Identity and access

Centre to an organization’s security is the concept of an identity. This identifier is unique to every individual, system, process and device that interacts within an organization’s technology environment. Attributes specific to a given identity in aggregate begin to shape the digital identity that establishes a unique entity. These digital identities are the cornerstone of how we manage access to critical systems and data. The desired state is an environment where every identity is known yet exists untrusted. It requires time as well as a level of maturity within the organization.

RSM’s digital identity team specializes in helping clients manage the universe of identities—from employees to third parties and connected devices to processes. Our team will work with you to understand your relevant universe and develop the right strategy to securely manage those identities. We’ll work with you on:

• Developing your digital identity strategy and governance model

• Identifying and mapping specific attributes and behavioural characteristics to your identities

• Consolidating identity repositories or providers for efficient management and governance

• Understanding and implementing biometric identifiers 

• Deploying identity proofing approaches and technologies

• Managing the delivery of enterprise-wide identity and access implementation 

• Understanding and building identity management strategies leveraging decentralized identifiers through blockchain

• Synthesizing and conducting identity and attribute clean-up activities

• Providing a fully managed identity solution covering your employees, third parties and devices, or co-managing your existing identity platform

Identity governance and administration (IGA) underpins secure and efficient technology and business operations, providing users, devices and processes with appropriate access to conduct daily operations. Crucial components of effective IGA include maintaining accountability for access-related decisions and timely addressing of changes in responsibilities. The identity governance program is responsible for defining what constitutes an organizational identity and the relevant governance processes, workflows and certifications to protect access integrity. The program should be aligned with the organization’s needs as well as incorporate the relevant regulatory and standards compliance requirements.

RSM’s digital identity team focuses on helping clients apply identity governance principles throughout the organization to support operational efficiency while maintaining accountability. Our team will help you with:

• Developing your identity governance strategy, framework program and processes

• Designing and deploying identity life cycle management processes from cradle to grave

• Establishing identity repository source of truth and precedence determination

• Deploying and integrating identity governance platforms within your organization

• Managing an organization’s identity life cycle and access certification program

• Delivering fully managed identity governance platforms that provide identity management, authentication and authorization capabilities to your organization

Authentication at its core is a simplistic concept: confirming with whom a person, device or process is or to whom it is associated. How an organization chooses to confirm these identities is a more complex effort that should consider a variety of factors such as the criticality of the systems, the data the organization wants to protect and the end-user experience. The biggest inhibitor of strong authentication is a complex process that provides a poor user experience. While usernames and passwords are still a reliable approach, organizations are realizing that enhanced, low impact authentication methods improve the user experience in a more secure manner. Navigating the wide range of options requires a partner well versed in password and password-less concepts such as adaptative, behavioural and contextual. Whether your organization is moving to more advanced concepts or remaining steadfast with multifactor or biometric means, RSM can help.

Our digital identity team specializes in helping clients define the appropriate authentication methods based on the criticality of systems and data. We’ll work with you on:

• Developing an authentication strategy focused on the organization’s digital identities and engagement channels

• Assisting you with determining the necessary level of authentication based on criticality of systems and data as well as regulatory and standards requirements

• Applying advanced authentication methods and techniques within your technology landscape

• Implementing authentication platforms that support efficient business operations inside the organization and with third parties

• Delivering fully managed identity authentication capabilities to your organization or managing your existing authentication platforms

Determining an authorization approach requires an understanding of the organization’s daily operations, including how users interact with critical systems while performing job responsibilities. End users and devices should only be granted access to the organization’s resources and data when authorized and for the amount of time necessary to perform the specified activity. Organizations are looking beyond static, “always on” entitlement assignment to more secure dynamic approaches relying on conditional attributes such as location, device being used, time of day and the system being requested. These conditions allow the organization to manage access dynamically based on a set of known, expected outcomes. As the authorization platform experiences more interactions, it learns the expected behaviour and begins to anticipate resource access needs.

RSM’s digital identity team focuses on helping clients define the appropriate authorization approach that will provide your identities with the right access to systems and data commensurate with their job responsibilities and needs. We’ll help you with: 

• Developing an authorization strategy and approach that considers factors such as low-resource impact, speed, accuracy and end user experience

• Understanding and evaluating authorization concepts such as zero or partial trust

• Implementing authorization approaches that support efficient business operations inside the organization and with third parties

• Delivering fully managed identity authorization capabilities to an organization or managing your existing authorization platforms 

• Designing and implementing enterprise authorization strategies such as role-based access control (RBAC), attribute-based access control (ABAC), location and risk-based authorization, etc.

Controlled administration of privileged access remains one of the strongest preventive measures to significantly slow an attacker’s advance on your technology environment. In a world of ransomware-as-a-service, limiting access to accounts that control the “keys to the kingdom” removes one of the most successful tools in the hacker’s kit, raising a significant barrier to their progress. These individuals often take the path of least resistance and will move on to another target. Privileged access management (PAM) helps to improve your internal security posture. It is also an effective way to control third-party access into your environment, which is another popular attack vector for adversaries.

RSM’s digital identity team focuses on helping clients manage privileged users, systems and processes access to critical systems and data while maintaining accountability and auditability. We’ll work with you in areas such as: 

• Developing a privileged access strategy and governance model

• Taking inventory of privileged identities across your technology landscape

• Designing your privilege identity approach to managing entitlements

• Implementing privileged access tools and technologies to support internal users, devices, and third parties

• Assisting with cleaning up your existing privileged identity data

• Integrating privilege identity activity with your secure monitoring solution to improve telemetry

• Providing a fully managed privileged identity solution or co-managing your existing privileged identity platform 

Providing a low impact authentication and authorization user experience that securely manages access to your critical systems and data is necessary to combat common user mistakes such as written or simple passwords, shared credentials and unlocked devices. The user interface should be highly intuitive while authentication methods should look to enhance security and reduce impact to users through concepts such as adaptive authentication or device fingerprinting. Our approaches to authentication learn from a user’s behaviour, harnessing identity analytics to identity which systems and data are required for an individual’s job responsibilities. Working closely with end-user teams when deploying these mechanisms in an end-user experience-centric manner will improve adoption and support the security team’s efforts to better secure the organization.

RSM’s digital identity team specializes in enhancing end-user experience through our human-centric design approach to building frontends across your customer engagement channels. Our end-user experience services include:

• Building intuitive UI/UX authentication portals and mobile apps for employees, customers and partners

• Reducing click-through experience for identity enrollment and proofing

• Deploying authentication and authorization approaches that minimize impact on the end user community 

• Incorporating mobile responsive design concepts into frontend authentication portals

• Minimizing customer/consumer impact through deploying low impact authentication concept such as social login, device fingerprinting and adaptative authentication

Organizations gather thousands, if not millions, of identity events across their landscape on a daily basis. This vast amount of user and device activity can provide the organization with an informed understanding of identity behaviour to draw insights regarding the performance of authentication mechanisms, accuracy of entitlement assignment and efficiency of governance activities. Continuous monitoring of user and device activity helps build an understanding of that identity’s behaviour, improving the organization’s ability to detect anomalous events that may be an indication of potential compromise or user awareness and training gaps. When integrated with security monitoring platforms, user behaviour analytics enriches the existing intelligence and enhances the organization’s overall telemetry.

RSM’s digital identity team specializes in helping clients harness the power of identity data to better manage and enrich identity investments. We’ll work with you on:

• Learning and leveraging your identity activity to enhance the authentication and authorization

• Harvesting the related identity activity to baseline and improve monitoring process and alert indicators 

• Determining acceptable usage and enforcement measures for identities and resources

• Implement machine learning techniques to analyze identity behaviour and entitlement usage for anomalous behaviour