Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Choosing IM/UP Software
If your organization is considering IM/UP, keep the following issues in mind:
- How big is the organization you’re trying to manage? If you have a couple dozen people on a single server, you may want to just use the built-in tools in Windows Server and not bother with specialized software. Generally, the full-blown provisioning management systems from companies such as M-Tech or BMC aren’t worth it until you get over 5,000 to 10,000 employees (barring special considerations such as compliance).
- How complex is it? A basic metric here is the number of separate servers you have to manage. Another consideration in complexity is how often privilege bundles change—Aisien’s "provisioning events."
- Do you have regulatory constraints? Some laws require companies to maintain auditable records of who had access to what. This is a double-barreled requirement because it not only requires that you limit access to certain information, it also requires than you prove you did so and keep verifiable records. This has led to a whole new subclass of IM/UP software with emphasis on auditability.
- How fluid is your organization? Some organizations and some departments are pretty much fixed in stone. While the users may change, the jobs—and the permissions to support them—change infrequently, if at all. This is typical of low-level employees doing clerical-type jobs. In other cases, access needs change weekly or even daily. Executives and high-level support people are typical examples. Here the software must help administrators change permissions quickly, often creating specialized bundles of privileges. In this case, a fast, efficient self-service provisioning feature is particularly important. So is avoiding fossil privileges.
Oracle’s Aisien adds four other criteria, primarily for enterprises that need a large IM/UP system:
- Look for a system that does more than high-level account management. Account management is basic, but it can be only the beginning. Ideally, you want to do as much of the work as you can from the provisioning system. Sophisticated provisioning systems can also do things like set disk-storage space quotas for users and associate users with groups doing anything the application’s interface will support.
- Look for systems that can automate the compliance process. This includes providing auditing reports and other functions to make it easier to comply with whatever regulations your company faces and to prove you’re in compliance.
- Look for systems that can manage workflow in a flexible manner. Because the process of granting and modifying permissions as needed is so central to provisioning (and to user satisfaction), it needs to be done as flexibly as possible. There shouldn’t be any unnecessary roadblocks to provisioning. Among other things, this means avoiding statically assigning granting permissions to specific individuals. Otherwise, the user may have to wait if the designated administrator is out sick—or, worse yet, on vacation.
- Use your existing Windows administration tools to complement provisioning tools. Aisien recommends getting a provisioning system that can make use of as much of your existing toolset as possible, rather than insisting that all relevant provisioning jobs be done through the IM/UP system.
The other thing that’s crucial on a provisioning system is planning and discovery. "A provisioning project touches a lot of different components," Gebel says. "It relies on account data about the users and a detailed knowledge and documentation of business processes. You have to ask yourself if you have the necessary information about the users that is going to be used to automate the workflow. If these things aren’t documented, you need to go through that process as well."
"People need to understand that it does take a lot of effort to be ready to make these projects successful," he continues. "They’re very complex, they stretch out and touch lots of different parts of the IT infrastructure. You have to deal with people and data owners across the company. This is not something to casually walk into and think you’re going to pull it off."