IGA Modernization: Legacy IGA Systems Cannot Secure Digital Transformation
By moving to the cloud, enterprises ease workload burdens, connect across Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) to enable business operations. In a modern world where customers and employees increasingly access the cloud, organizations can no longer solely maintain on-premises IT infrastructures. Faced with legacy challenges, organizations seek to find the right approach for their cloud migration and hybrid architecture strategies. Unfortunately, despite wanting a modern modernize IT infrastructure that enables customers and employees, enterprises often forget that IT modernization needs to start with people which requires identity governance and administration (IGA) modernization as well.
What Are the Financial Benefits of IT Modernization?Digital business models and digital operating models increase revenue by enabling new customer engagement models that drive growth. The World Economic Forum highlights several benefits:
- 30% (estimated) of industry revenues will come from new models by 2020.
- 90% of companies adjusted their operations in the last two years.
- 26% more profit can be earned by companies that understand the digital transformation.
What Problem Does The IT Modernization Strategy Solve?As a buzzword, digital transformation says very little. As a strategy, it says a lot because it enables the new customer engagement models that keep businesses relevant and drive growth. Modernization requires organizations to place technology at the core of their operations. It means looking at business objectives and creating a long term plan for growing revenue. Thus, the questions that the enterprise must ask are:
- What are the corporate goals? These can be customer engagement or employee enablement, but the strategy needs to start with the purpose rather than the technology.
- What application tools can best meet these goals? Creating a multistage program and prioritizing deployment streamlines the transition.
- Who are the users? Business-critical operational goals define the strategy, but users (employees, customers, partners) need to define the deployment process.
WHAT ARE THE ACCESS SECURITY RISKS ARISING FROM IT MODERNIZATION?Legacy IT infrastructures fail at securing data as organizations modernize their infrastructures. As data breaches increase in severity and numbers, organizations need to secure their mission-critical systems, networks, software, and applications. If one or more of the following describes your infrastructure, you likely have security vulnerabilities:
- Operating modern IT infrastructures in legacy environments increases complexity.
- Legacy IT infrastructures connected to the cloud create more entry points.
- Disconnected services across the ecosystem cannot be managed effectively.
- Fragmented identity systems create gaps that can lead to Segregation of Duties and “least privilege necessary” violations
What Does IGA Modernization Mean?IGA modernization means strengthening the web access management process. IGA modernization requires focusing less on the simple questions of “what and who” and focusing on the broader questions of “how and why.”
Legacy IGA FocusDue to the static nature of on-premises IT infrastructures, IGA began with data then aligned it with users. Legacy IGA systems focused only on “who and what”:
- Create ID
- Set authentication
- Look up user access permissions
- Review the access control rule for role
- Compare individual’s access permissions to resource’s access control rules
- Grant if they match. Deny if they don’t.
Modernized IGA FocusA modern access solution starts with people because cloud and hybrid environments exist to ease user pain points. People are not static. Digital business transformations focus on mobility to enable users. Remote employees connect to workplace IT infrastructures from laptops, tablets, smartphones, and smartwatches. Customers connect to digital engagement models in the same way. To manage dynamic identities and access points, the enterprise needs an IGA solution that focuses on “when, how, and why” rather than simply “who and what.” IGA modernization requires solutions that focus on:
- Digital identity: human user
- Account: application the human user logs into and how much access they need
- Permissions: access right to a system focusing on system criticality to role
- Role: business role which often bundles with job function and establishes user criticality
- Policy: rules defining how a role or permission links to the identity or account
- Context: when and where the user logs in
- Attribute: a full aggregation of identity, account, permissions, role, and policy within a given context to create a holistic approach to identity and access