Pane Relief: Herding Cats -- User Provisioning in Windows
- Identity Management and User Provisioning
- The Nature of the Beast: Kinds of IM/UP Systems
- Provisioning, Privilege, and Identity
- Self-Service Provisioning
- Roles, Rules, and Requests
- Fossils and Over-Reaching
- Choosing IM/UP Software
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Identity Management and User Provisioning
Identity management and user provisioning (IM/UP) systems—software to help handle the process of setting up users with passwords and the access permissions they need to do their jobs—are becoming big business.
According to the Burton Group, a Salt Lake City, UT, market research firm, IM/UP software is becoming a major category because of the need to manage the provisioning process.
"To find clear evidence of this," the Burton Group reports wryly, "one has to look no further than help desks, which typically receive large numbers of requests from users to unlock accounts or reset forgotten passwords."
User requests aside, there’s another factor that’s making provisioning software more important: compliance. "One big reason [for the growth in provisioning software] is the emphasis on compliance," says Gerry Gebel, senior analyst at the Burton Group and a specialist in identity and privacy strategies. "Provisioning products are seen as a big factor in implementing controls and auditing in that environment."
Of course, Windows comes with a set of tools to do all these tasks; after all, such tasks are pretty fundamental to any multiuser operating system. However, the Windows utilities aren’t automated. If you have more than about 100 users, the utilities are clumsy and time-consuming. Relying on these tools can eat up an inordinate amount of Windows administrator time.
An alternate solution to burdening administrators or investing in provisioning tools is to farm out the job of granting access and setting permissions to low-level employees in each department, such as secretaries or administrative assistants. This "cure" can be worse than the disease, however, because privileges are a critical part of IT security. Someone who isn’t trained in Windows Server, and whose main job lies in some other area, probably won’t appreciate the implications of the task, and is likely to succumb to the all-too-human impulse to satisfy the person in front of him or her by finding a way to grant the privileges demanded—whether or not they should be granted. This combination quickly makes Swiss cheese out of one of the key parts of your security system.