It is always enjoyable to read advice from those in the trenches of Identity management implementation.  As a recent guest blogger on the Identigral blog,  Tom Ebner outlined and explained ten best practice rules he learned while living the “Identity Management Lifestyle:”

• Rule #1. Understand the problem and the opportunity
• Rule #2. Assess the quality of the identity data
• Rule #3. Create a strategic technical vision
• Rule #4. Get (and keep) an executive sponsor
• Rule #5. Build a great team
• Rule #6. Add great partners to your team
• Rule #7. Create a strategic technical architecture
• Rule #8. Deliver something valuable to the business
• Rule #9. Manage your risk
• Rule #10. Understand and communicate “What does success look like?”

Thanks, Tom, for excellent advice.  May your continued work in this lifestyle earn you the yacht and Rolls Royce your colleague talked about!

(You’ll have to read Tom’s article to catch the significance of that last statement.)

This post is the fifth in a series of eleven posts I am writing about trends in the Identity Management industry.  

The use of roles for identity provisioning and audit compliance has seen growing acceptance in production systems.  Enterprises are getting more value in both operational efficiency and streamlining compliance efforts by leveraging business  roles.  Role management can support compliance efforts even if full automated provisioning is not in place. 

Experience has shown that using a fairly modest number of roles relative to the size of the user population is most effective, rather than engineering and trying to maintain a large number of roles to take care of all circumstances.  A blend of role- and rule-based provisioning appears to strike the right balance.

As roles are implemented, good governance methods are essential to oversee the entire role management life cycle, just as governance over the complete Identity management life cycle in needed.  The governance structure over both life cycles should be closely integrated.

Some companies are finding a broader use of roles than realized at first.  Roles may have been first engineered to drive role-based access control and compliance enforcement, but can also be used for such things are evaluating organization and infrastructure effectiveness.

Attribute-based access control (ABAC) is emerging as a possible alternative to role-based access control (RBAC), particularly for large, complex organizations such as government entities.  This has led some people to predict that ABAC will replace RBAC.  However, if we consider that roles are really a form of attributes attached to Identities, we could predict that the two methods will converge – with the best approach being a balance that leverages roles where appropriate, and attribute-driven rules where that approach makes sense.

Recommendations:

Consider questions such as the following:

1. Where can roles be leveraged to improve the effectiveness of your Identity provisioning and compliance system?
2. What is the right balance for your organization in the number of roles and the rules that complement the roles?
3. How can you effectively govern both the Identity life cycle and role life cycle in your organization?
4. Are there ways you can leverage the role infrastructure you have adopted in other ways besides RBAC and compliance?
5. Can emerging methods such as ABAC bring further efficiencies to your operation?

By the way, the stack of hats shown above served to represent different roles or personae a person may possess in a tongue-in-cheek blog post I posted earlier this year: Have a Token: ID Hats and Personae.   I liked Dave Kearn’s perceptive comment to that blog: “Good analogy Mark, but I’m afraid that those of us who understand the phrase ‘to wear different hats’ are getting grayer, plumper and more forgetful every day! People just don’t wear a good homburg, Stetson or Panama any more….”