Copyright
Publisher: Steven Elliot
Editorial Project Manager: Benjamin Rearick
Project Manager: Malathi Samayan
Designer: Mark Rogers
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
Copyright 2014 Ernst & Young, LLP. Published by Elsevier Inc. All rights reserved
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publishers permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described here in. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Osmanoglu, Ertem.
Identity and Access Management: Business Performance Through Connected Intelligence/Ertem Osmanoglu.
pages cm.
Includes bibliographical references and index.
ISBN 978-0-12-408140-6 (pbk.)
1. Computer security. 2. ComputersAccess control. 3. Computer networksSecurity measures. 4. False personationPrevention. I. Title.
QA76.9.A25O78 2013
005.8dc23
2013036149
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library
For information on all Syngress publications, visit our website at store.elsevier.com/Syngress
ISBN: 978-0-12-408140-6
Printed and bound in the United States of America
14 15 16 13 12 11 10 9 8 7 6 5 4 3 2 1
![Foreword Roger Park IT Advisory Services Leader EY Financial Services - photo 3](/uploads/posts/book/59380/images/F000211fm03-9780124081406.jpg)
Foreword
Roger Park
IT Advisory Services Leader, EY Financial Services OfficeAmericas
As the leader of the IT Advisory practice within EYs Financial Services Office in the Americas, I have seen firsthand the dramatic rise in the number of Identity and Access Management (IAM) initiatives across the financial services industry over the past several years. Many of these IAM projects are driven by business and technology transformation programs that go beyond the scope of traditional security and/or technology risk remediation projects. The reason for this change in emphasis is broader recognition within executive ranks of the critical role that identity and access management plays in enabling the business to respond flexibly and safely to rapidly changing requirements.
Over the 20 years that Ive been in technology consulting, the operations and technology platforms that underpin high-performing businesses have become increasingly complex and intertwined. Starting with the move from mainframe systems through client server to service-oriented architectures and now Cloud, leading companies have progressively migrated to more heterogeneous environments with highly distributed processing. Todays core business services involve processes that span multiple actors with overlapping roles, numerous applications that are themselves composites of smaller grained services, and multiple data stores that contain a wide range of sensitive information. An enterprise IAM solution allows all of these moving parts to work together to efficiently, safely, and securely deliver business value.
Looking forward, the firms that succeed will be those thatsimply statedcan move quickly while avoiding mistakes. Whatever the driver is for changereducing costs, addressing rapidly evolving regulatory requirements, or moving nimbly to seize new business opportunitiesthe capability to leverage emerging technologies (BPM, Cloud, Big Data, digital, analytics) to enable agile operating models and streamlined processes will provide a significant advantage over the competition. However, the challenge of protecting the business from risks both external and internal during that journey will be one of the key constraining factors for any company trying to move quickly on that path. In that context, the ability to effectively implement a comprehensive IAM solution becomes a critical success factor for any business that is in the process of significant change.
The unfortunate reality is that many organizations have struggled to implement enterprise IAM correctly. The reasons for failure are easy to understand but difficult to overcome. That is why I was delighted when my good friend and fellow EY partner, Ertem Osmanoglu, told me he was writing Identity and Access Management: Business Performance Through Connected Intelligence. There are many books on Identity and Access Management, but none with the holistic and pragmatic insight that Ertem and his team of coauthors bring to the discussion from their extensive experience in the field solving real world issues. Anyone with an interest in the topic will appreciate this practical and insightful guide to designing and implementing identity and access management solutions that leverage best practices to deliver real business value.
Preface
Ertem Osmanoglu
Identity and Access Management Leader, Financial Services Office, Ernst & Young LLP, New York, NY 10036
Over the past 10 years, cloud computing, mobile technology, social networking, BYOD (Bring Your Own Device) policies, and other IT and consumer trends have transformed the threat environment. To survive and thrive in this increasingly interconnected and virtual ecosystem, organizations must recognize identity and access management (IAM) as essential to the secure transfer of information that lies at the heart of commerce. This book is for security executives, IAM practitioners, and IT professionals in organizations with all levels of success in IAM implementationwhether you are new to the subject or a veteran of a large IAM implementation attempt.
IAM involves trade-offsin terms of cost, risk, convenience, and other user freedoms.
Having worked in the IAM domain for many years, I have observed one common characteristic of many large IAM programs: they often fail. Clients routinely engage my team when they and their IAM integration partners have failed to deliver on measures of business value, quality, time, and cost. These failures are often due to an overly-aggressive initial scope, lack of business sponsorship, lack of knowledge of how the business works, and lack of the program flexibility necessary to incorporate critical new business or regulatory changes. We have helped turn around many IAM programs at leading institutions and led teams that both delivered real business results and provided the flexibility needed to navigate future requirements and regulatory demands. Based on the experience we have gained, this reference serves as a practical guide and shows how IAM can powerfully improve business performance and profoundly reduce risk.