Identity & Access Management (IAM) and Identity Governance & Administration (IGA) are crucial for organizations, but current implementations often fall short. Major vendors like Okta, Auth0, Microsoft, Sailpoint, and CyberArk have been at the forefront of IAM transformation for over two decades. Yet, a Sailpoint survey last year revealed that 44% of respondents are still at the beginning of their identity journeys, lacking foundational governance and holistic visibility. The Problem: A Never-Ending Challenge DayBlink Consulting has been involved in many implementations, updates, rebuilds, and replacements of these technologies, particularly over the past 5 years.  Across many consulting clients,w we have observed a significant divergence in how companies approach IAM efforts and the associated success rates. Authentication (e.g., SSO and provisioning) projects often reach completion, while Authorization projects seem never-ending. And therein lies the rub – Identity & Access Management as a whole has become a required operational capability of any enterprise and not a one-and-done effort. The fundamental issue is that governance is a continuous battle, not a one-time project. Here are the key root causes: Complexity of Authorization: The process of Authorization is inherently more complex than Authentication. It requires detailed definitions of roles and permissions, ongoing data quality management, and continuous adaptation to changing business requirements. Unlike Authentication, which can be relatively straightforward and can be accounted for as a one-time capital expenditure, Authorization requires continuous operational effort and investment. This complexity often leads to delays and incomplete projects. The “who needs access” conversation is often far clearer and vastly shorter than the “what rights should that individual have” conversation. Complexity of Authorization: Even within the access rights conversation, coarse-grained access control is often suitable for automation, whereas fine-grained access control usually requires manual intervention.  Requirements regarding Authentication remain far more static than those around authorization. Talent Shortage and Expertise Gap: There is a significant shortage of qualified and experienced Identity engineers. This talent gap hampers the ability to effectively implement and manage Authorization systems, leading to prolonged projects and increased costs. The skills required for managing Authorization are more specialized and scarce compared to those needed for Authentication, further exacerbating the issue. Talent Shortage and Expertise Gap: Data Quality and Governance: Authorization demands cleaner and more accurate data than Authentication. Managing permissions and groups effectively requires high-quality data, which many organizations struggle with. The transition from legacy systems to modern identity platforms involves complex data migration and integration efforts. Poor data quality can lead to security risks and operational inefficiencies. Data Quality and Governance: Sailpoint itself claims that “even mature companies cover less than 70% of the identities in their organization through foundational governance capabilities (with particular gaps around 3rd party identities, machine identities, and data).” Managing entitlements becomes increasingly difficult each year, necessitating a significant amount of manual governance effort from the identity teams. Proposed Solutions: Achieving Better Outcomes Despite the challenges, Authorization efforts are both worthwhile and necessary. Here are key steps to improve speed and success: Automate and Streamline Lifecycle Management (including Joiner/Mover/Leaver) Processes: Clearly define processes and automate as much as possible across provisioning, deprovisioning, JML, access campaigns, etc. This reduces manual effort and minimizes errors. Implementing automation in the joiner/mover/leaver processes ensures consistent and timely updates to identity and access management systems. Automate and Streamline Lifecycle Management (including Joiner/Mover/Leaver) Processes: Enhance Data Quality and Integration: Invest in data cleansing and governance initiatives to ensure high-quality data for Authorization processes. Ensure the authorization platform is properly connected to relevant HRIS systems and other authoritative sources. This integration enables accurate and up-to-date identity information. Enhance Data Quality and Integration: Develop and Enforce Robust Access Control Models: Build and enforce Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Policy-Based Access Control (PBAC) models across the organization. Regularly review and update access control policies to adapt to changing business needs and security requirements.  Focus, wherever possible, on the highest value applications and processes before burning resources on the long tail. Develop and Enforce Robust Access Control Models: A Light at the End of the Tunnel IAM and IGA are essential but complex fields requiring continuous effort and adaptation. The solutions aren’t easy and often require dedicated, specialized team members, but they are already well-established approaches to risk reduction. By addressing the root causes of Authorization challenges and implementing these solutions, organizations can achieve better outcomes and more effectively manage identity governance.

Attacking Github – Why You Need a Better Threat Model

GenAI - Soon to Be Great for Automating Dumb Attacks

Read My Stories

Partner

Too Long; Didn't Read

Download free Tech Leaders Productivity Report!

Identity Governance and Administration Projects Are Never Done – But Can Get Much Easier

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

Attacking Github – Why You Need a Better Threat Model

Why Dockerizing Applications is the Key to Building Scalable Software

How to Install WordPress on Linux Server: A Step by Step Guide

How To Link a Third-Party Hosted Website using Cloudflare Services

How to Simplify Cron Monitoring With a Simple Bash Trick

Attacking Github – Why You Need a Better Threat Model

Why Dockerizing Applications is the Key to Building Scalable Software

How to Install WordPress on Linux Server: A Step by Step Guide

How To Link a Third-Party Hosted Website using Cloudflare Services

How to Simplify Cron Monitoring With a Simple Bash Trick

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps