Security Slideshow:
Managing Identity Data Through Corporate Restructurings

• These are tumultuous times, characterized by shot-gun mergers, acquisitions, and corporate restructurings resulting in mass lay-offs. This corporate churn forces companies to change employee access to sensitive corporate data on very short notice, grant access privileges to new employees, adjust access privileges for re-assigned employees, and terminate access for former employees and contractors.

  Organizations that are "identity aware" can successfully - and proactively - manage the IT risk associated with changing user access to applications and systems. In this presentation, SailPoint's Founder and CEO, Mark McClain, provides advice to help IT organizations prepare for these scenarios.

• 1. Take formal steps to manage your identity risk before a merger, acquisition or downsizing takes place:
  • Catalog all sensitive information assets affected
  • Identify all workers impacted (joiners, movers, leavers)
  • Define all internal controls to be used to manage risk and ensure compliance
• 2. Perform an identity inventory on assets that will be affected by the restructuring, in order to create an authoritative record of "who has access to what?"
  • Aggregate user and access information from various systems into a single repository
  • Use correlation rules to resolve inconsistencies between resources to obtain a unified view
• 3. Perform a "data cleanup" certification to establish a reliable baseline of data:
  • Require application owners and people managers to review and certify the access privileges of all users in their departments
  • Identify the list of all access privileges to be revoked based on this initial review
  • Organizations typically find that between 10-25% of user access privileges are inaccurate or inappropriate and should be revoked.
• 4. Proactively identify and manage high-risk users
• Include those with privileged accounts and those most likely to be affected by a restructuring and ensure they are visible to all certifiers
• Use the principle of "least privilege" to remove any high-risk access privileges not needed to perform job functions