Why firms need to harness identity management before it spirals into an identity crisis

Digital transformation is at the top of every organization’s agenda today. But while it is easy to make bold, forward-looking plans on paper, the reality of implementing digitalization can be slow and frustrating work. Many organizations are deeply entrenched in legacy infrastructure that has formed the basis of their operations for decades. Unpacking all these processes to either move them entirely to the cloud or create a hybrid setup involves a vast number of moving parts.

Digital identity is one of the most essential elements of this process but is an area that is often overlooked as firms focus on specific hardware and software issues. Most organizations have identity data scattered across multiple locations such as LDAP, AD, SQL, and web services, creating a fragmented infrastructure that is very hard to manage.

An incomplete identity management strategy has a serious impact on the success of digital transformation, as well as increasing cyber risk exposure. So, how can organizations take control of their identity data and use it to fuel, rather than hinder, digital transformation efforts?

How poor identity management is holding back progress

Digital transformation is all about driving efficiency, creating new processes that can work faster and deliver better results, while also using less resources. Identity data plays a fundamental role in this, and achieving impactful results is all but impossible without effective identity management.

The key issue is having a clear and accurate picture of how the company’s identities relate to its workers. Individuals in large organizations will often own dozens of different identities spread across multiple applications and systems, with no system in place to easily connect all the dots. Establishing whether that Peter Smith on Salesforce is the same as the one on SharePoint is usually a manual process. Scale that up to a global organization with thousands of employees, and it’s a huge task. Add in the complexity of digital transformation, and it’s Herculean.

As a result, many firms quickly lose track of which identities belong to which users, resulting in many redundant, unmanaged, and overprovisioned accounts that create a massive attack surface for bad actors. Abandoned accounts are ripe for takeover, and users with needlessly high access privileges can be exploited to terrible effect.

Alongside the elevated cyber risk, this situation is also highly inefficient and wasteful, causing digital transformation to take longer and deliver less impactful results. Firms may be paying for dozens, perhaps hundreds of accounts they no longer need, as well as wasting time and resources in transitioning unused profiles over to new digital systems.

If we take a use case as an example, these challenges are all multiplied when it comes to M&A activity. 2021 was a record year for M&A, and organizations around the world are now wrestling with merging disparate IT networks and integrating tens of thousands of user identities from completely different systems. Most of those firms will also be trying to advance their digitalization plans at the same time.

Attempting to progress with digital transformation without getting identity under control is like trying to build a house on shifting sands. But if identity data management is so fundamental to progress, why haven’t more businesses taken charge of it by now?

Why are businesses reluctant to tackle identity?

Getting to grips with identity is extremely time and resource intensive if done manually. For large organizations, it can be an onerous multi-year project just to discover, categorize and link the existing accounts across countless identity stores. Firms will often avoid the task indefinitely as achieving a single source of truth for identity appears to be impossible.

Getting this done in any kind of realistic time frame means automation, but it can still be challenging to find the right tools for the job. It’s easy to fall into using a large, overarching system that folds identity management into several other features. However, such solutions often need substantial customization to fit a firm’s specific needs, which means they can still be time consuming, expensive, and ultimately incomplete solutions.

Even once all the digital identities within the enterprise have been discovered, delivering effective identity controls can be incredibly challenging when dealing with a hybrid of new and legacy infrastructure. Controls need to be universal across all aspects of the IT environment and should not disrupt existing processes.

And so firms will often delay or sidestep the issue for as long as they can. They will slap a metaphorical “band-aid” over any pain points caused by inefficiency and frustration. Only when the issue goes from “band-aid” to “hospital trip” will they be forced into action.

This is common across most areas of IT investment. For example, I once worked with a financial company that was still using a mainframe as its core infrastructure. Rather than risk the expense and disruption of switching over to more modern technology, they reskinned it with an interface layer while keeping the legacy tech intact.

However, when it comes to identity, things can reach “hospital trip” levels of pain very quickly indeed. A cyber-attack can escalate identity issues into an identity crisis in a matter of hours. Even without the single focus of a breach, poor identity control will continue to hold back digital transformation efforts with inefficiency and increased costs.

How a single source of identity data moves digital transformation forward

Getting digital identity under control requires a single, unified source for all identity data regardless of origination, a concept known as Identity Data Fabric. Firms need a single pane of visibility for all identities to highlight redundancies, ghost accounts, and profiles with unnecessarily high privileges.

An Identity Data Fabric can help to overcome the key challenges created by fractured digital identities. Organizations can realize powerful cost savings by cutting down redundant accounts and licenses. Removing identity management as a bottleneck to digital transformation also speeds up digital transformation and project ROI. Further, the firm’s risk exposure is significantly reduced as thousands of potential attack paths are closed off.

Getting to this point requires a highly automated approach that can efficiently discover and collect identities across both on-premises legacy systems and in the cloud. Similar identities are mapped to an abstraction layer and then unified to create a single profile. This ensures that every digital identity is clearly linked to an individual employee.

Crucially, this process must happen at the data layer rather than the application layer. This ensures compatibility across the diverse range of systems in the IT estate, while also avoiding interfering with any existing processes. Working at the data layer also means that the single point of control can extend across multiple organizations with different IT systems, such as our earlier M&A use case.

With their digital identities under control, firms will be able to adapt and integrate new systems as part of their digital transformation without getting bogged down by inefficient, disjointed processes. Further, they’ll be free to grow and explore bold new digital strategies without worrying about threat actors swooping in to exploit old and overlooked accounts.

Source: https://www.helpnetsecurity.com/2022/07/25/harness-identity-management/