Manage Learn to apply best practices and optimize your operations.

What should an internal support model for identity management look like?

In this Q&A, Joel Dubin discusses how to create an internal support model for enterprise access management.

My company purchased a full suite of identity management (IDM) products from a major vendor. Once it's built, what should my internal support model look like? I want to plan for staffing. The product suite will serve as the trusted source to provision to Active Directory and home-grown Web applications.
An internal support model for this project should be based on two things: the size of the company, meaning the number of users, and the type of access required by the applications using the new identity management (IDM) system. Generally, access management should be handled by a dedicated team that is part of the IT security department. But if that's not possible, there are other options.

The size of a company will determine the number of people needed, and the type of access will determine how to distribute staff for various provisioning functions.

For example, a small company that has a limited IT staff but no dedicated IT security group will have to make due with its existing IT department. In many smaller and midmarket companies, the IT staff handles everything -- managing the network, repairing hardware and workstations and setting up new users -- and that usually means issuing user IDs and passwords.

But for a larger company, particularly a global organization with far-flung offices around the globe, the internal support model has to be a bit more structured. Even if a company is only domestic but has many offices around the country, a dedicated access management group is still needed, preferably within the IT security department, if there is one.

Why the IT security department? Because access management is an IT security function. If there isn't a dedicated IT security team in place, then it should be handled by whomever sets up new users and maintains existing ones, usually part of a desktop or hardware group.

Functionally, If the company is big enough, the access management team should have its own manager or director who reports directly to the chief information security officer (CISO). This way someone at the director level or higher can coordinate all access management activities and make sure the access management department complies with the company's IT security policy.

In addition, compliance with regulations such as SOX, HIPAA and PCI require accounting for users and logging of their access to corporate systems. Establishing a senior management team to oversee access management makes it easier to assemble these reports for executives.

The type of access required by applications will govern how duties are split up within the team. If a corporation has a number of different applications, each requiring their own unique user IDs and passwords, the team may have to be split by application. There might be team members specializing in only Lotus Notes or Outlook access, another team for mainframe access and yet another for desktop and workstation access. But again, this is driven by the size and complexity of an organization.

If the company occasionally handles large projects, or it just acquired another company and needs to provision thousands of users at once, for example, it may makes sense to have a special projects team, if the staff resources are available.

As for daily operation, access provisioning is one of those never ending headaches in IT security. Staff will need to be available 24x7 to handle requests and the inevitable password resets. Companies with offshore locations may want to spread the work around the globe to achieve availability in every time zone where they operate.

Finally, establish clear access management procedures for support. Have the team accessible via a ticket system through the help desk or through a series of rotating pagers. All tickets and access management requests should be logged, so that malicious access can be tracked. Make sure someone is available at all times -- even in the middle of the night -- and has a backup. The last thing you want is to have employees calling or paging individual members of the team all the time for special favors. That's a prescription for chaos.

For more information

  • In this tip, learn the key access management issues of 2008.
  • Security pro Joel Dubin reviews essential components of an access management strategy and reveals how to deliver the plan to executives.
  • This was last published in February 2008

    Dig Deeper on Active Directory security

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    Start the conversation

    Send me notifications when other members comment.

    Please create a username to comment.