|
The Challenge
User ID correlation is one of the first, and most difficult, challenges in implementing Identity Management, Compliance Management, or any centralized privileges management system for that matter. The creation of a centralized repository of privileges requires consolidating accounts and privileges from many systems, where user IDs are not always easily traceable to their rightful owners. For example,
- John Smith may have accounts john.smith on one system, jsmith in another system, smithj on a third application, and js113 on a fourth one
- There may be more than one John Smith in a company, resulting in accounts such as jsmith1, john_smith_jr, etc.
- John Smith might have multiple accounts in one system, especially if John is the administrator of that system and holds accounts such as admin, root, etc.
- There are many “friendly” account naming conventions, e.g., johnny, or bigguy, spelling errors (e.g., smitt instead of smith).
In addition, it is common for people to retain accounts and access rights long after they are needed, and some accounts may simply be left in the system long after their rightful owner no longer works for the organization.
The typical solution to this problem is to identify the most frequent naming conventions, and to write scripts that attempt to match accounts based on those. This works for 75% of the cases, but this takes some work, and may then result in a lot more manual work for the remainder of the accounts, and an increased likelihood of erroneous assignments.
UUID Tool Overview
Eurekify Unique User ID Correlation Tool (UUID) first uses advanced pattern recognition, across all account attributes to calculate the probability of match of each account to every potential owner. It then creates a standard Eurekify configuration which can be input into Eurekify EQM for further investigation, reporting, cleanup, and ambiguity removal processes. Remaining uncertainty can be tackled using Eurekify’s certification facility, asking account owners, resource owners, and managers to review and screen out ambiguous assignments.
How it Works and Main Capabilities
In the initial steps of most identity, compliance, and role management projects, there is a need to consolidate accounts and privileges, using the following steps:
 Identify potential matches between accounts on one or more systems, and a list of potential owners (usually an HR feed)
- Out of the box functions and conversion tables for simple matches (e.g., based on naming conventions)
- Ranking of alternative matches based on their respective probabilities
- Querying, reporting, and cleanup tools to remove incorrect assignments
- Web-based account ownership certification process for accounts owners, managers, and system/data owners
- Automated consolidation of all users’ entitlements from all systems based on approved matches.
- The consolidated view serves as input for privileges analysis in Eurekify Enterprise Quality Manager (EQM), for role model engineering in Eurekify Enterprise Role Manager (ERM), and for policy modeling and verification in Eurekify Enterprise Compliance Manager (ECM).
In the ongoing management of privileges, the tool can be used to
- Periodically identify duplicate accounts
- Review and correlate new accounts of new and existing users
- Consolidate privileges from additional systems and applications
When to Use
- In a pre-Identity Management gap analysis project: first to consolidate accounts from multiple systems, and secondly to evaluate the effort that will be required in future consolidation
- In Identity Management projects, to ease and speed deployment of new systems
- In Compliance projects, to ease and speed consolidation of entitlements from across many different systems
- In Role Modeling and Management projects, to ease and speed consolidation of entitlements and role definitions
- In any other application where it is necessary to consolidate information that is not easily linked with a unique key.
In many of our IdM deployment projects, it took almost 6 months before we were able to correlate accounts into the [IdM data store]. This tool is a breakthrough for us, and will significantly cut the time and cost of deployment.” An expert Identity Management consultant.
|
