IAM is a far-reaching concept. This understanding must be put into practice when running such a programme, to avoid quickly falling into common pain points. Let’s take a closer look.

IAM programme challenges: some typical examples

Three main drivers which are putting demands on IAM are business change, cyber security, and user experience. However, organisations often undertake IAM programmes driven, exclusively or primarily, by the desire to migrate to a new solution. With technical debt or tooling the only real concern, IAM programmes can face issues very quickly.

1/ Broad impacts of migrating to a new solution

Often the desire is to simply migrate to a new tool or perform a major upgrade of the existing technical asset, whilst leaving all other elements of the IAM service unchanged. This can have unwanted effects on these other aspects. For example, a new tool will likely bring about new approval processes, which will require staff training on a new user interface. It could even require entirely new leavers and joiners’ processes for HR. This pain point ultimately boils down to a lack of assessment of the impact of the technology change, in the context of wider IAM ecosystem.

2/ An ever-growing list of requirements

When an organisation realises that IAM change is not limited to the tooling, this can often open the floodgates to an unrealistic number of new objectives. Stakeholders end up demanding more of the programme (such as better user experience and increased ITSM integration) – despite these new objectives not being originally identified and catered for. The programme can become a vehicle to voice dissatisfaction with the existing end-to-end IAM service, causing scope creep. This dynamic can quickly bring pain to the programme across change management, budget, and solution architecture.

3/ Forcing a like-for-like implementation

Once interactions between the new IAM solution and its perimeter services are fully functioning, you still need to consider differences in design philosophies between the new and the old tool. Key product design differences must be catered for. If not, organisations can end up requiring custom code and complex configurations on the new solution, simply to match the previous setup. This can impact on vendor support, maintenance, overall performance – and not to mention the need to retain a huge body of knowledge on the complex customisation. By going down this road, you can cause more trouble than that you are trying fix. A true butterfly effect of issues can be on the cards when trying to force a like-for-like on different tools.

The key to avoiding these common pain points is to acknowledge that IAM must be viewed as a transversal topic, which impacts technology, people, and processes.

What is the recommended approach then?

Key to success is the acknowledgement that IAM improvement is a far-reaching programme. The implementation of new solutions is only the tip of the iceberg, and key impacts should not be underestimated. Under the covers, we believe the key streams of the transformation are:

/ IAM solution renewal: the deployment (or upgrade) of the new IAM solution. This includes solution architecture, engineering, and technical migration.

/ Modelling of rights: existing access rights must be translated into the new IAM ecosystem, such as business roles and application profiles.

/ IAM data cleansing: the stream to review, cleanse, and validate reliability and correctness of existing user data. For example, recertifying the role of a user and validating their line manager to ensure the correct person is approving access requests.

/ New processes and change management: this includes new ways to request and review access to applications, new processes to manage leavers and joiners, and training staff.

/ Interoperability with other services and assets in the IS: for example, integrating the new IAM tooling with the SOC may require re-engineering the log ingestion into the SIEM and API calls. Another typical piece of work is to coordinate with concurrent AD migrations or upgrades.

We recommend structuring the IAM programme such that each of these topics is covered by an individual project. The design authority of IAM policies should operate at the programme level, with clear inputs to help guide all streams.

Critical to success is also strong sponsorship and a publicized vision of the objectives. Because IAM programmes touch so many organisational domains, it is essential that the programme manager and PMO function are supported at the executive level.

Finally, flexibility is key to manage changing circumstances and constraints. Here’s other tips to ensure the programme can remain on track to meet its intended objectives:

/ Find a good middle ground between legacy assets, the ideal target state & the capabilities of the new solution: the target state should be based on what best helps deliver the end-to-end IAM service to the business.

/ Evaluate the possibility of integrating new solutions with existing services, even if not originally envisaged in the ideal target state. Simplify and rationalise where possible. This will help in both the short term and the long term.

/ Do not rule out the possibility of retaining existing tools which were originally due for decommission, if it supports the overarching IAM objectives: sometimes it is best to maintain some existing assets, rather than decommission and migrate for the sake of IT modernisation.

In this article we have seen how defining key objectives is vital for the success of the programme. Understanding the breadth of IAM change is crucial, both for structuring the programme, and delivering on time and on budget. This approach will also allow programme managers and each stream lead to implement flexible measures to migrate from a legacy ecosystem and legacy applications to the new sol

Cet article Identity and Access Management: keys to a successful transformation programme est apparu en premier sur RiskInsight.

IAM transformation: what are the main drivers?

Businesses are changing at pace, and speed-to-market is strongly dependant on IT systems built on robust and scalable identity services. Whether it’s new a web service available to customers, a significant expansion, or a back-office merger – the requirement to scale IAM services quickly and efficiently is ever-present.

At Wavestone, we witness three drivers, often in combination, which demand more from Identity & Access Management:

1. Cybersecurity risks
2. Business change
3. End user experience

Let’s dive into each of these in more detail:

1/ Evolving cybersecurity and information system models

Information systems are increasingly open and fragmented. Cloud adoption and distributed architectures are contributing to this fundamental shift. Security is adapting its principles and the notion of zero trust is now well established. Identity and access management is a key enabler for zero trust.

Information systems are consumed by thirds parties, customers, and employees. Identity is central to critical data exchange and confidentiality amongst diverse entities. It is therefore necessary to have a unique identity for each entity across the entire information system. While architectures evolve – the ultimate IAM objective does not: the right person or entity, with the appropriate level of rights, to access the right resource, in the right context. Crucially, this principle must be met on an ongoing basis.

Each machine and user’s unique identity is also critical for traceability. An organisation should be able to identify, authenticate and authorise any user, from any other entity, when accessing a resource. The ability to centrally log, audit and monitor these events from across the information system is essential.

2/ Identity-as-a-service to the business

Businesses are experiencing core transformation which require more agility & shorter time-to-market. For example, several retailers are seeking new digital avenues to market due to an evolving e-commerce landscape and operational challenges brought about by the COVID-19 pandemic. Identity services must be able to support large business initiatives and cater for innovation at scale.

Complex business change cannot be slowed down by extended security or infrastructure delivery times. Identity must be an enabler, and not synonymous with delay. Any project must be able to rely on identity services which are provided as an available commodity to the business, and not newly designed and deployed for each initiative.

Consolidation and standardisation of IAM solutions and processes is critical to implementing this model. This includes consistent and robust management and is dependent on technology-agnostic methods and protocols – based on the latest, secure, industry standards (such as SAML, OIDC and OAuth).

The provision of identity services must become embedded in the organisation’s operating model and practices such as Agile, DevOps @ scale and innovation @ scale: IAM delivered as a service to the business.

3/ User experience demands are now centre stage

The third, crucial, driver of IAM transformation is user experience. The focus is on organisations to provide employees with the same quality of authentication and authorisation services that external customers have often enjoyed in the past. The objective is to allow end users to prove their identity easily and effortlessly, and access required services, from anywhere, and from any device. This forms the basis for a genuine continuous experience that supports new ways of collaborating, also accelerated by remote working.

Easy and smooth registration processes, as well as consistent authentication across different applications, should be provided to customers to simplify their experience and build brand loyalty. This same principle holds for employees and third parties.

Passwordless technologies and unique application logins are examples of solutions on the rise; Innovative risk-based and contextual approaches can streamline accesses, which can have a significant, positive, impact on user experience by reducing authentication requests.

What steps to IAM transformation?

Understanding your current maturity is a key step towards delivering on the above. Over years of supporting IAM initiatives with clients, we have built our IAM maturity improvement journey, which is comprised of 4 maturity steps.

• Fragmented: the organisation lacks a consolidated approach to IAM across solutions, governance, and standards.

• Rationalized: the technology landscape supporting IAM is simplified and managed centrally to aid user experience across all applications and users. Consolidation provides satisfactory oversight capabilities.

• Extended: the organisational IAM capabilities cater for an evolving information system: any user, any device, any service.

Many organisations currently have elements of these capabilities, but rarely deployed globally.

• Mastered: the organisation has adopted next-gen solutions, which provide strong security benefits and a smooth user experience – all whist reducing the workload on IT operations thanks to intelligent automation.

At the time of writing, these are adopted on a case-by-case basis or serve as an aspirational step on IAM roadmaps.

Each of the above steps requires a deep transformation of the environment: change of governance, change of processes, and deployment or migration of supporting technologies. To be a success, we believe it needs to be addressed as a dedicated IAM transformation programme.

Stay tuned for our next publication, where we share what good looks like for an IAM transformation programme…

Cet article Identity and Access Management: back in the spotlight est apparu en premier sur RiskInsight.

For more information, watch the video presentation of the contest.

For the fourth edition of the contest, data and AI come along with Cybersecurity!

While previous editions of the competition rewarded only startups specializing in the field of cyber security, the 2020 edition has broadened its scope to include new topics, such as artificial intelligence and data, which remain key components of the cyber ecosystem.

All the participating startups, of French or European origin, were able to share all the richness of their diverse technological expertise. Below are the top 5 topics covered by the participants this year:

• Fight against fraud
• Digital identity protection
• Development of artificial intelligence for business
• Data integrity protection
• Detection of incidents and vulnerabilities

A high-profile jury, with analyses and strong messages!

This ceremony was obviously intended to reward the big winners of the 2020 edition, but not only. It was also an opportunity for all the jury members to share their analyses of the current startup ecosystem.

This year, the jury was composed of Claire Calmejane (Group Innovation Director – Société Générale), Christophe Leblanc (Group Digital Resources and Transformation Director – Société Générale), Pascal Imbert (Chairman and CEO – Wavestone), Reza Maghsoudnia (Strategic Development Director – Wavestone), Guillaume Poupard (Managing Director – ANSSI), Jamal Attif (Professor at Dauphine-PSL, head of the MILES team) and a college of experts (Thierry Olivier, Christina Poirson, Julien Molez, Gérôme Billois, Ghislain de Pierrefeu and Severine Hassler).

Lessons and perspectives of the crisis

Although this health crisis is not yet over, it seems in any case a little bit better controlled than in March, when this disease was still unknown to all of us. On that topic, Pascal Imbert and Christophe Leblanc brought their analysis of this crisis and its impacts.

According to them, this crisis has revealed the fragility of both the companies and of our current economic models, but it has also accelerated the trend, with digital technology recently taking an even more important place. This makes the transformations deeper and faster. However, it is not without consequences for companies, which are seeing an acceleration of their transformations, with the need to integrate new factors, such as a better balance between efficiency and resilience, together with a major focus on technology, which represents an economic, technological and sovereignty challenge. According to Pascal Imbert, the startup environment, which is being honored with this competition, is one of the key elements that should enable us to regain control over technology and how it is used.

This crisis is both a factor of digital and strategic transformation, of which data and cybersecurity are an integral part, a factor of agility, with the acceleration of teleworking and the necessary adaptation of IT security rules, and a factor of “stress-testing”, for our economic and technological models.

Artificial intelligence and data at the service of the crisis

Jamal Attif reminded us all from the start: “the value is in the data”. However, according to him, AI as we know it today is unable to solve this crisis. It can help fight it, for example by using bibliographic data mining algorithms to understand the effects of certain drugs. It can also speed up and improve medical diagnostics, through image recognition, but it cannot predict what has never been seen before, such as this epidemic, which has grown very rapidly.

The startup ecosystem today has a real impact on our business models, but he deeply thinks that it is important to combine all the forces, whether from the world of research, large companies or startups, in order to achieve breakthrough innovation that will enable us to respond to such issues.

Cybersecurity: evolution of the threat and innovations

Guillaume Poupard notes two major points concerning digital and cybersecurity today.

First of all, he raises the positive side of the digital transformation, which helped overcome the lack of activity during this period. However, according to him, we must remain cautious, especially in the face of the particularly worrying growth of cybercrime, which now targets large companies, with very serious cases multiplying (50 ransomwares in 2019, against already 130 in 2020, and it’s not over yet). The issue of combating cybercrime is therefore a topic of major importance. It is then useful to perform new risk analyses and information system audits to detect possible cybersecurity flaws that were created in these few months. Like Jamal Attif, he reiterates the importance of public and private stakeholders of all sizes, with different motivations, working together to strengthen our cybersecurity defenses. According to him, it is necessary to put forward those who innovate, and this is one of the objectives of the cyber campus, which should soon be created, in the Paris region.

The other point is to continue to raise these issues at the European Union level, and even beyond, by setting up networks so that all stakeholders can work together. This is notably the objective of the recent launch, by the member states of the European Union, of the Cyber Crisis Liaison Organisation Network (CyCLONe).

Focus on the innovation and startups ecosystem

Reza Maghsoudnia shares the very essence of the startup ecosystem, which is to think outside the box, to challenge established players, and to innovate in order to give more value to the various transformations we are experiencing. The crisis is further increasing the need for innovation, and it is of deep importance for Wavestone to continue to identify these sources of innovation, to support and accompany them.

That is for this reason that, in 2015, Wavestone created a startup accelerator program (Shake’Up), enabling it to be in constant interaction with several hundred innovative players on the market and to identify great startups to accompany them. As of now, more than 40 startups have been supported, including real success stories such as Alsid and Citalid, in the field of cybersecurity. Regarding the French Cybersecurity startup ecosystem, we invite you to read the analysis of our experts, following the 2020 startup radar conducted by Wavestone.

61 startups competed, 8 startups retained and 4 startups rewarded

Isahit, Special Prize – Data for good & Ethics

Founded in 2016, the French “Tech for Good” Isahit offers companies a digital impact sourcing platform for processing digital tasks that cannot be handled by artificial intelligence.

Watch the video presentation of the startup Isahit.

CryptoNext, Special Prize – Cybersecurity Made in France

Founded in 2019, CryptoNext has developed an encryption technology to make data resistant to the power of quantum computing. Its software is intended to be implemented in the offerings of major players in the IT security sector.

Watch the video presentation of the startup CryptoNext.

Inqom, Data & AI Grand Prix

Founded in 2015, Inqom has built a SaaS software for automating accounting production, allowing real time generation of the balance sheet. Using artificial intelligence, the solution processes and enriches accounting data to create centralized, standardized and intelligent accounting.

Watch the video presentation of the startup Inqom.

Hackuity, Cybersecurity Grand Prix

Founded in 2018, Hackuity provides a platform that rethinks the way IT vulnerabilities are managed across the enterprise by collecting, standardizing and orchestrating all security assessment practices, whether automated or manual.

Watch the video presentation of the startup Hackuity.

Cet article Banking Innovation Awards: together they are building the bank of tomorrow! est apparu en premier sur RiskInsight.