It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM).

Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be achieved after successfully rolling out an identity strategy. They all talk about reduction in friction, improving users’ perception of the value of the IAM platform. But how do you measure the business enablement of IAM? Is the cost of a Service Desk call really the $75? And how do you measure customer satisfaction during an authentication journey?

IAM programs tend to penetrate the entire organization resulting in many business-side stakeholders bringing disparate requirements to the table. Talking to those stakeholders in technical terms is a sure-fire way of getting them to switch off and disengage. Statements like “OIDC SSO followed by FIDO2 auth will revolutionize your user journeys” will be returned with a blank expression (at best). A re-framing of the message such as “re-use of existing credentials in order to reduce the footprint of passwords combined with a simple fingerprint swipe will remove user frustration and improve your security standpoint” may be more meaningful. But can the value of these capabilities be measured? Yes, they can.

What Should You Measure?

Like everything in life, doing a good job is not enough. The evidence of your doing a good job has to be visible, tangible. Capturing the reduction in number of password reset calls received by the Help Desk is a good start, but there are other simple and powerful metrics for measuring the value of an IAM platform, including:

  • Timeliness of identity life-cycle activities (particularly Joiner & Leaver actions)
  • Speed of onboarding applications into both IGA and AM integration patterns
  • Number of successful automated provisioning/deprovisioning actions based on policy rather than manual requests
  • Certification/Attestation campaign effectiveness including speed of reviewer responses, number of deprovisioning actions executed, and the overall reduction in security exposure as a result of entitlements being removed
  • Number of failed registration attempts (or put more positively, the increased effectiveness of onboarding and registering new users)
  • The overall number of entitlements assigned before and after rollout of the IAM service (with the hope that there is a reduction in entitlement drag because policies, mover processes, and certification campaigns are effective)
  • Risks identified, categorized by mitigating controls assigned, and the speed of remediation

These metrics, combined with basic measurements, can provide real insight into the effectiveness of the IAM platform and can provide a visual representation that will be meaningful to all stakeholders.

Note that there are other basic measurements for providing both IAM scope and output, including (A) total number of accounts, (B) accounts split by owner type, (C) accounts split by active/inactive state, (D) account dormancy levels, (E) logins, (F) logoffs, (G) number of visits, (H) number of pages visited per session, and (I) number of journey abandonments, etc.

And of course, there is always room for non-tangible measurements such as user satisfaction across the various user communities, whether that is end-user, stakeholder, administrator, or application developer.

Know What You’ll Measure, Before You Invest

Modernizing and consolidating IAM platforms doesn’t come cheap (although it’s definitely cheaper than it used to be). The ROI might be quantifiable for certain user actions, but the likelihood is that the benefit of any IAM platform may be more difficult to quantify in monetary terms.

Determining the measurements that will be critical for your business and your stakeholders should be done prior to any investment in technology — how else will you know that you have achieved your aims?

Learn more about IBM Security Verify here.

More from Application Security

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

Twitter is the New Poster Child for Failing at Compliance

All companies have to comply with privacy and security laws. They must also comply with any settlements or edicts imposed by regulatory agencies of the U.S. government. But Twitter now finds itself in a precarious position and appears to be failing to take its compliance obligations seriously. The case is a “teachable moment” for all organizations, public and private. The Musk Factor Technology visionary and Silicon Valley founder and CEO, Elon Musk, bought social network Twitter in October for $44…