Setting the finish line halfway: Why IAM cannot be a tick box exercise

Target audience: Minimal IAM knowledge, Cyber Leaders/Managers about to start on their IAM journey or those who already have base implementation of an IAM tool.

Consistent growth in implementing Workforce Identity technology products in Australia has led to many partially integrated solutions that aren’t delivering the anticipated value, or tickbox exercises that are still failing audit and compliance requirements. We hear that identity is a long journey, but why aren’t we committing to it after the base implementation?

The presentation will discuss the human and organisational factors that are at play in IAM implementations, and how to avoid common pitfalls.

• Ownership

oMost IAM implementations are driven and funded by the CISO; to increase productivity and reduce cyber risks. In reality IAM touches all areas of the buiness so should be jointly owned by CIO/CTO and the business.

oIAM Programs are usually done in phases, where the base implementation is the first phase. Some organisations do not move forward after the first phase, because they did not see immediate value and broader buy-in from the business.

oExecutives need to understand that the initial investment is high, but the risk buydown comes over 3-5 years.

oIAM is a core component of addressing regulatory requirements, data integrity & privacy concerns, and other Internal Audit findings.

• Governance

oIAM extends further into the business than most leaders realise.

oIAM needs to be part of enterprise architecture forums. Downstream teams (eg. Finance, HR) who are procuring applications, need onboard into IAM controls as part of the application lifecycle.

• Risk

oThere’s often debate about when IAM risk has reduced. A base implementation of an IAM tool only connected to ITSM and AD is a great start, but if there isn’t coverage on high risk/crown jewel applications, it’s hard to justify risk reduction in an Internal Audit scenario, especially without manual controls.

• Business Need

oIdentity vendors in the market are changing and consolidating. IAM should be tied to the business strategy, and not just the next best technology solution.

oIncreasing reliance on non-human Identities and AI means business needs are shifting, and compliance requirements are getting stricter.

• Requirements & Buy-In

oGetting engineers and business users on board with changing how they work can be difficult, especially if they have a lot of ownership over the domain.

oUsing them to define requirements and tying in their pain points and what the business’ strategy is into the IAM deployment will help.

oThere’s a line between preventing frustration with the new tool whilst ensuring no workarounds (especially in PAM). Change management and writing new SOPs will enforce change.

• Process

oAvoid replicating outdated workflows with custom solutions; consider out-of-the-box options that can fulfill business needs, then changing the team’s day-to-day behaviours.

o(Manual) Process optimisation for Operational teams will support both Buy-In and meeting of IAM control requirements.

Where is the finish line? When coverage is broad enough across your highest risk assets, the solution is running in BAU.