Making the Business Case for Secure Identity Management

Monte Luehlfing

Assistant Director – Networks

University of Mississippi Medical Center

Stuart Scott

Solutions Creations & Marketing

sscott@novell.com

Novell, Inc.

Why are we here?

How can I discuss identity management challenges and benefits in a non-technical manner?

How can I tie technology to business needs?

How can I justify the investment in a solution?

What are your experiences with SIM?

None?

In process of implementing?

Already implemented?

What have been your experiences?

Do you have any tips to share?

The problem seems simple ... at first

We all have too many user IDs and passwords to maintain.

If it is a pain for admins, imagine the problem for our clients. And vice versa.

Isn't there a better way to balance security and usability?

Personalized User Interface

Content Aggregation

Self Service

Web Based Access

Authentication

Single
Sign-on

Remote
Access

Authoritative Identity Sourcing

Policy Driven Workflow

Role Based Profiling

Password Management

Auditing &
Intrusion
Detection

But it quickly gets complicated

So it's important to boil the problem down to the basics

Existing Systems

Transactions

Packages

Utilities

Collaboration

Docs/Content

Network

Communities of Users

Employees

B2B

Partners

Customers

What types of identities matter to your enterprise?

What types of systems or resources should they
have access to?

If the business can agree on policies,
IT can automate much of the job

How much security does each resource need?

Who should have access to each resource?

What processes will we use to grant and revoke access privileges?

What password policies will satisfy our security requirements?

Who will be responsible for tracking and enforcing compliance?

HR

E-mail

Computer

Phone

White Pages

New employees receive access and resources quickly & automatically, based on roles & responsibilities

Policies establish
who will receive access to which resources

A user lifecycle view of
secure identity management

“It took me over six weeks to get all the required access privileges”

“I didn’t know what I needed or who to ask”

Access policies based on roles

simplify administration

Who are you?

What is your role?

What do you need access to?

HR

E-mail

Computer

Phone

White Pages

New employees receive access and resources quickly & automatically, based on roles & responsibilities

Terminated employees have access revoked completely & immediately across all systems

Policies also determine
when access privileges should be revoked

Common challenges to successful
Secure Identity Management

Data

Ownership

Project

Scope

Organizational

Realignment

Politics

Money

Application
Integration

Architectural
Design

Lack of

Expertise

Training

Change

Control

Complexity

Why are we here?

How can I discuss identity management challenges and benefits in a non-technical manner?

How can I tie technology to business needs?

How can I justify the investment in a solution?

“A new and useful contrivance
for Traveling on Water”

Life Raft

H. R. Rowlands

Patented Dec. 28, 1858

The operator standing in the steps c, c, belays taut the forward float lines and slackens the after ones; then, taking hold of the stanchions H, H, be advances one foot forward similar to the action in walking, the water forcing open the after floats, a short pause then ensues, and the float falls by its own weight to its first position thereby preventing a retrograde motion in the same manner. To back water, the after floats are raised and the forward floats are lowered.

IT wants to be ready to respond
to changing business requirements

Product & Business Model Innovation

Mergers & Divestitures

Regulations

Sarbanes-Oxley Act (US)

The Spam Act (Aus)

Data Protection Directive (EU)

etc.

The inability of Toys 'R' Us to compete with Target's and Wal-Mart's prices has hit sales and profits badly, Goldman Sachs analyst noted…

Competition

Target widened its lead in rock-bottom toy pricing over the past two weeks…

Dow Jones Business News

Organizations need the agility to
respond to several major change drivers at once

How are all these business drivers related?

Business Reach

Security

Cost Reduction & Productivity

Regulatory Compliance

Service Levels

We don't want to spend too much...
Or too little

Business Reach

Improved
Security

Cost Reduction & Productivity

Regulatory Compliance

Service Levels

Reactive

Dislikes ambiguity

Waits for instructions

High costs when crisis finally drives change

Proactive

Welcomes change

Solve problems and moves on

May tend toward point solutions that age poorly

Strategic

Creates foundation for intelligent adoption of new solutions

Creates flexible structures that can respond to change appropriately

Business drivers & response patterns

Secure Identity Management
solves an important business problem…

It provides the means to:

Cost-effectively deliver real-time, role-based resources

To a distributed workforce, partners, and customers

From any location, wired or wireless

While keeping systems safe

We're not just proposing technology
The solution has five dimensions

Strategy

Organizations & Processes

Technology

People & Change Management

Project Management & Governance

Where is the enterprise going?

How is the enterprise organized?

What is the current technical & application environment?

Is there effective sponsorship for addressing these issues?

How do you coordinate programs and projects across functional areas?

What are the relevant business goals & initiatives?

How are business plans and technology strategy coordinated?

What are the main business processes?

How could these processes be improved?

What other initiatives or major changes may affect your plans?

What are the potential barriers to acceptance of solutions to these issues?

What are the relevant technical requirements & constraints?

Let's find the starting point
that fits our needs

Solution Implementation

Sponsorship in place

Business-justified

Scoped & planned

Staffed

Proof of Concept

Hands-on

Lab environment

Small scope

Demonstrate results

Discovery Workshop

Engage stakeholders

Educate

Explore

Align

SIM Strategy

Enterprise-wide

Study alternatives

Set direction

Overall roadmap

Why are we here?

How can I discuss identity management challenges and benefits in a non-technical manner?

How can I tie technology to business needs?

How can I justify the investment in a solution?

A CFO's perspective

A business case should answer the question:

“What are the likely financial and other business consequences if we take this or that action or decision?”

Why do business cases fail?

The business case developers don’t understand what the decision-makers expect

The business case lacks credibility

It just isn’t compelling enough in relation to other investments the organization is considering

“Show me predicted investments
and returns over time”

Cash

Flow

Time

−

+

Accelerate Gains

Increase Gains

Reduce Costs

“Avoid these common mistakes”

Flawed methods

“The choice of cost and benefit items was biased.”

“Too much credit was given to soft benefits.”

“The data are incorrect, out of date, or incomplete.”

“The financial assumptions were unrealistic.”

Faulty analysis

“The benefit stream needs a longer ramp up or learning curve”

“Not enough weight was given to risk factors”

“The projected gains are too optimistic”

“Can you speak my language?”

Estimated annual benefits

-	Recurring costs

=	Earnings Before Interest, Taxes, Depreciation, Amortization (EBITDA)

-	Depreciation

=	Earnings Before Interest, Taxes (EBIT)

-	Taxes on EBIT

=	EBIT Adjusted for Taxes

+	Depreciation

-	Capital One-Time Costs

=	Net After Tax Cash Flow

+	Previous Net After Tax Cash Flows

=	Cumulative After Tax Cash Flows

x	Discount Factor

=	Cumulative Discounted Cash Flow

What are the concerns?

How do they help?

What do these mean?

Investigate business cases
for various scenarios

Single Signon

Password Management

Identity Integration

There are several ways to address the identity management problem:

How do you start the process?

Determine Current State

What are the systems that require identities?

What technologies are currently in use in the organization?

What are the current “pain points”?

What are the current processes?

Who are the stakeholders?

What departments will be involved?

What is the current relationship between IT and clients?

What is the current financial state of your organization?

How do you cost-justify the project?

Identify current costs

Identify costs to implement SIM

What are benefits and cost reductions/avoidances?

What is the bottom line?

What are the current costs?

Hardware

Software

Procedures

Productivity lost

Personnel time

What are the costs to implement SIM?

Software

Hardware

Services

Training

Internal resources

What are cost reductions/avoidances?

Procedures

Productivity

What is the bottom line?

Automating processes will save time, making employees more self-sufficient in relation to account maintenance.

System administrators can shift focus from mundane tasks to the more forward-thinking tasks of how to use technology to improve the business.

Your results may vary.

How do you obtain funding?

Departmental approvals

“Check-signers” Approvals

Budget Planning

Determine Financial ratios (“alphabet soup”)

Review/Interview Success Stories

Creative Thinking

Feedback: How ready are you...

To help your organization figure out and agree on its needs and priorities for secure identity management solutions.

To explain identity mangement challenges and benefits in a non-technical manner?

To tie technology to business needs?

To justify the investment in a solution?

Related Sessions

IO145:	Building Intelligent Enterprises with Novell's Identity	Driven Computing

IO154:	Novell Nsure Identity Manager 2 Overview and Futures

IO256:	Best Practices for Implementing Role-Based Identity	Management

TUT165:	Identity-Driven Computing: Enabling Greater Business Value	and Flexibility

TUT370: Architecting the Identity Services Foundation

...And many more; see the session listing for others!

General Disclaimer

This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.

No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.

The organizing backbone of the business case is a time line extending across months or years, as this figure shows. This gives you a framework for showing management how they can work with you to implement financial tactics:

Reduce costs

Increase gains

And accelerate gains

How did the example we just studied display the financial consequences over time?

Turn back and look at the spreadsheet that shows cash flow over time. Notice that it shows different kinds of cash flow. Let’s take a closer look.

When business cases fail to convince decision makers, they usually criticize either the methodology or the analysis – the conclusions you drew. There’s a lot of subjective judgment in any business case. This means that two people working independently can evaluate the same IT investment proposal, use the correct financial arithmetic, and still produce quite different business case results.

Here are examples of common criticisms of business cases. Let’s think about these for a minute. If someone is against the idea, these are easy criticisms to make, but hard ones to rebut. You will always have to make choices about what costs and benefits to include. You’ll always have trouble coming up with complete and accurate financial data for things that the client hasn’t measured carefully in the past. You’ll always have to make assumptions about the future economy and business environment. You’ll always have to make subjective judgments about how quickly gains will be realized. Almost everyone has a tendency to underestimate risks and overestimate gains.

These criticisms aren’t just easy – they are often valid. So we have to take a lot of care to make sure our business cases are sound, credible, and convincing. How can we do that?

Why am I telling you this? Do I expect you to memorize this calculation? No.

I just want to make an important point. Every financially astute manager will look for a competent financial analysis. They will expect to see discounted cash flows used as the basis for calculating payback period and internal rate of return. They won’t accept simplistic calculations that don’t take all these factors into account.

You don’t have to be an expert in calculating discounted cash flows. But you have to appreciate the fact that someone from Novell needs to have this expertise if we expect to provide our customers with credible business value justifications for their investment decisions.

This means that no work is lost with either the Novell Nsure UDDI corporate or testing solution.

Enterprises that build their UDDI solutions with Novell Nsure UDDI Server, are not only leveraging the deep experience Novell Identity Management foundation brings to the standard, they are securing their own future by building on an open standard implementation that will grow and scale with their corporate needs.

2005-01-21T14:27:42

Stuart Scott