If I Were David Letterman

1
If I Were David Letterman

• What identities do we need to manage that we
  dont control
• Do we really know who is in our workforce
• How accurate is our identity source data
• How well do our applications vendors really
  understand their authentication/authorization
  routines and data sets
• How willing are our applications vendors to play
  the identity management game
• Does the IDM implementation team really
  understand the difference between an identity and
  an attribute
• Whose budget are the savings in
• Whose budget are the costs in
• What is the real cost of the supporting
  infrastructure
• Can a schizophrenic run an identity management
  program

2
Identities Do We Not Manage

• Examples
• Students/Interns
• Medical device and supply representatives
• Short term consultants
• Outsourced staff
• Wheres the data
• Who are they
• What do we match on

3
Who Is In the Workforce

• How do we keep data current
• Transitory and episodic involvement
• Ineffective procedures for termination and
  transfer tracking

4
Determining Data Accuracy

• Creating incentives for sources
• Varying definitions
• IRS vs. State licensing board
• Varying point-in-time cutoffs

5
Application ID Use Modules

• Does the vendor really know how they work
• Do they understand that LDAP is not a brand of
  caulk
• Do they care

6
Vendor Participation

• What is their value proposition for engaging
• Is the necessary resource available

7
Identity Versus Attribute

• What is in a Name?
• Does the IDM team understand the distinction
• Matching versus describing

8
The Budget Game

• The Costs
• Hardware
• Software
• Consultants
• Business Owners

• The Savings
• Wait time down
• Help desk calls down
• Security up
• Information flows

9
Real Cost

• Quantify the net
• Show the impact to accountants

10
Did You Start Out Schizophrenic?

• Structure vs. Flexibility
• Design vs. Implementation
• Data vs. Process
• Identity vs. Attribute
• Matching vs. Matching