While it’s most important to establish a solid IGA foundation, as described above, NetIQ is continually pushing the envelope to make governance automation more encompassing and effective in helping information owners protect their data. Near-term identity governance and administration development directions within identity and access management infrastructures include:
Beyond providing the best information possible in a format that approvers and reviewers can quickly understand, the next generation of IGA brings together least privilege best practices and organizational policies to automate entitlement analysis. The automated elevation of risk scores of their sensitive information, as well as the users accessing them, highlights points of concern for review and potential security actions.
The intelligence-based automation scenario described in the previous bullet is best augmented with behavioral analytics of actual usage. This type of analytics can guide focus on specific identities and resources to reassess the risk they perpetrate on the organization.
While traditionally IGA hasn’t included governance of root access to systems, a more formal approach to securing access to server hosted data and executables is necessary. In that system administrators can potentially bypass various security mechanisms, the importance of securing root privileges is obvious. Beyond the ability to delegate and govern different levels of administration, these superusers have so much granted access that advanced monitoring of their system-related actions offers potential valuable forensic information.
A well-built IGA environment isn’t easy to implement. Getting buy-in at the executive level and the various business owners can be long and uneven. Pulling in the information owners to properly onboard their resources take investment, as does keeping in touch with them for changes in their environment that require updates. But the value of this type of security investment pays huge dividends. It allows organizations to be more agile in their digital business operations while keeping their risk low.