Introduction

Over the last decade, IT complexity has grown to challenging levels. Almost every company now has to manage a large amount of applications in a complex IT infrastructure consisting of large amounts of accounts and permissions.

Having control over who can access which data in such an environment is crucial for privacy, compliance and protecting against cyber threats.

The traditional answer to this challenge is introducing human governance processes, typically for requesting, approving and reviewing employees' accesses. Those processes are crucial for your operational efficiency and having them checks the necessary compliance boxes, but they don’t necessarily lead to actually being in control of the users and their access.

How do you know if you’re in control? And how can you prove it?

Those questions are exactly why we wrote this guide. Because reporting about your current identity status and identifying potential risks or gaps remains a challenge.

Based on our own experience and frameworks such as ISO 27001, we bundled a set of crucial indicators that you should measure in order to know whether you are in control - and to prove that you are.

TERMINOLOGY

💡KPI? KRI? KCI?

Key performance indicators (KPIs) measure performance - the achievement of identified goals. Key risk indicators (KRIs) measure risk exposure - they are an early warning to potential threats. Key control indicators (KCIs) measure the effectiveness of controls that are put in place.

One of the main goals of identity management is, however, reducing risk. And the performance of identity management is translated for a large part into the effectiveness of processes, the output. As such, there is not always a clear or strict distinction between a KPI, KRI and KCI within identity management. In this guide, we use the term key identity indicator.

The right choice of indicators

For most of the organizations the same set of key identity indicators is relevant. Nevertheless, no two organizations are exactly the same. Depending on their focus areas of being in control, some indicators will be more relevant than others. Answering questions that matter and getting support from management will be much easier if the indicators are aligned with your focus areas.

It’s important to understand that the choice and priority of indicators is not set in stone for all time. There are several factors that could influence what it means to be in control for your organization. Think about strategies and goals that develop over time, more information that becomes available, changes in the regulatory landscape, etcetera.

In the following pages we’ll take a closer look at each of these categories.

DATASHEET KEY INDICATOR CANVAS

Prove that you are in control

Eager to get started yourself? We created a canvas to help you prove that you’re in control of your users and their access.

We can help you fill in this document, offer you the complete solution or help you improve the current situation. You can contact us at hello@elimity.com or find out more on www.elimity.com.

Download Canvas

FIRST CATEGORY

1. Orphaned Accounts

What: Accounts that are no longer active or have no owner.

Why: SECURITY + OPERATIONAL EFFICIENCY

Details:

Orphaned accounts form an interesting path for hackers to gain access to organization resources, applications or systems. Organizations that fail to take the necessary steps to close these entry points leave the door on a jar for attackers, and expose themselves to unnecessary risk. By identifying and cleaning up these accounts, security risk is reduced significantly.

Moreover, tracking orphaned accounts can provide insights to improve operational efficiency. When an employee leaves the organization or when a contractor’s project has ended, their accounts must be deactivated (i.e. disabled). This should be part of the typical offboarding process. However, in practice, it happens that those accounts are incorrectly deactivated or not deactivated at all. By finding out why these accounts were not deactivated, the offboarding processes can be improved.

Metrics:

Accounts for which the user has not logged in for quite some time. Accounts that have not been used for a certain period of time are also known as dormant accounts. What that time period should be exactly can vary for different types of accounts and between organizations. Often 90 days is considered for standard accounts.
Accounts for which the user has not logged in since they got the account, also called ignored accounts.
Uncorrelated accounts, also known as ghost accounts. These are accounts that do not belong to any employee or accounts that belong to an employee that is not active anymore. So in other words, accounts without an active owner.
Accounts with a status indicating inactivity. Think for example about an employment status ‘retired’ or an activity status ‘inactive’. The clue is to look at the user characteristics in the identity system that could indicate inactivity of a user.

Download the full guide to take action yourself!

DOWNLOAD GUIDE

How to prove that you are in control