RFP Toolkit: Stand out in the crowd
Identity management systems can help agencies meet security mandates
"He was tired of spelling out Michael dot Leavitt at state dot UT dot US," said Phillip Windley, then CIO for the state, now a computer science professor at the University of Utah. "We owned the domain Utah.gov, so we decided to give him and every other state employee a Utah.gov address."
However, making the change was anything but simple. Utah had to upgrade network directories at nearly every agency and create a metadirectory to synchronize their data. It also had to get consensus on a naming schema (i.e., first name, last name, etc).
"Getting everyone in a decentralized organization to agree on anything can be a challenge," Windley said.
Today, when government agencies implement identity management systems, security is more likely their primary concern. Homeland Security Presidential Directive-12 of August 2004 requires the federal government to adopt standard ways of securing physical access to buildings and logical access to information systems. Although not bound by HSPD-12, many state and local governments also are implementing an IDMS for added security and efficiencies.
"Our first reason for adopting identity management was to tighten up security," said Norman Jacknis, CIO for New York's Westchester County, which is rolling out IBM Tivoli's identity management suite to more than 6,000 county employees. "We also realized we're wasting enormous resources by having every software developer build their own ID structure."
An IDMS can reduce the number of passwords an employee must remember, and automate password recovery, slashing help-desk costs. It also can simplify provisioning for new hires or terminations, letting IT or human resources departments control access to network resources with a few keystrokes.
Rules First
Before rolling out an IDMS, you must define roles and set policies for every contractor and employee in an agency. This lets people access some systems but not others, depending on their roles.
Some IDMS are more flexible than others, said Ellen Libenson, vice president of product management for Symark, an enterprise IDMS vendor in Agoura Hills, Calif. Ensure that an IDMS lets the agency define roles based on factors such as an employee's title, department and security clearance, and manage resources at a level granular enough to, for example, deny access to certain databases after normal working hours.
The ability to manage many roles is also important for large agencies. The United Kingdom's Ministry of Defence has 400,000 employees but more than 600,000 roles, said Torgeir Pedersen, senior architect for Trondheim, Norway-based MaXware.
A basic IDMS authenticates users, manages access to resources and helps users better manage password security. A better IDMS provides a "three-strikes" capability, locking users out after a specified number of failed login attempts, Symark's Libenson said. It also would capture users' keystrokes during login to help spot potential break-ins.
Another key driver for this IDMS capability is the Sarbanes-Oxley Act, which requires some agencies to maintain audit trails of employee access to information systems. But most identity management solutions stop logging the moment you gain access, said Toby Weir-Jones, director of product management for Counterpane Internet Security in Chantilly, Va.
"The system will know when and where you logged in and that you logged out seven minutes later, but it won't know what you did in between," he said. Because most identity management systems aren't designed to track user activity inside applications, they should be able to integrate with third-party tools that do, Weir-Jones said.
For sensitive data and strong authentication, Libenson said, "you'll need a system that integrates easily with tokens, smart cards or biometrics."
For federal agencies, an IDMS must integrate with smart cards based on Federal Information Processing Standard 201 for personal identity verification. FIPS-201-compliant cards store digital fingerprint data and support public-key infrastructure credentials for user authentication.
Integration Challenges
Because IDMS touch every major system in an organization, they are a challenging integration project. It may take months, even years, to roll out an IDMS at large agencies with diverse platforms.
Nearly all core enterprise applications, from e-mail to human resources to accounting, have their own user directories. An enterprisewide IDMS must be able to communicate with directories in each application and synchronize the data, even if the account is listed as "George W. Bush" in the accounting application, "Bush, George W" in human resources, and "potus@white
house.gov" in e-mail.
"A key requirement of any identity management system is how effectively it can connect to and use data held by multiple systems," said Chris Zannetos, CEO of Framingham, Mass.-based Courion Corp.
It's necessary to inventory all systems that hold identity data to evaluate whether an IDMS gives an interface to each one, Counterpane's Weir-Jones said. "If they don't, you'll have to build them yourself, which can be expensive. And when the tool changes, you have to upgrade the interface," he said.
Some IDMS packages offer tools to build connectors between applications, but they may need tweaking to work with some apps.
"One of the biggest stumbling blocks is interoperability with other agencies," Weir-Jones said. A "federated" identity management scheme lets employees use the same log in and password on any federal network. But as federation standards are still in flux, an IDMS must support multiple standards from the Liberty Alliance, IBM and Microsoft's Web Services architecture, and the open-source Security Assertion Markup Language 2.0.
Chart the processes
The biggest challenges to building an IDMS may not be technological.
"This isn't a solution you're going to buy from someone as much as it is a cultural change in your organization," said the University of Utah's Windley. "How do you assess risk for the various components of your information infrastructure? What authentication guarantees can you pass on to the underlying system? The risk assessment has to be driven by business leaders, not IT security professionals."
Look at the problem from a business or organizational point of view, said Jon Wall, principal technology specialist for Microsoft Federal.
"Figure out what triggers what," he said. "Walk through two scenarios from beginning to end: hiring an employee and terminating one. Chart every system that process will touch and in what order, and do it from an internal agency perspective, not a technology perspective. We can bend software to do a lot of stuff for you, but identity management is really driven by business practices."
Successfully implementing an IDMS requires a slow, steady rollout and lots of patience, Westchester County's Jacknis said.
"We've had so many surprises with identity management products," he said, "I can only say that I hope to be done [with our rollout] by the end of 2006."
Identity Management Systems
CA Inc.
Islandia, N.Y.
(800) 225-5224
www.ca.com
Management Suite
Framingham, Mass.
(866) 268-7466
www.courion.com
Palo Alto, Calif.
(650) 857-1501
www.hp.com
Identity
Management(s)
Armonk, N.Y.
(800) 426-4968
www.ibm.com
Manager, Tivoli
Access Manager
Trondheim, Norway
(732) 409-5000
www.maxware.com
Redmond, Wash.
(425) 882-8080
www.microsoft.com
Integration Server 2003, Enterprise
Edition
Waltham, Mass.
(800) 529-3400
www.novell.com
Manager 2
Redwood Shores, Calif.
(650) 506-7000
www.oracle.com
Management
Santa Clara, Calif.
(800) 232-4671
www.sun.com
Identity Manager
Agoura Hills, Calif.
(800) 234-9072
www.symark.com
PowerPassword User Management Edition,
PowerKeeper
Technology journalist Dan Tynan is author of "Computer Privacy Annoyances" (O'Reilly Media, 2005).
NEXT STORY: Army re-ups L-3 division for tactical trainers