From ‘oversight’ to the algorithm driven company

In last weeks contribution (Identity & Access Governance in the age of digital transformation) I was outlining the general picture, answering the question, what Governance is after all, what it means, when applied to Identity & Access, emphasizing the need to look at Identity and Access separately, and finally breaking ’direction' down, following the downstream path from strategy to executable rules. Today I will cope with how to make policies & guidelines actionable.

About the necessary underpinnings of a digital transformed corporation

When considering the quality of everyday management decisions in major corporations, the well-known Nobel laureate Daniel Kahneman found himself not exactly awed: “You look at large organizations that are supposed to be optimal, rational. And the amount of folly in the way these places are run… is actually fairly troubling.”

Even more worrying was the insight that this routinely making poor decisions did not correlate with experience, training and other factors usually considered having a positive effect. Rather the less encouraging conclusion was that this nearly unavoidable “noise” was the effect of the very human nature – the traps and biases we use to run into during our daily life, whether job or business.

And the cure? Well, Kahnemans advice is “Algorithms”. Let algorithms run the company? Yes! That's what he meant. As radical as this advice sounds, it is not an entirely new view. We have them since long. Policies & guidelines, Procedures & standards and Specifications & work instructions, representing a layer of abstraction each.

However these business rules are meant to be processed by humans – not by machines. They still need some degree of translation, interpretation and situational judgement. And even worse, they usually don't provide a complete set of guidance even for the majority of the “Business As Usual” cases.

While it still might take a while until we will see governance performed by robots (although in some companies it already might look like that), the operational layer of the traditional corporate pyramid can well be, and quite often already is, run in an automated way. Next target now is the Management layer, where less frequently decisions are taken to keep operation within the pre-defined policies & guidelines channel. This will be the battlefield where the success of the digital transformation, many companies lately decided to head for, will be archived – or not.
Nevertheless, giving “direction” needs to be expressed in a formal way. And it is still a good start for many corporations to fill the voids in the document pyramid, as shown in fig. 1.

It might be a disturbing idea which Kahnemann conveys, when he expects systems powered by artificial intelligence (AI) one day to be able to execute professional judgement even better than humans. For now however laying the necessary foundation as the necessary underpinnings for a (more) digitized corporation, will be already enough of a task for most of us.
So let's do our homework first.

Oversight starts with a simple question

Oversight starts with a simple question: Who has (had) access to which Resources?

Simple question – simple answer? Yes? No! Rather only few corporations are currently able provide sufficient evidence of their access situation as outlined below.

Who

Let's first look at the ‘who’: usually you may think of (fixed term) employees. And indeed, providing them with the appropriate access to corporate resources causes headache enough and keeps hordes of colleagues, consultants, system integrators and auditors busy. However the subject behind the ’who' needs to be looked at more fine-grained. It can be other staff, like contractors or those with elevated rights like admins. It could be suppliers or customers and even their respective administrators in case some limited delegated administration is implemented. Increasingly non-human actors like other systems interact via more or less controlled APIs and need to be included into the access control focus. And finally the IoT age is dawning, bringing new challenges to the table, let them be the sheer number, the often external nature or the limited capabilities of those ’things'.

Has (had)

The innocent word ’has' can be broken down into sufficiently complex cases too. It is not just about listing all resources any digital identity has access too – now. Not just listing them by resource, by digital identity, by system, content authorisation level, or context exclusion rule. Also it must be immediately back-traceable why this privilege exits, who (person or policy) granted it and when last has been checked. For audit purposes or forensic investigations these answers have to be given for any chosen period of time, which legal and corporate retention rules permit.

Access to

What about the ’access'? Is it uniform? What a stupid question. No, it is not. Next to the trivial CRUD-access (Create, Read, Update, and Delete): There are risk-mitigating content-based access limitations in place, restricting access according to pre-defined authorisation levels: “You are allowed to close contracts up to 1 million US-Dollars.” Next to content, the context might add to the sensitivity, like: “Well, you might close that contract but not during your vacation, from a nightclub in Shanghai, during (local) night-time, using your private smartphone, which hasn't been updated to the latest security patch level.” The last example could even contain several policy violations. A third restriction is process based and prevents a digital identity from running a complete business process just by his/her own. Also known as Segregation of Duties (SoD) this risk minimizing step can be performed at administration time (static SoD) or at run-time (dynamic SoD). Privileged access finally is quite a different breed and should again be handled completely different, e.g. via granting completely monitored and recorded session-based access.

Which Resources

After talking about the subject of the access act, what about the object, the corporate ’resource'. The sensitive corporate resources, which need to be protected, are not the ERP-, CRM- or HR-systems but the underlying information objects, the employees, customers, contracts payments, … . They should be well-known, classified by their sensitivity, assigned into areas of responsibility and expressed in a formal model. As information objects don't interact by their own and are unable to protect themselves, access to them goes through a whole stack of systems, which are usually object of access control in lieu of them. This IT stack comprises, but is not limited to, applications as the most obvious part, but also middleware, operation systems, networks, telco-systems and physical assets, e.g. premises, as well. There are no logical – only practical reasons – why the entry of humans into buildings is handled by independent PACS (physical access control systems) and not by the access control systems, which shields digital resources.

Executing oversight for I&A Governance

When it comes to implementation of Governance usually 3 types of controls are considered:

• Preventive controls
• Detective controls and
• Corrective controls

There is no question that it would be optimal to prevent any deviations from our policies, hence fully rely on preventive controls. This however would mean that the ’direction' part of I&A Governance would have got sufficient traction to rely on it. It further means that you have to declutter your architecture, mature your administrative processes to a high level of maturity and - as we learned from the introduction above – automate all administrative processes to a high degree.
As these prerequisites are rarely fulfilled, we have to rely on the second best set of controls, the detective ones, which belong to the oversight part of I&A Governance.

A few standard implementations of detective controls are required by major regulatory bodies and hence found wide acceptance. Detective controls therefore dominate the IAG processes. They should be gradually reduced in favour of preventive controls once the necessary preconditions are given.

The three top-level detective controls in use today are:

• Reconciliation - Does the implementation reflect the intended state?
  This daily health check is only necessary, if the access definition is done on a different location (Policy Administration Point or PAP) than the policy decision (Policy Decision Point or PDP) and the policy execution (Policy Enforcement Point or PEP) and the target systems still maintain their native Administration Interface. In an architecture where there is (at least logically) just a single policy store, there is no need for this control; in reality however it quite often is.


• Attestation - Is our decision still valid?
  Also known as Re-certification this regular (quarterly to biannual) check on validity just reconfirms the decision once taken during initial grant of the privilege in question. This check become necessary (and hence is required by regulatory bodies) as we don't have sufficient trust in our administrative processes, that they would properly, immediately and automatically react on change events in the real world and reflect them in the access structure accordingly.


• Expiration - To limit risks for domains outside your own control.
  Expiration of once granted privileges is a widely underestimated and thus underutilised detective control. Its use is evident for granting access in the context of limited endeavours, like task forces or projects. Also in environments outside of the direct control, like vendor employees authorised via delegated administration, whose leaving and changing positions would otherwise go undetected. But also for regular employees on BAU tasks (Business As Usual) it would be beneficial and could even replace attestation. Prerequisite however is a proper implementation of time-out dates and a powerful workflow support.

One important point to mention is that I&A Governance is by no means an IT task. It is rather purely organisational. Therefore all decisions must be well understood and taken here by representatives of the business side. As this can only be expected when all access objects like roles, rules, privileges, or information objects are named and described in business terms, it is only a minor step from here to find the find and implement the appropriate business rules (Kahnemann calls them algorithms) to drive the process henceforth.

In these two postings I described the current status of what is expected of corporations to have implemented today. In my third and last part next week I will focus on the challenges lying ahead and what they will mean for us.

Identity & Access Governance in the age of digital transformation

Identity & Access Governance obviously is a difficult task. Many major corporations struggle to meet their various compliance criteria, which could be expected as a natural by-product of good governance. But having hardly completed this job, the next one, innocently called “digital transformation” knocks at the door.

Will governance thus become even much harder by then: At least I was asked that question recently. Ok, let me quickly give an introduction to the total topic, go into a little more detail where it appears appropriate to me and eventually come up with a couple of brave conclusions.

You might have heard of the new esoteric trend “Declutter your life”. Some very similar recipe I would prescribe the majority of today's companies: “Declutter your infrastructure (before going to digitize it)!” So, with all right, you can expect a decluttered contribution too, dear reader. However, the text nevertheless has become slightly lengthy. I will therefore publish it in three parts - one per week:

1. Governance and Identity & Access
2. From ‘oversight’ to the algorithm driven company
3. Challenges ahead for a digital transformation agenda

What is Governance after all?

The term Governance was coined and defined during the last years of the previous century. However before that time too some form of ’governance', i.e. oversight, strategic change & direction was always expected from high ranking positions like non-executive directors.

In the beginning it was all about corporate governance, as senior management first had to be convinced of the usefulness of handling this new discipline explicitly – before it was applied to sub categories, like e.g. Identity & Access. By now it is accepted that a governance layer should reside on top of each management layer.

In case you want to get an in-depth introduction into Corporate Governance, its Principles, Policies and Practices I recommend the voluminous authoritative guide by the 'father of corporate governance', Bob Tricker, surprisingly named, 'Corporate Governance'.

Identity & Access Governance

So, how did we discover Governance in the I&A world?

Historically we started with the attempt to manage Identity & Access – as it became time to do so. This task alone turned out not to be easy going. While by then I expected the corporate world to do their homework within a timeframe of 3 to 5 years, it isn't even achieved today to a sufficient degree. And more challenges are looming around the corner, not least the digital transformation.

But even when companies succeeded with the introduction of I&A Management, the questions arose: Are we doing the things right? Are we doing the right things? Therefore, and as any management layer needs a governance layer on top of it to stay healthy, I&A Governance appeared out of the dark.

But IAG itself turned out not to be an easy task. The sufficiently powerful equipment for data analytics was missing and, more often than not, is still missing today. I&A Intelligence was born - the application of data analytics to the domain of Identity & Access.

 

Separating into Identity and into Access

While working hard on making Identity & Access Management (IAM) become reality some fine structure was discovered in what had been reluctantly lumped together into one discipline. The equation hence became: IAM = Identity Management (IM) + Access Management (AM).

Identity Management being a genuine Management discipline on its own, is the necessary organisational foundation for many corporate necessities like business automation, fine grained cost controlling, classical disciplines like human resources management and – of course – access management. So access needs identity a solid foundation – but not the other way round.

Hence one can imagine 6 distinct disciplines, as for identity all 3 layers (operations, management and governance) have to be performed, as has it for the access part.

Direction – we need a strategy

Remembering the definition of Governance as ’direction & oversight' let me quickly have a look at the 1st half of the world: direction. Certainly you should have to follow a strategy while directing a whole business towards its future.

This insight is not entirely new and so the procedure of defining a strategy is pretty well understood by now. Strategy development is merely a high level planning process, leading from the current state to some assumed future state. To do this with sufficient rigour, some prerequisites need to be fulfilled.

First you need to have meaningful mission. As for a corporate mission “Earning tons of money” might not be a good enough driving mission, so “Securing the business” would not suffice for Identity & Access. Good news is that nearly every company has started with a clear mission. By the time it may however need some adjustment or even re-invention, enough in each case to keep top management busy for a while.

Second you should now your current “As is” status, as ”if you don't know where you are, every direction might be the right one”. As trivial as this “know thyself” sounds, given the complexity of today's major institutions, you can easily run into the “analysis paralysis”-trap.

And thirdly you should have an idea of what lurks around the corner, the future drivers, influences, trends, new technologies, which may have an impact on your business.

Hence “Strategy Development” can be understood in a narrow and abroad sense, depending on whether the necessary foundation is laid already, or the entire work lies ahead still.

Strategy development - a cyclic process

Strategies often bear the stigma of being fuzzy, general, overambitious or even outright unrealistic. At least they are blamed to talk about a distant future in abstract terms. This perception is not completely wrong and not entirely right. Strategy development follows a cyclic process. And as its goal is to transform an organization from a defined here-and-now state to a specific future state, during this process it deals with abstract and far-off future issues, just to come back to the here-and-now, the cruel dirty world, with change items to be implemented tomorrow.

Expressing it as guidance

Having been perhaps too generously spending 356 words on a well-known corporate discipline like strategy development, I cannot afford the luxury to do the same for the subsequently necessary change activities. Let's assume however, that one fine day the projects will have come to an end, yielding new corporate processes – and altered corporate guidance.
The pyramid of corporate regulatory documents traditionally looks like this:

1. Strategic level: Policies & Guidelines

   
   Policies:

   Policies are binding corporate documents, usually issued by top management. They express goals, principles, focal areas and responsibilities. They represent the top level of the documentation pyramid.
   
   

   Guidelines:

   Guidelines like policies are of a high level of abstraction. However they don't come with a binding character.
   
   

2. Managerial level: Procedures & Standards

   
   Procedures:

   Procedures lay out all management controls for a defined problem domain on an essential level. They contain (static) functions & responsibilities and (dynamic) processes.
   
   

   Standards:

   They state requirements for generic minimum standards, a choice of good practice examples or a bandwidth of tolerable quality parameters.
   
   

3. Operational level: Specification & work instructions

   
   Specifications:

   The Implementation of controls on a physical level is specified in operational specifications, work flows, specifications, … Techniques, configurations of solutions and organisational processes are documented on this level.
   
   

   Work instructions:

   Based on the defining procedures work instructions specify the volatile details like configuration parameters or physical techniques.
   
   

Traditionally these documents on each level are written as some kind of narrative to be read and followed by its target group. This group evidently is meant to be made of humans. Automated processors usually are not in scope – however they increasingly need to be.

To let process definitions seamlessly translate into executable workflows, to automatically check human and automated activities against corporate policies, to authorise digital identities (human 'users' or automated processors) dynamically and aware of its context, expressed as rules and attributes (ABAC), much more rigour has to be applied to definition of regulatory documents.

As those documents become the central code, whose rules are executed in an unattended manner they need to be considered as the sensitive core of the entire organisation – and hence protected accordingly against failure, inadvertent or malicious alteration and creeping degradation.

Ok, that enough for now. Next week I will outline how to make policies & guidelines actionable. So please stay tuned.