IAM Data Model Separating Logical and Physical Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity access management (IAM) systems face challenges in efficiently managing access rights to computing resources, particularly in large enterprises, as they often require manual processes that can lead to mistakes and inconsistencies, and business personnel lack the technical expertise to handle access requests and reviews effectively.
Innovation Solution
Implementing an IAM data model that separates logical and physical aspects of access management, allowing business personnel to submit requests and conduct reviews in business terms while technology personnel manage the technical implementation, with a system that includes a processor, data store, access request handler, and reconciler to provision and revoke access rights accurately.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual processes are used to manage access rights, then flexibility in handling individual cases is improved, but mistakes and inconsistencies increase leading to reduced reliability
Solution Approach 1:
The system enables self-service through automated workflows where the IAM system automatically provisions, reviews, and reconciles access rights based on predefined policies and business terms. The system serves itself by automatically comparing provisioned access rights with business requirements and initiating corrections without manual intervention, thus maintaining both flexibility and reliability
Solution Approach 2:
The system implements continuous feedback loops through automated access reviews and reconciliation processes. The IAM system periodically reviews provisioned access rights against business requirements and provides feedback by identifying discrepancies and automatically initiating corrective actions, ensuring ongoing accuracy without manual oversight
2Measurement precision
If technical terms are used in access requests and reviews, then precision in specifying access rights is improved, but ease of use deteriorates as business personnel lack technical expertise
Solution Approach 1:
The system introduces an intermediary layer that translates between business terms and technical implementation details. Business personnel interact with the system using business-friendly terminology while the IAM system automatically translates these into precise technical access rights specifications, maintaining both precision and ease of use
Solution Approach 2:
The system segments the access management process into distinct layers: a business interface layer where personnel use business terms, and a technical implementation layer that handles precise technical specifications. This segmentation allows each layer to operate independently with its own terminology while maintaining accurate mapping between them
3Productivity
If automated systems are implemented to manage access rights, then productivity is improved, but system complexity increases
Solution Approach 1:
The IAM system implements multi-functionality by consolidating multiple access management functions (provisioning, review, reconciliation, translation) into a single unified system. This universal approach improves productivity by eliminating the need for separate manual processes while managing complexity through integration rather than multiplication of components
4Reliability
If periodic access reviews are performed manually, then security is improved by ensuring appropriate access rights, but loss of time increases due to manual effort required
Solution Approach 1:
The system implements automated periodic access reviews that occur at scheduled intervals without requiring manual initiation. The IAM system automatically reviews provisioned access rights against business requirements at defined periods, maintaining security while eliminating the time-consuming manual effort previously required
Solution Approach 2:
The system establishes continuous automated monitoring and review processes that operate without interruption. Instead of discrete manual review events, the IAM system maintains continuous oversight of access rights, automatically detecting and correcting discrepancies as they arise, thereby maintaining security while minimizing time investment
Data Source
AI summary
Systems and methods of conducting access reviews of access rights to logical computing resources are provided. An access reviewer may receive a selection indicating a user having access to one or more logical computing resources of a computer system. The access reviewer may identify a set of current logical computing resources that the user has access to and a set of current logical entitlements associated with the user. The access reviewer may generate an access review summary based on a comparison of the current logical computing resources to one or more of the current logical entitlements.