February 9th, 2008 by Corbin H. Links
Hello Everyone:
Is it just me, or has anyone else been recently stuck trying to solve the latest “last mile problem?” Last mile you may ask? This time, I’m talking about the issue of connecting all of those “target systems” to this new generation of what I call “complianceware” tools. The idea of “complianceware” tools is that they help ensure that all of your target systems are compliant with regulations (GLB, SOX, et al.) and maintain dashboard and reporting features — among others. So the last mile is the connection distance or method between the data to be analyzed/audited/baselined/reported/role mapped, (target data) and the source of analysis (source system.)
Into this mix, I would also place role mapping tools, or “roleware” (which can be closely aligned with, or even a part of, “complianceware” packages.) A great many vendors are now out on the market talking about auditing, reporting, role mining, role mapping, role-based access control (RBAC.) I have had the opportunity to experience several demos of the latest technology in the space, in addition to implementing many traditional “big iron” IAM tools that to some extent include this functionality.
My findings? All in all, the newest generation of tools are great — even phenomenal — at doing what they do best. Analyzing data, log files, flat files, data streams (traffic passed over the wire or otherwise,) mapping, collating, reporting, dashboarding, dynamic role creation and mapping, and even provisioning and de-provisioning of access and accounts. This is all great, and in and of itself, this tool category can add enormous value to today’s enterprise.
But here is the challenge: how to get data from your “target” system (i.e. what you want to audit and report on,) to your action and analysis system? (Source / auditing system.) This is a common question we ask of vendors, but the honest ones are not able to give a strong answer.
Sure, the modern tools can slice and dice files in amazing ways. They can do incredible things with role engineering and compliance baselining. In other words, once these systems can get at the data, they can do amazing things. In many organizations however, “getting at the data” can be difficult if not downright politically impossible in some organizations. Without valid connections, schema maps, access to csv or XML-based files containing target data for analysis, live log files, access to bit streams from the network wire, or other methods, they cannot do anything. Zilch. Nada.
What do vendors offer? Yes, they have connectors, agents, adapters, filters, protocol analyzers, etc. But how do they solve the people, political, organizational challenges of people that just plain do not want to make that happen?
Here are five key suggestions that almost all organizations to use to close up that “last mile” between the complianceware system, and the target systems.
- Get the resource owner buy-in before investing in complianceware/roleware. This is key. Don’t just buy something and expect that you can just seamlessly hook everything together. I don’t care how easy or transparent the product vendor tries to make it. The vendor cannot make your clients/subject matter experts provide what they do not want to provide. Even if the technology is there, the political will may not be there. If buy-in is not there, then your organization should be taking serious stock of its situation. What is the cost of forcing subject matter experts to comply? Is it worth losing them if need be? This exercise will also help guage your effectiveness at communicating the program vision and goals, while setting realistic expectations.
- Task each application owner with providing at least two points of entry for their applications. These may include (but are not limited to):
- Agents or adapters form the complianceware system to the target system
- Non-connected methods such as csv files, space separated files, tab delimited, structured xml, or any other type of output format that is mutually supported by the target system and the complianceware system.
- Indirect query methods such as direct SQL queries into application databases
- Give application owners choices as to how they want to provide data. These choices will be driven by the capabilities of your source and target systems.
- Try this exercise:
- Send a survey to your top departmental managers. Ask them “if you could have any report that told you what your people were doing where, with what, and when,” what would that report look like? The answer(s) to this question will help determine your product evaluation criteria
- Ask your auditors the same question. Ask them “if you could walk in here tomorrow and receive one report in your hands containing everything you wanted to know, what would that report look like? What would it contain?”
- Choose a test or development copy of one of the three applications discussed above. Then try accessing user records by two or more of the agreed or supported methods. Be sure it is a development or test copy, so that there is no haggling over who owns what, or what level of “access” is appropriate. The point of this exercise is to just test data extraction and analysis. The results of this can be used as “sales and marketing” material for the more resistant stakeholders in your enterprise.
- Don’t underestimate the time/effort/complexity involved in connecting all of your Identity stores, databases, legacy systems, and custom applications with your IAM framework or complianceware tools. It is helpful to add a “complexity multiplier” to each resource when estimating integration time. We often take a baseline of the ‘easiest’ or most broadly supported target system, then add multipliers as point values. For example, baseline Microsoft SQL 2005 database integration at 1.0, then adding DB2 at 1.2 (may be more complex,) and Sybase at 1.5 (forms or adapters may be inadequate for your requirements,) etc. These are examples only, and not intended to be indicative of actual complexity - which will vary widely between organizations and chosen software tools.
For additional information on the topics above, please consult with your copy of Identity And Access Management (IAM) Success Tips: Volume 1. Don’t yet have a copy? Ordering is easy. Just click here or click the “Buy Now” button over to the left of this article.
Thoughts? What have you experienced? Other creative suggestions for closing up the “last mile?”
All the best, of Identity Management Success.
Corbin H. Links, President
Links Business Group LLC
©2003-2008 Links Business Group LLC. All rights reserved.
