Populating the Unpopulated: Challenges of Building a Comprehensive User Inventory
Building a user inventory is often the most challenging aspect of an identity security program, but it is also fundamental to its success. Building an inventory is critical for any area of cybersecurity, and identity is no exception.
A comprehensive user inventory provides an organization with a complete view of all users, their access rights, and other relevant information that can help identify security risks, ensure compliance, and streamline user management. Moreover, a user inventory is essential to implementing a zero-trust security model because it provides complete visibility and control over user access and behavior. A user inventory is also a necessary precursor to other identity projects, enabling you to save time on projects like IGA.
Despite its importance, building a user inventory is not without its challenges. In this blog, we will explore the difficulties of creating a comprehensive user inventory, including managing different lifecycles, merging identities, managing machine identities, and understanding admin access. However, we will also highlight why it is so critical to get it right and the benefits of doing so.
1. User Lifecycle Variations
When we talk about “identities” in an enterprise, we’re not just talking about employees and customers. We need also to include contractors, vendors, and non-human identities. Critically, each of these types of identity has its own specific lifecycle and needs to be monitored differently.
Different types of users go through different stages in their relationship with an organization. This can create a problem for creating a single, unified user population because it can be difficult to track and manage all of these different lifecycles in a cohesive way.
For example, employees typically go through a hiring process, receive training and orientation, have ongoing performance evaluations, and eventually leave the organization through resignation or retirement. On the other hand, contractors may have a shorter onboarding process, work on specific projects or tasks, and may (or may not) have a defined end date for their engagement with the organization.
Vendors may have a completely different lifecycle, with a process for evaluation and selection, negotiation of contracts, and ongoing management of the vendor relationship. Customers may have their own lifecycle that includes marketing, sales, onboarding, and ongoing customer support.
These different lifecycles can make it difficult to create a comprehensive user population because it requires tracking and managing different types of users in different ways. For example, employees may have access to more sensitive information and systems than contractors or vendors, which means that their access needs to be managed differently. Customers may have different levels of access depending on their relationship with the organization.
Let’s be clear; there are legitimate business reasons for these discrepancies in lifecycles. For example, customers may not need as many controls as employees because they are not part of the organization and are not subject to the same security requirements. Similarly, there may be limited options for contractors in certain industries or locations, which means that organizations may need to work with contractors who have different lifecycles than employees. Vendors may also have different lifecycles depending on their size and capabilities; a small vendor may not be able to handle complex processes and may need more support from the organization, while a large vendor may be able to dictate more of the terms of the relationship.
Overall, these discrepancies between user lifecycles can create a complex and challenging environment for creating a single, unified user population. Organizations need to carefully manage and track different types of users in different ways, while also balancing legitimate business reasons for these discrepancies.
2. Merging Users Across Platforms
Difficulties in merging a user’s data across platforms is another reason that organizations struggle to get a unified view of their identities.
First, each identity provider may store user data in different formats, using different attributes and schemas. This can make it difficult to map and reconcile user data across different systems. This can be particularly challenging when trying to merge data between HR directories and identity providers.
Second, the data quality and accuracy of user data may vary across different systems. For example, user data in an HR directory may be more up-to-date and accurate than user data in a cloud-based identity provider. This can create discrepancies and inconsistencies in user data when attempting to create a unified view of user identities.
Third, each person may have multiple accounts that tie to their identity. On average, Oort finds that companies have 340.5 personal accounts (Gmail, Yahoo, Hotmail, iCloud, etc) with access to company data. Many of these accounts should be tied to a corporate account.
Overall, getting a unified view of every identity in a workforce requires careful planning, standardization of data formats and attributes, and the ability to reconcile discrepancies and inconsistencies in user data. Integrating different identity providers, such as Okta, Azure AD, HR directories, and other identity providers, requires a deep understanding of each system's authentication protocols, security policies, and integration requirements.
3. Managing Non-Human Identities
Gaining visibility of machine identities, also known as service accounts, can pose several challenges. Initially, service accounts are usually created to cater to specific applications or services and may exist across various systems, which can make it arduous to keep track and manage them.
Furthermore, service accounts can possess elevated privileges and access to sensitive resources, thereby making them alluring targets for potential attackers.
Additionally, service accounts might be shared among multiple users or applications, which can create intricate scenarios and security risks.
To obtain a comprehensive understanding of service accounts, organizations might have to implement tools for discovering and managing them. Besides, implementing policies and controls to monitor activity and regulate access can also prove beneficial.
Most importantly, service accounts must always be linked to one human so there is one “throat to choke.” Ideally, accounts should be tied to more than one human in case someone leaves.
4. Tracking Admin Access Across Shadow IT
It can be difficult to know all administrators across different identity providers, especially if it involves Shadow IT - the use of unauthorized or unmanaged IT resources and services. This is because employees or departments may use identity providers that are not officially sanctioned by the organization, making it challenging to track and manage all administrators.
Lack of visibility into who has access to what resources and data can be detrimental to an organization's security posture, especially in the case of data breaches. It is crucial to know all administrators to ensure that only authorized individuals have access to sensitive data and resources. Additionally, it helps organizations to optimize resource allocation and ensure that employees have the appropriate level of access to the tools and data they need to do their jobs effectively. Knowing all administrators helps organizations to manage their identity and access management (IAM) system effectively, reducing the risk of cyber threats and data breaches.
Worth the Slog: Benefits of Getting a Comprehensive View
Despite all of these challenges, building a unified view of your identities is well worth it. You cannot protect your identities from account takeover until you know what you are protecting.
Once you know what you’re protecting, you can then start cleaning it up, resolving inconsistencies, and improving overall IAM hygiene. By identifying risks like dormant accounts and removing them, teams can reduce their attack surface and reduce the amount of unforeseen work for other identity projects. These are not sexy or fun things to resolve, but they will set you up for success with other identity projects like Identity, Governance and Administration (IGA).
Finally, building a user inventory is one of the core projects required as part of any zero trust journey. We’ll be exploring this topic in more detail over the coming weeks and months.
Conclusion
The creation of a user inventory is fundamental to the success of an identity security program. A comprehensive user inventory offers organizations a complete view of all users, their access rights, and other relevant information to identify security risks, ensure compliance, and streamline user management. However, creating a single, unified user population presents challenges, including managing different user lifecycles, merging identities, managing machine identities, and understanding admin access. These challenges require careful planning, standardization of data formats and attributes, and the ability to reconcile discrepancies and inconsistencies in user data. Ultimately, building a user inventory is critical to implementing a zero-trust security model by providing complete visibility and control over user access and behavior.
Oort specializes in providing enterprises with a single pane of glass into their identities and gives them a unified view of their identities from HRIS, SSO, Cloud Directories, and other identity providers. Get in touch to learn how we can help.
