July 31, 2017 By Jas Johal 3 min read

When was the last time you heard an identity governance and administration (IGA) success story? If you’re thinking “not in my organization,” you’re in good company. IGA projects have a reputation for being hard to complete, drawn out and costly. But why are they so difficult to get right?

Measuring the Business Value of IGA

Part of the issue is that IGA projects are not differentiated from other identity and access management (IAM) efforts. IAM technologies are implemented to support one or more business process improvements or compliance initiatives. Mature IAM technologies provide solid support to organizations that need the fundamentals to integrate traditional and new applications. As such, they are predominantly infrastructure technologies.

IGA is different. Many enterprises expect IGA to deliver business value, but they are finding that it is difficult to get right primarily due to a mismatch between the IAM program road map and business priorities.

Three Tips for Identity Governance Success

The problem usually begins when a business approaches IGA as a technology project when it’s really a business transformation program. When such an approach is taken, more problems usually follow, such as:

  • Failure to deliver value early and on an ongoing basis. This undermines the trust in the effectiveness of the IGA program and can cause stakeholders to divert budget and eliminate resources for the completion of these efforts.
  • Automating already broken processes. This bandage solution often fails to eliminate manual interventions and results in hard-to-understand customization.
  • Mismatch between the IGA road map and business needs. This leads to poor adoption of the technology by the lines of business, and may jeopardize future program funding and progress.

The business benefits of IGA adoption are indirect and not immediately visible to the organization. This is a key reason why companies often lose their will for business participation, which is key for IGA project success. As a result, many organizations today are asking security professionals the question: How do we regularly demonstrate business impact and value from IGA?

Here are our recommendations, starting with a three-step deployment planning model:

1. Understand the Business Requirements for IGA Strategy

Before you begin, work with stakeholders to understand business requirements and create a clear vision of the end state you’re working toward. Document dependencies and identify gaps to address before beginning an IGA project. A good identity governance vision maps stakeholder needs to objectives and priorities, resulting in a project’s road map. An IGA road map with business cases helps justify IAM program funding by demonstrating how governance objectives align with business objectives.

2. Start Small and Keep It Simple

To win business interest in your project, deliver high-value and low-risk functionality early to build trust. Evaluate risks, value, costs and dependencies for deployment elements. Use readily available, out-of-the-box IGA capabilities to deploy features fast and leave customization for later. Encourage business stakeholders to share their enthusiasm and support with users and peers.

3. Plan for Success and Get It Right With IGA Deployment Prioritization

Once you have successfully deployed basic IGA functionality, you should have the support and momentum necessary to broaden your implementation. IGA offers many capabilities to support identity life cycle capabilities, such as application onboarding, access request approval, access recertification, role/segregation of duties (SoD) management, advanced auditing and intelligence. At this stage, prioritize business needs when approaching the automation of processes.

Putting People and Business First

Identity governance and administration services from IBM focus on people and business process before technology. Our three modular service packages are available to procure separately or together, depending on your IAM program maturity and IGA needs:

  1. IGA Adoption assists with the prioritization of your IGA integrations, providing conceptual architecture and a detailed adoption road map.
  2. IGA Accelerated Deployment helps demonstrate IGA capabilities to deliver high-value and low-risk functionality early with foundational capabilities. It also integrates select in-scope business applications.
  3. IGA Advanced Integration uses IGA capabilities to organize deployment. It provides a detailed design for broader governance services enablement, including expanded integrations with custom development and operationalization of end-to-end IGA services.

View the infographic to learn more about building an effective IGA program

More from Identity & Access

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today