09
talking with folks, you know, and having these kind of
19:11
conversations, it's okay, you know, we want to be more
19:16
role-based and oh, by the way, we have this policy that says,
19:20
you know, we're least privilege. Okay.
19:21
Well, which is it because if you're assigning roles that have
19:26
access has two things that people don't need, then you're
19:30
violating the concept of least privilege and that's usually
19:32
kind of a thinking machine. When we're talking customers
19:36
and, and kind of thinking, okay, well, house is actually going to
19:38
work. And I think this kind of goes
19:41
back to the whole roll mining on the roll engineering exercise as
19:44
well. Because I do see some value in
19:48
the role mining but I don't see and I see the value of the Roll
19:53
engineering and I think that they're most effective when
19:56
they're done together. If you're trying to do one or
20:00
the other, I think it's a lot more difficult to see the True
20:03
Value out of it because The way I see it is, you know role
20:06
mining is basically digging deep into these applications or
20:10
systems trying to figure out what are all the different
20:13
access rights. That could be in place for that
20:16
application and then basically just coming up with inventory.
20:20
So the mining is, you know, you're going it out into this,
20:23
you know, this this mind and down into the shaft and you're
20:26
trying to find, you know, the different nuggets of gold ore
20:30
and those gold or might be different entitlements within
20:33
the application. It's great that you found them.
20:37
But what do you do about it? And I think that's where roll
20:39
engineering comes in, is okay. Now that you know what those
20:42
nuggets are, what are we going to do about it?
20:45
Do we take this gold and refine it down to this purpose, right?
20:49
Or do we leave this as a raw material for some other purpose?
20:53
So I see the role mining more as a Recon effort.
20:57
Let's figure out what's out there which is good right?
20:59
You want to know? Because if you're trying to
21:01
protect an application and you don't protect you Applicant, you
21:04
know, the rights that allow edit access to a database table and
21:08
things go Haywire. That's not going to be good
21:10
either. So you kind of have to know both
21:13
and then the engineering comes from working with the
21:15
businesses. They okay.
21:17
Let's talk about what are we going to give access to people
21:20
and then does that, how does that work with these privileged?
21:23
And the concept of rules because there certainly is a lot of
21:27
risk-based decisions that. I think that can be made there
21:30
around, you know, let's, let's take the cafeteria menu for
21:33
example. We really care if everyone has
21:37
access to that, you know, maybe it was not granted and it's a
21:40
certain people, maybe it was a mistake or maybe it's a new app
21:42
that just didn't get back filled to two people who were here
21:46
before the app, right? Probably not right.
21:49
The risk is low. Do we really care for having
21:51
chicken on Friday or, you know, or ribs or whatever?
21:54
Maybe you know, that's okay. But if there are more sensitive
21:58
accesses then yeah you probably do care and maybe the role that
22:03
you thought would be good for For an entire team or a
22:05
department, needs to be split up because you want to keep with
22:10
that, you know, concept of least privilege.
22:12
So I think there are I think there's value in the role
22:15
Engineering in the mining and the mining isn't just finding
22:17
the applications, right? It's also or the entitlements
22:20
that it can also be what do the people have?
22:23
And I see that as just an intelligence report that comes
22:26
back to eventually someone in the engineering side of things
22:29
whether it's the role owner, the role developer, you know,
22:32
whatever it might be, whatever persons handling that Say okay.
22:34
Yeah. Jim and Geoff, both have this
22:36
access, but General Jin has this other access but Jeff doesn't is
22:41
that appropriate? Maybe it is.
22:43
Maybe it isn't. Right.
22:44
And I think, you know, whatever the differences are comes down
22:47
to risk. If it's because Jim can knows
22:49
that we're having chicken on Friday and Jeff walks into the
22:52
cafeteria, you know, back in the day when we could actually go
22:54
into into buildings. You know, any surprise when the
22:57
menu comes up, maybe that's a risk were willing to accept or
23:01
maybe I'm just really picky eater and I need to have Have
23:04
the menu in front of me before, I'm going to waste my time
23:07
walking down the cafeteria, just to find out, we're having the
23:09
same old thing. So, that's how I kind of look at
23:11
it. You know, between the two, I
23:13
think, if you take a real philosophical approach, that's
23:16
probably not the right approach, right?
23:17
It's good. Value out of doing a data
23:21
mining. And, you know, we use the
23:25
cafeteria menu example because Nobody cares, right?
23:32
Everybody has access to the cafeteria menu.
23:34
Like, no one, no one should care anyway.
23:40
But they're, you know, made me think of a few things.
23:43
One was I saw a really good presentation and then we'll know
23:47
who attributed to, but it got into have access management,
23:51
fatigue managers getting so many requests for Access that
23:57
eventually just started rubber-stamping because they
23:59
didn't have have time to think about it.
24:01
You know, we're all busy during the day.
24:02
We're doing our job. Then you layer on all this kind
24:06
of red tape. But if you really boil that down
24:08
to only send a question to the approver, when it's actually
24:13
something that is worthy of an actual review, then you can get
24:18
to the point where you actually have deep thought put into it.
24:23
So you never asked about the cafeteria menu, but you always
24:26
ask about access to sap or whatever.
24:30
The financial system are and then it's, you have to decide
24:33
everything in between whether or not that requires somebody to
24:38
review that approval. Another thought I've run into
24:43
overtime is with least privilege applying that to privileged
24:47
access menu. So it's kind of the same concept
24:50
around assigning. What is the risk to the access?
24:54
And that's an area where roles can be very valuable, right?
24:57
Because You know, if you have, I think philosophically speaking
25:02
anyway, you should have fewer rolls than you have
25:04
entitlements, right? Yeah, ideas.
25:06
Should be you're bundling those sticks and you're not creating
25:10
more bundles of sticks actually, there were sticks.
25:13
So, if you can get to that smaller number, it becomes an
25:19
exercise that is more feasible. In terms of actually assigning a
25:23
risk value. Something that can be used to
25:27
determine what are the Operator controls around that, around
25:31
that access you touched on the design, their right a little bit
25:34
around. You know, what are these bundles
25:35
look like? How does someone get started
25:38
designing roles or going down? The are back or a back path for
25:43
their organizations? Well, I think it's, I think it's
25:46
probably like a lot of I am things and you have to look at
25:50
trying to get your low-hanging fruit first.
25:52
Great. As I always think about with our
25:54
back, is you start talking about?
25:57
Are back with people. I tend to think, people think
26:00
it's all or nothing, right? You're either doing everything
26:03
through our back here, doing nothing through our back and
26:06
when you see organizations that are actually on the are back
26:10
path, they usually never have to finish line right there.
26:13
Doing a lot of things with our bag and where I think
26:17
organizations to get the most value is the things that they
26:21
can automate. So it's that Birthright access
26:24
getting someone started on day one so that they Whatever it is
26:28
80% of the access that they need in order to do their job and
26:33
then beyond that, it's now you have to start getting into the
26:40
tougher stuff. So building those roles that are
26:43
around functional teams or functional jobs within the
26:47
organization and tying off the access, and it really requires
26:51
somebody with expertise on what is the access that you need in
26:55
order to make that successful. Successful.
26:57
And so you need to pull in people from the business and
27:01
really where I think I am teams and it teams should spend their
27:07
time. There is with the business units
27:09
that really want to step to the table and invest the time to do
27:14
this. So in other words, if somebody's
27:16
going to play along, you're going to get a lot further than
27:19
if you feel like you're dragging them into it and there you're
27:23
making them do something that they don't want to do.
27:25
I think, And those other groups that are not participating.
27:30
You see this success as being bred by the teams that are
27:33
participating, they'll want to participate as well.
27:36
So that's kind of I think the approach is think big but know
27:40
that you have to kind of start small and where you start is
27:43
with the low-hanging fruit stuff you can automate from and then
27:46
when it gets into the tougher stuff, you know, first work with
27:50
the teams that really see the value and are willing to invest
27:54
their time into making this successful.
27:56
Yeah, I like the The concept of starting big and starting micro,
28:00
you know, maybe it's macro micro so, right?
28:02
When I say that what I mean, is, you know, let's figure out.
28:06
Are you an employee, right? It's kind of a basic decision.
28:09
Maybe your, maybe an employee. Maybe you're a contract or maybe
28:12
you're a vendor or an intern, you know, whatever.
28:14
Maybe start with those giant rolls that you can answer
28:17
relatively easily and try to figure out if there are things
28:22
that are in common that all employees.
28:23
Get, maybe it's VPN access. Great.
28:27
Now, you've got something, you can edit that maybe it is the
28:29
cafeteria schedule, right? Maybe it's a company intranet
28:31
site, something like that. So you start with these very
28:34
broad roles and that's okay because you got to start
28:37
somewhere and then I like to start by dogfooding rolls with
28:42
my own team. So what I mean by that is
28:44
designing roles for my own organization and seeing what
28:48
works, what doesn't work so that I can really kind of refine the
28:52
process before I go to the next area, right?
28:56
Another business unit other team Etc.
28:57
And I would certainly start with teams that are friendly to, you
29:02
know, this this process. It's a lot easier with a willing
29:05
partner, that's for sure. And knowing that, you know,
29:08
you're there to try and help it and that there are going to be
29:10
pain points, right? Let's figure it out together but
29:12
the idea is to at some point roll this out to the rest of the
29:16
organization and being able to design those roles and figure it
29:21
out from a macro micro type of way.
29:23
I like that approach personally because I think You don't push
29:27
off the value. That might that you might be
29:29
getting by trying to design a whole bunch of rolls at the
29:31
department level. You can get value out of our the
29:34
employer their contractor, right?
29:35
That could be enough to make a difference.
29:37
And you can say all employees, when they on board, they get an
29:40
active directory account with these two adgroups and this
29:43
Office 365 or Microsoft 365 license.
29:47
That might be, you know, a good enough win to solve a couple of
29:51
pain points, maybe from an onboarding perspective, right?
29:54
It shows that you have Have some capability to get this done for
29:58
right? So you start to build
29:58
confidence, he organization and that, you know, the money and
30:01
the time that's being invested into this is working.
30:04
So I think that is, you know, a big part of it.
30:06
And then, you basically make a circle bigger from there or you
30:09
make the circle smaller from there, depending which angle
30:12
you're approaching from. And you can do both at the same
30:14
time, you know, with with the proper, you know, management
30:17
around how you'd like that to work.
30:19
I think I really like your house of growing.
30:22
Your own dog food. I think that works really well
30:25
with the And your, whatever your I am group or some small
30:29
contained group, I would say that I key generally is one of
30:33
the hardest departments to take on in terms of Designing roles
30:37
for, you know, system administrators database
30:41
administrator. That's where I'd like becomes
30:43
almost impossible and so you might feel like you're swimming
30:47
Upstream. If if you start with it, other
30:53
departments can be more stable HR.
30:56
Finance things like that because they those roles generally tend
31:00
to not change as much overtime as some someone and I can do or
31:05
be as cost in that group. Yeah, that's the point.
31:08
I think, you know, IIT is this is probably the hardest.
31:12
And if you can start with something simple, write your
31:14
ear, again, showing the values sooner rather than trying to
31:17
tackle the really hard stuff, right?
31:18
Get the 80% that will get value out of the stuff that you do
31:21
know. And then either punt or figure
31:23
out later down the road. How you're going to handle the
31:25
rest? And, you know, it's okay, I
31:28
think to not have a role for every single thing that's out
31:30
there. That's just, that's the real is,
31:32
you know, the realistic way to a kind of approach.
31:34
This is different teams, different organizations,
31:37
different business units, different geographies.
31:39
Those will all play into whether or not a are back.
31:44
Model makes sense. Right?
31:46
You may have a more mature role based access control for certain
31:50
teams on a less mature in other areas.
31:53
Using the console we've kind of talked about, maybe it really
31:55
only has An employee role. Whereas, you know, Finance maybe
31:58
has an employee role and a finance role.
32:01
And you know what accounts, receivable World, write
32:03
something like that and I think that's okay.
32:05
You just have to be able to manage it effectively and know.
32:09
And when no one know when and where to pick your battles I
32:13
would say. One other thought I was having
32:15
is we were talking about something like finance and we
32:18
think about, you know, Erp systems a lot of times they'll
32:23
already have a complex role structure.
32:26
Then the Erp system. And so I think as an I am
32:29
practitioner when you're looking to do, Enterprise are back, you
32:34
have to kind of set what your scope is.
32:36
I think is a dangerous place to you know, volunteer that you're
32:40
going to go into the application to solve the role needs within
32:43
the app. You have to start with an
32:45
expectation that the app has good enough application Level
32:49
roles but you know, so I think that's an important point and
32:55
the other thing I was going Going to say is just that, you
32:57
know, I think finances really good place to start because
33:00
that's where you're also going to find a lot of segregation of
33:03
Duties types issues and the IGA platforms that can really, you
33:08
know, identity governance and administration platforms that
33:11
can tend to help build our back models and manage our back.
33:17
They do a pretty good job generally speaking in terms of
33:20
identifying segregation of Duties and then baking those
33:24
into the access request. Access review process.
33:27
So kind of get a double benefit if you focus on on that area and
33:31
you're able to roll in s0 D as part of role management.
33:35
I'm glad you mentioned segregation of Duties because
33:37
that's something that we definitely see a lot especially
33:40
in you know Erp and finance apps, things like that.
33:44
And that's usually where we see relatively decent if not good.
33:49
You know, controls around what the roles do because there is
33:52
some you know, more judicious. Thinking around who should have
33:57
access to what in a financial systems.
33:58
Those sorts of things where we see a lot of organizations, kind
34:03
of fall down is cross application, ssds.
34:06
So they may be really good at managing sap and, you know,
34:09
having the appropriate checks and balances there.
34:12
But where the challenge comes in is if you have, you know, across
34:17
different applications. So maybe not only are you an
34:20
administrator in sap. Maybe you're also an
34:23
administrator on this other application.
34:26
That is kind of outside the purview of finance.
34:28
That makes a toxic combination, you know, something.
34:32
Introduces more risk to a certain process, you know,
34:35
things like that. So this is I think also an area
34:37
where there is the potential to leverage roles and the different
34:42
axis controls. Once you're aware them to say,
34:45
hey we have more visibility now of what people have access to
34:48
and what they can do. Not only within a system but
34:50
across systems. Does that make sense?
34:53
Do we want to keep that going or do we need to think of A control
34:56
to, you know, address that I think when we have these
34:59
conversations it's one other thing that has everyone who's
35:03
listening these to keep in mind is that, you know, we try to
35:07
make it as generic advice, right?
35:09
Or a generic copy. They were talking about, but
35:12
especially when it comes to, like roll management at the
35:15
segregation of Duties within Erp system, it's going to be a lot
35:19
different for 500 person, organization versus a 50,000
35:23
person organization and You know, he's going to have to take
35:27
the advice and then kind of feed it in as one data point, but I'm
35:31
sure either way are our fellow. I am practitioners out there.
35:35
They become expert at doing within their organization and
35:39
kind of are able to take these data points.
35:41
It's something where we're really talking here around, kind
35:43
of like guiding principles. And how do we, how do we move
35:46
forward with this? It is very hard to do.
35:49
You know, I said it before, these are generally at least a
35:52
year, multi-year long projects to do.
35:56
The mining right, finds the entitlements, and then figure
35:59
out. What do they do?
36:01
Do they make sense? How are we going to, you know,
36:03
construct, those bundles of sticks, right?
36:05
Those sorts of things. So, it is difficult and it is
36:09
something that can be done, but don't get, you know, don't get
36:12
to, I think Lost In The Weeds if especially if you can start to
36:16
address some of the macro type of roll situations.
36:19
So maybe we should talk a little bit about some of the guiding
36:22
principles for role management that we've kind of Talked about,
36:26
you know, around here in this conversation but also maybe some
36:29
more things we haven't mentioned yet.
36:30
Maybe we can start with what makes a good role versus not a
36:34
good role. One of the things there is a
36:36
good role is going to be used a lot.
36:39
The business is going to understand what it does and it's
36:43
going to apply to more than one person.
36:46
It's going to confirm more than one small piece of access.
36:51
So the Moores used the more people applies to the better.
36:55
The role is Is what are some of your thoughts are?
36:58
Yeah, I like to keep it simple, right?
36:59
Don't create roles unless you need them.
37:01
Gets it's the same thing. As you know, don't create an
37:03
active directory group, you don't need it.
37:05
Don't create, you know, any type of entitlement you're just
37:08
creating more work for no reason.
37:09
So, take a look at the way things are constructed and
37:13
figure out if you actually need to spend the time doing it.
37:15
And maybe, you know, if one person has this access and they
37:19
use it, you know so infrequently.
37:21
Maybe it does make sense to leave out of a roll and make it
37:23
more, you know, on demand. Requestable or however, you kind
37:27
of like to work through that. So I think that makes sense,
37:30
right? What about a framework.
37:32
So we've talked a little bit about Birthright and requestable
37:35
roles, and I feel like that's a pretty good framework to kind of
37:39
start with when it comes to getting started with, how do you
37:42
want to, you know, figure out which bundles of sticks, you
37:46
want to create and how they're going to be constructed.
37:48
Maybe we can, we can talk a little about that, right?
37:51
Yeah. I mean, I think a framework
37:53
means a way of thinking about, About a problem and something
37:57
that is reusable and solvable. So to me, it's setting yourself
38:02
up with a series of questions that you can ask about, you
38:06
know, as kind of a workflow almost of questions you would
38:09
ask yourself in terms of building roll, is it a good
38:13
Earth re-roll? That's what you would want,
38:16
ideally, right? Because I think you want to
38:18
automate access where possible if not.
38:22
Can you make a good requestable roll?
38:25
And if not does Even make sense to have as a role.
38:27
So, kind of questions you get, as yourself are, can I define
38:31
the user type? So if we're using the example of
38:33
interns, yes, I can, you know, interns are distinct group of
38:37
people does an authentic authentication or authoritative
38:43
Source exist for that user type. So maybe in our HR System we
38:49
have in turn as it goes ignition.
38:52
If we do, we can still go down that path.
38:54
That it could be A, you know, we could still be going down the
38:59
path of having a birth very role.
39:01
If it's not in the in the authoritative Source like the
39:05
work they system or the HR System, then it would have to be
39:09
a request Will Roll, right? There's no way to automate the
39:12
idea that somebody is is in that grouping.
39:15
Another question would be kind of defining entitlement pattern
39:18
or access pattern. So in other words do interns
39:22
actually have to you know, access the same Soup of data
39:27
across all the entire intern population or do those is there
39:30
some subset of data within the organization that they do all
39:34
need access to? And then is the membership
39:37
volatile. So example, I'm going to give
39:40
here is that I worked with an organization that they would
39:43
change their cost centers very frequently.
39:45
And so even though it seemed like at one point your cost
39:49
center could be used, it was coming from an authoritative
39:52
Source. It did Define some access
39:54
patterns because if you're in a certain Cost centers.
39:56
It kind of meant that you needed access to certain things.
40:00
However, it was volatile it change so often for people as
40:04
they did. These re organizations that it
40:07
actually did not make a good roll.
40:09
So if the interns hype is usually not volatile, right?
40:14
People are yes they're interns and then they can move on to
40:17
something else or leave the organization but they're not
40:20
switching different types of in Terms all the time.
40:23
If they are then it would potentially As qualified as, you
40:27
know, potential birth re-roll, that to me is what the framework
40:31
is all about is being able to kind of walk yourself through a
40:34
questionnaire and being able to determine whether or not you're
40:37
creating a birth rate role of requestable roll or you know
40:42
that population doesn't make for a pretty good roll.
40:45
Yeah. I think you touched on a couple
40:47
of important things there and especially around data quality
40:49
and coming from HR and other authoritative sources like
40:53
workday sap, Oracle etcetera. Is, you know, a lot of these
40:58
access decisions are going to be driven by the quality, and the
41:02
timeliness of the data in those systems.
41:04
So that's something that you also want to take into
41:06
consideration when you're talking about how these roles
41:10
are going to be constructed. And then, where is the data
41:12
going to come from and, and from in, from when right, if someone
41:16
gets loaded into work day, the day of their higher that might
41:20
not be a good spot to drive automation from a Birthright,
41:23
real perspective to maybe that you know, things end up being
41:25
more of a request. Double role because you don't
41:27
have the data in the time that you need it to be most
41:30
effective. So I think that's something that
41:31
also kind of consider, you know, any talk about automation,
41:34
right? And I think this is something
41:35
that you grow into. You don't want to automate all
41:38
the things all the time. You probably want to pick where
41:40
you get the biggest bang and where you feel the most
41:43
comfortable and safe from a maturity standpoint, to be able
41:46
to assign access in an automated fashion.
41:48
You don't want to, you know, create a role and it has the
41:50
wrong access it and they just gave it to everybody and put
41:53
your organization at risk. Yeah.
41:54
There's something else there with the The, the automation
41:56
pieces, typically organizations are getting that data from an HR
42:03
System, right? So those HR processes get bound
42:07
to your prophecies for assigning access, right?
42:10
So there is some some governance required there and that kind of
42:15
also comes down to how stable that that data is right?
42:18
If it's being changed. If you know, you're trying to
42:21
drive access off of something that you know, the Code or job
42:27
code. There's job codes wind up
42:29
changing every couple of years. You could, you know, create
42:32
Havoc. Yeah.
42:33
Absolutely. It's got to be.
42:35
This is where the tight integration between HR and I am
42:38
really kind of hits the most because it's okay to make those
42:42
changes. What's not okay, is to not let
42:44
the, I am team know and those changes are being made because
42:47
that certainly affects me a lot of things down the stream.
42:49
So you had a good relationship with HR HR, It Whatever the
42:53
right, you know, term is for your organization and where that
42:55
Authoritative data is coming from makes sense, and maybe it's
42:58
not HR, right? Maybe contractors or vendors are
43:01
managed by Finance team or maybe they're not being managed at
43:04
all. See it a lot, too.
43:06
So trying to design around those types of issues, you know, we're
43:10
not going to have the answer right here in this conversation,
43:12
but at least bring it up so that it can be addressed as part of
43:15
what is the overall rule strategy?
43:17
That's right. So I think, you know, we've
43:19
covered quite a bit today and it, you know, there's some other
43:22
things that we probably could probably touch on, you know, you
43:24
want to have measurable. Results when it comes to that
43:27
you don't want to create rules that are unnecessary, right?
43:29
Keeping it simple making sure that their roles are easily
43:32
understood. So using plain language to
43:35
describe what the role is and what it does, you know, that'll
43:39
help people not only request it but also approve it and
43:43
hopefully that you get out of the rubber stamping situation
43:46
where, you know, a manager or whoever is responsible for the
43:49
access. You know.
43:51
Just says yeah, it's okay because of apathy, they don't
43:53
care or because of fear, right? There may be afraid to take away
43:57
something because someone can't do their job and it ends up to
44:00
become a, you know, 3M call on a Saturday or something like that.
44:03
I think you also think about the fact that you know, people
44:07
retire and leave the organization over time.
44:09
Other people are going to inherit that ownership of roles
44:13
and they need to be able to inherit them and understand what
44:16
they do. Yapping, The Inheritance is a
44:18
strategy that if a lot you don't want to break the chain, right?
44:21
So if someone owns a role and they lead the organization, My
44:26
basic philosophy is okay that person's manager should now
44:29
become the owner of that role on the till they tell me who is
44:32
going to do it instead of them. So that way you don't have this
44:35
role hanging out there that doesn't have an owner or has a
44:38
gap, you know, in some way, whether it's approval structure,
44:40
whatever. So I think being able to come up
44:42
with, you know, standard processes around, that doesn't
44:45
mean that they permanently own it, but someone has to own it
44:48
and you want to make sure that, you know, you keep that link
44:52
between the two things in place. Yeah.
44:54
And you mentioned something about Measurable.
44:56
I think that can be using some measures or some metrics.
45:03
As you're rolling out, roles to know how many roles have owners
45:08
or even if you're a little kid, like groups, they have owners
45:11
that they have descriptions, that are, are usable, you know,
45:14
you can use that to make sure that you're closing the Gap.
45:17
But then also, as you've really gotten a head of steam around
45:21
using rolls, how many rolls are, you know, how many, People
45:26
belong in a roller. How often is that role assigned?
45:29
What you find, if you have low use of a roll, it's probably one
45:35
that you want to reach out to the business.
45:37
Say hey, do you still need this right?
45:38
See that you're not using it very often or there's only one
45:42
member of the role is just you know, is this something that's
45:45
worth us? Investing our time into having a
45:48
role like this? Maybe it is, maybe it isn't.
45:51
But that that's where that data can potentially, you know, use
45:55
Is metrics. Don't only have to be to
45:58
communicate out to the organization and hey this is
46:01
what a, what a great job we're doing.
46:02
But also having those metrics to do a better job of managing
46:06
yourself. Yep.
46:07
Fulfilling that role accessed rewrite.
46:09
Sometimes you got to do some pruning and that's healthy and a
46:12
way to keep it, you know, manageable.
46:13
So I totally agree with that. We've been going on for quite a
46:16
while here, role-based access control and, and other things
46:20
around it. Is there anything that you want
46:22
to bring up before we decide to call it for this week?
46:25
We did talk a little bit about it, but I think the technology
46:30
side of this is really the identity governance and
46:33
administrator IGA space. And so, you know, if you're kind
46:37
of looking to do additional research, one thing I would also
46:40
say when it comes to roles, right?
46:42
Taking it from this philosophical discussion that
46:44
we've had today and turning it into something that's going to
46:48
be very tangible and restart using specific terms of me
46:53
specific. Things is your To adopt
46:56
technology. I recommend that if you're going
46:58
to adopt that technology that you try to adopt the practices
47:02
and best practices built into that technology, IGA is the
47:07
space that typically does role management.
47:12
And so I just wanted to point that out.
47:13
That if you go down the route of say, implementing a cell Point
47:18
type system, they have definitions on what roles are
47:23
business, roles, application roles things like that.
47:25
Use that terminology try to adhere to their best practices
47:29
as well because if not you're going to kind of be swimming
47:32
Upstream. Yeah that's a good point.
47:34
You know you buy a lot of these Technologies not only for the
47:36
technology itself but the process that comes with it,
47:39
right? And this is what those
47:41
Technologies. Do sale points, avian clear sky,
47:45
a whole bunch of these other IGA players.
47:47
They have a process that they follow and generally it works
47:50
otherwise their application will work.
47:52
So you want to try and stay within the bounds of that and
47:55
try it. I decided to adopt those those
47:57
processes into your business so that you're not having to get
48:00
into this world of customization and exceptions.
48:03
And, you know, all the kind of things that come out of using
48:06
technology in a way that it wasn't meant to be used, which
48:09
you certainly want to try and avoid as much as possible.
48:11
Yeah. All right.
48:12
Well, I think that's a pretty good spot that maybe we can
48:14
leave it for this week. I feel could cover a lot of
48:16
ground, on our back, a back P back and I'll bunch of other
48:20
acronyms. I'm sure that we threw in there
48:21
as well, so don't forget that you can, you know, Visit us on
48:26
the web at identity at the center.com you can see us on
48:29
Twitter at idac podcast. And with that we're going to go
48:33
ahead and talk with you all in the next one.
48:36
Thanks for listening. Thanks for listening to the
48:42
identity at the center podcast. If you like what you heard,
48:45
don't forget to subscribe and visit us on the web and identity
48:48
at the center.com.