The 57th Edition of the Identity Jedi Newsletter

People, Process, Technology

I often bring up this phrase whenever I talk to organizations about IAM. People, Process, Technology. Those three things in that order have such significant factors in the success of an IAM program. This article from the Ramp engineering team illustrates this to a T.

I loved the approach they outlined in how they solved their problem. So I wanted to break it down for everyone:

They start with people. In this case, it’s their engineers. What’s their primary function, and how do they currently operate? What allows them to do their job effectively? What causes friction?

Asking these questions allows you to understand the people's needs. It also leads you directly to the next part, which is process.

How do they do it today? Are there issues with the current process? Here’s how they broke this down at Ramp

So they understood their people and how they worked. What their current process was, and what issues had grown. Then they applied security principles to the current process. ( Because Identity is security, right?) This allowed them to find objectives that they needed to meet.

Next, BEFORE CODING A SINGLE THING OR BUYING A SINGLE PRODUCT. ( Ok, to be fair, I don’t know if they did this, but for the sake of this post, I’m going to assume they did to make a point)

They designed their ideal system. They took what they knew about their people and processes combined that with the things they wanted to fix, and applied security principles. This gave them a direction for where they wanted to go.

And THEN

They directed their ideal system into the components they would need to make that happen. Check out how they describe the process.

Chef’s kiss.

I LOVE this approach and thought process. Being successful in an IAM program is about more than just tech, and requirements. People have to buy in, process has to be designed. None of this comes with contract you sign with the vendor, or even the contract you sign with the consultant company to come do this for you. It HAS TO START with you and your organization. Now those other actors can and will help, but that can’t do it all for you. It’s like coaching. You can tell a player everything in the world, give them all the practice sessions, and all the information, but when it comes down to it, the player has to execute. The coach can’t do it for them.

Finally once you’ve done this prep work, you pick the technology that best aligns with your process. You know exactly where you need it to fit, and you know what to look for when purchasing. Check out the full article from Ramp to read about their process. Definitely worth checking out.

Make Identity Simple Again?

So CISA and NSA issue a report that says vendors need to do a better job of explaining technology to customers, and make it less confusing when describing features and services.

Now why does that sound familiar? I could have sworn I saw the other day, somebody that said something very similar. That the industry needed to do a better job of explaining what things where, and not using the same product marketing pitches over, and over, and over again.

For the life of me, I can’t think of who that was 😉 

All jokes aside, good report from the CISA/NSA folks, we do need to do a better job of describing the areas of this industry. We should be focused on developing standards and vocabulary that cleary define the lines between the interesecting disciplines.

We’ve made some progress over at IDPRO with the Body of Knowledge and CIDPRO exam, but there’s always more work to be done. I encourage you to get involved. Hope on a standards body, write an article for the Body of Knowledge, etc. Together we can change it.

Plus, we like beer and happy hours in the identity community so the more you’re involved the more happy hours you’ll know about. And who doesn’t love that?

Shared Responsibility

A word from our friends at Acsence

Let’s talk about the Shared Responsibility Model. (SRM) If you’re building architecture for cloud-based applications it’s a term you’re probably all too familiar with, and if not, its definitely something you should. Here’s a blog from our friends over at Acsense that breaks it down.