Why do organizations continue to struggle with entitlement risk modeling? It boils down to risk being aligned to roles and role-based access. The irony is that roles were never intended to be risk models. They were once low-hanging fruit, a logical way to provide an early means of grouping users to entitlements and later associating risk to such groupings.

The Problem With Role-Based Risk Modeling

Let’s briefly step back and distinguish the difference between groups and roles. Groups are typically bundles of individuals or entitlements that can be managed together within a single system, application or common system framework. Roles extended such groupings can span across both common and dissimilar enterprise systems and applications. The purpose of roles and groups was once to boost efficiency in managing entitlements and improve oversight of common members. Somewhere along the line, they became common tools for risk modeling.

Ultimately, security teams must determine whether each entitlement is in conflict, toxic or nontoxic, to another entitlement. This would be a tall order. The unfortunate problem with using roles for risk modeling is that each time an additional entitlement is added or removed from a role, the enterprise is forced to evaluate whether a new risk has been introduced.

To further complicate things, roles frequently contain multiple entitlements and even subroles with many contents. The role contents must constantly be evaluated for direct or indirect conflicts with business rules, policies and regulations that determine requirements for segregation of duties (SOD). Roles will, of course, be modified and consolidated as a common practice, and role contents will be added and removed.

The maintenance required to constantly evaluate and mitigate potential SOD risks each time a role is modified with a new or removed entitlement is impossible to effectively manage. It’s no wonder that organizations rarely achieve maturity in their risk models when they are based upon roles. The constant nature of role maintenance totally contradicts any risk maturity when specifically aligned to roles.

A Smarter Approach to Risk Modeling

A more effective approach is to separate risk models from roles — in other words, just let roles be roles. By aligning risk to static business activities, the roles can remain dynamic without disrupting risk models and resume their intended purpose of driving efficiencies in provisioning, user management and recertifications/attestations.

Business activities that largely remain unchanged are best defined by the lines of business (LOBs) or auditors, and they are easily modeled from common business process management frameworks. In fact, there is an open standard model of industry-specific business processes and even a generic cross-industry model available from an open community led by the American Productivity and Quality Center (APQC). The APQC community refers to these standard models as process classification frameworks (PCFs). Most business process management solutions leverage the open standard APQC PCFs and LOBs are usually very familiar with industry-specific PCF models. LOBs and auditors commonly use these frameworks in business process management, benchmarking operations and auditing.

At this point in time, only IBM Security Identity and Access Governance can successfully separate risk modeling from past role management, embrace the APQC PCF model and accommodate an organization’s own business activities. The solution was designed from the ground up to leverage this more effective business activity risk modeling approach. This allows security professionals to use roles the way they were originally intended instead of introducing inefficiencies into the risk management and modeling strategies.

Read the white paper: How Identity Governance became a key compliance and risk control