The future of SAP GRC

There has been quite a bit of  discussion about the potential futures of SAP IDM and SAP GRC. SAP has just started a survey so that they can get customer input. I would encourage all customers using or considering these products to take the poll.

I've worked with the integration between the two products several times now, and I can honestly say that I have never achieved the results that I wanted. As I've thought about the issues that have kept me from getting what I (and of course, my clients) want, it all seems to come down to the architecture.

The way SAP would have it, GRC is the brains, VDS the nervous system, and IDM is the muscle.  IDM workflow does all the work using the various frameworks (Provisioning, Exchange, GRC, Lotus Notes, etc.) while it checks with GRC via VDS to tell it what to do.

The problem as I see it is that there are:

• Too many moving parts -  IDM, VDS via WebServices to GRC, back to IDM
• Not enough information that passes back from GRC - We don't see why things are rejected and it's not clear what is happening.
• A lack of ways that conflicts can be addressed from IDM - This means that the "Security Desk" needs to get involved so they can fix the issue.

So how should this be addressed?  I think through either a tighter integration that is more direct and thicker, that is one where more information is passed, so that IDM becomes the "face" of GRC allowing for mitigation and remediation activities.  However I do not know that the current SAP architecture really supports this. therefore I think it makes more sense for IDM to "consume" GRC and make the GRC functionality part of IDM.

IDM already has a very basic concept of Segregation of Duties through Role Mutual Exclusion functionality.  Having logic that determines what should be "Mutually Excluded" from GRC type functionality makes sense.

However as SAP Roles map to IDM Privileges it would also be necessary for this concept to be extended to the IDM Privilege level.

Finally this new functionality would need to include the ability to implement periodic entitlement reviews (sometimes referred to as attestation or certification) Since in a typical SAP Landscape implementation IDM is connected to HCM with Manager and Organizational properties already defined, IDM is in an excellent position to use it's Presentation Layer, Notifications and Identity Store Database to support this.

This just my opinion and I have registered it via the survey posted above.  Go register yours!

Intelligent IDM

Just read a great blog post (Thanks, Dave Kearns for posting in your newsletter) that I think anyone involved in Identity Management Architecture / Design / Management should be aware of.

Earl Perkins from Gartner Group has written a short piece on Business Intelligence information that can be obtained from an IDM solution.

We've spoken for years about making IDM a part of compliance and security, and certainly tools such as SailPoint Identity IQ help provide that data, but I think that all applications, particularly provisioning applications that are long on information and short on reporting and logging could do more to share this information not only with central BI repositories. Certainly there is information that is of interest to a BI warehouse. It would be interesting to see what such a model would look like.

I look forward to seeing what Earl and others develop in this concept.

The Myth and Reality of ROI

Ultimately IT departments (and their clients) are concerned with a reduction in complexity, whether we are considering Identity Management, GRC, Information Security or any other initiative. This can measured in a number of ways:

• Lowered TCO
• Reduced Help Desk call counts
• Increased usage of existing tools

No matter what metric is used, this is ultimately measured as Return on Investment, yes the dreaded ROI. Investment in software tools is always weighed against what this potential ROI can offer. Most firms specializing in Enterprise Software are more than happy to offer ROI calculator to prove the value of their offerings.

Customers and their Business Analysts consistently find that the ROI claims do not hold water. There are a couple of reasons for this, in my estimation:

1. The ROI Calculator is defined too narrowly – Only a few parameters are highlighted in the calculator, and is therefore incomplete. For example, there’s no consideration for hardware costs, data costs, High Availability considerations, etc.
2. The ROI Calculator is defined too broadly – The only way the numbers work is when they are applied too broadly. For instance, when a tool is needed for a workgroup or single location, but total enterprise numbers are the only ones that make it work.

Does this mean that the companies sponsoring the ROI are crooks and liars? Or those potential customers can’t do basic math? No, not at all. Just that everyone involved needs to be aware of how we plan to measure ROI. Vendors need to consider what the customer needs, while customers need to make sure that the offered metrics in the ROI calculator actually affect their organization.

When I first started outlining this entry is was more about technology and how the reduction in complexity would translate into required services whether they were based in the local data center or the cloud, however a discussion of the ROI benefits. The takeaway here is that once again business analysis is what drives the discussion.

From the technology side, the problem is fairly straight forward; do you use a simple monitoring solution that reacts to inform the client’s datacenter or a more modern intelligent system as advocated by Adrian Rodriguez and the team over at Likeminds? Along with a discussion of what the Enterprise’s requirements are, it will also depend on how these intelligent systems are evolving. It will be fun to watch, that’s for sure!

SELECTing from the Identity Store

Now I don't know about you, but I've always had some issues with looking up entries in the NetWeaver Identity Management Identity Store. I know there are built in scripting functions like uIS_Get, uIS_GetValue, uIS_sGet, uIS_sGetValue, etc, but they've just never worked well for me. So to compensate, I've developed my own methodology for searching and retrieving items from the Identity Store.

The basic use case is this: The Identity Management solution needs to do a look up between an incoming data feed and the Identity store. The basic idea is that if the value from the feed and the value from the Identity Store match then the entries match and updating/provisioning can proceed as directed by workflow. I'm sure you can imagine other use cases, looking up managers, phone numbers, and other frequently used attributes.

The feed processing job will use a script to evaluate the match. Most likely it will pass MSKEYVALUE but could also use some other unique attribute in the feed.

The first thing that is needed is to determine the MSKEY, if any, for the entry to be worked with. To this end, I created the following query which will be implemented by NW IDM's uSelect function, which can be used in a Provisioning Job or Reconciliation task. Following best practices for NetWeaver Identity Manager, I am using the JAVA engine and therefore JavaScript in this example.

//Create an uppercase version of Par for checking against the SEARCHVALUE
uPar = Par.toUpperCase();

MSKEYQuery = "select mskey from mxiv_sentries where (searchvalue = '" + uPar + "')";
MSKEYResult = UserFunc.uSelect(MSKEYQuery);

You'll notice one of the first things we need to do is make sure we access the searchvalue correctly. Elements in this column always have their text elements stored in Uppercase, so we need to make sure that for the purposes of searching, we have an uppercase value handy. The results of this query are stored in a variable called MSKEYResult. Now that this information is available, we can now search for needed values related to this entry.

EmployeeNumQuery = "select avalue from mxiv_sentries where (mskey=" + MSKEYResult + ") and (AttrName='HR_EMPNUM)";
EmployeeNumResult = UserFunc.uSelect(EmployeeNumQuery );

With this query I can now look for a specific attribute value for a specific user and store it in a variable. At this point we should plan on returning a more nicely formatted version of the attribute so we will return aValue rather than SearchValue which is the value for the attribute as it entered into and subsequently processed by NW IDM for use in screen output, reports, emails, etc. In this example we are returning the user's Employee number.

This process might also include another query to do a count of returned Employee Numbers to protect against potential "dirty data" entries (multiple identities for the user or to many users with the same name.) If this scenario occurs more detailed searching, involving more attributes might be needed.

Note: I don't necessarily claim that this is the best or most efficient methodology for accessing this information. All I know is that it works for me and the way that I think / process information. If anyone has ideas on making this better or properly using the embedded functions listed above, I'd love to hear about it.

IdM and the Economy

I observed two comments on the recent issues in the economy and its relationship to IT initiatives.

The first was from FOX Business which I was watching during lunch today. As they were reviewing the tech stocks one of the panel said something along the lines of, 'with diminished income, companies won'y be buying a new PC for your desk this year' (paraphrased)

When will the business folks get it through their heads that there is more to IT than the computer on their desks! I mean really, even more than email, firewalls and antivirus.

IT provides some essential services for the company that can provide a definite return, either in a direct return on investment or by avoiding fines and penalties through maintaining compliance and security standards.

One person that seems to get this is Ash Motiwala. In his blog entry today, Selling Identity in an Economic Downturn, Ash hits on this directly. It's not that you are spending money, but that you are achieving ROI and Compliance initiatives.

Let us look at ROI, when we don't have to have Network, Database and Application administrators creating and modifying accounts, they can be focusing their attention on making sure their areas of responsibility are working properly. When workflows are processed automatically (save approval actions) There's no need to have admins creating badges, modifying building access, and asking what kind of equipment each employee is supposed to have. Let all of these people do what they are supposed to be doing.

Compliance is another area. Let's face it, compliance is getting more complicated and sprouting up everywhere. Government realizes that charging fines and other penalties are a great way to make money, so there's a lot of attention here. In a time of data loss and identity theft showing adherence to Compliance and other areas of Risk Management are a selling point from a company to its customers, making Identity Management initiatives even more important than ever.

Value Adding Security to the ROI of Identity Management

I just had the pleasure of reading this fantastic article by my friend and fellow blogger, Matt Flynn.

Matt has some fascinating thoughts on the future of provisioning where he submits that the future of provisioning must include detailed rights management and auditing. Having this infomation increases the Return on Investment (ROI) of a provisioning solution since increased rights management reduces security risk and therefore increases ROI.

I can't say that I disagree with these thoughts. The original goals of Identity Management (which Matt also covers in his article) focused on data accuracy and authoritative stores resulting in increased efficiencies and reduced support costs. Reducing security audit risks results in reduced fines and never having to spend money in cleaning up after a security breach.

It will be interesting to see how the Identity Management vendors and solutions react to these thoughts, but I think we'll see some quickly!