IGA Hyperautomation – WHY BOT?!

• Effectiveness of access controls continues to be critical to an organization’s security posture, which in turn relies significantly on the maturity of identity governance and administration (IGA) processes and platforms.
• However, there are still considerable gaps that IGA solutions simply can’t close.
• This post discusses how hyperautomation can be leveraged to extend IGA capabilities, close these gaps, and help organizations realize the true value of identity governance.

New Year, Same Challenges

For many across the world, 2022 started with a sliver of hope, and so far it’s been living up to expectations. For us in the world of cybersecurity, this year brought renewed challenges, but as always, there’s no dearth of excitement. These challenges are getting even more daunting with the geo-political shifts our world is going through. One of my New Year’s resolutions is to watch even more closely the threat vectors and vulnerabilities mushrooming at an exponential pace. As I review Optiv’s daily Threat Intelligence Report, I continue to see a trend that unfortunately isn’t new – ransomware continues to wreak havoc, social engineering attacks are on the rise, insider threat continues to be a major concern and, of course, threat actors are preying on organizational assets in the cloud. We’re also seeing the growing sophistication of these threats, but no matter how sophisticated they are, the delivery mechanism continues to be traditional. The delivery still relies on:

Given this vehicle for exploit delivery is more than often a human or a machine identity, it isn’t a secret that effective access controls continue to play a critical role in curtailing these attacks.

Strong Identity Governance Capabilities Are Still the Cornerstone

It’s a fact that enterprises across the world continue to invest heavily in building their identity and access management (IAM) and identity governance and administration (IGA) capabilities. What’s surprising, though, is the weak correlation between investments in IGA capabilities and maturity of identity-related controls across enterprises.

To analyze this correlation further, let’s take a closer look at a few patterns from the context of IGA:

The list can go on, but the bottom line is: identity governance is a big puzzle, and an IGA solution is indeed a significant piece that completes it. However, we’re still missing tiny but key interlocking pieces, without which the puzzle will continue to have gaps. Unfortunately, these gaps are large enough to open the doors to an organization’s crown jewels.

Traditionally, enterprises plugged these gaps mainly through excessive customization and custom scripting outside their IGA and / or ITSM platforms. Indeed, some large organizations have leveraged RPAs and AI OPS, which unless managed firmly, end up creating additional silos and disconnects, defeating the very purpose of the solutions.

Completing the Puzzle with Hyperautomation Through Readibots^™

Image

“Hyperautomation,” an approach for rapidly automating business and IT processes, continues to be an emerging trend in technology. Optiv has partnered with Readibots, a cloud-based automation platform that leverages Hyperautomation to solve the IGA gaps by enabling the interlocking pieces between organizational assets (on-prem and cloud), IGA solutions and ITSM platforms.

Readibots accomplishes this by following the product’s core principles:

A Brief Case Study

Context:
A Business Process Outsourcer (BPO) with ~100,000 employees (full time and contractors) had significant dependency on its workforce to be prepared to fulfill client commitments starting Day One.

Challenge:
A significantly higher contractor turnover rate meant considerable delays in onboarding and offboarding the resources, resulting in Operational, Security and Compliance risks.

Root Cause:
Complex onboarding and offboarding workflows in the existing IGA solution (Oracle), with excessive dependency on IT Admins for ITSM (ServiceNow) ticket fulfilment.

Image

Solution:
Rapid automation of the manual administrative processes associated with ITSM ticket fulfilment released admin overheads and drastically reduced response times, all without the need for process redesign or re-engineering.

Agile Delivery of IGA Automation Through Rapid Application Development

Success of Hyperautomation relies heavily on two attributes – speed and agility. As we continue to mature IGA automation at Optiv, these two attributes remain key to our methodology. We have been successful in blending in our knowledge of automation through PowerShell, IGA and agile delivery to design an optimized approach that significantly accelerates the value realization process.

Image

Optiv’s Hyperautomation Methodology

Conclusion

Effectiveness of access controls continue to be critical to an organization’s security posture, which in turn rely significantly on the maturity of IGA processes and platforms, an area that continues to see investments. Notwithstanding this correlation, we continue to see security vulnerabilities exploited due to weak access controls. Additionally, the convoluted business processes result in edge cases that are simply not addressed by IGA solutions. These conditions create a void that require extending the capabilities of IGA solutions by relying on manual workflows, resulting in further security, compliance, and operational risks.

Hyperautomation in IGA addresses these challenges by providing an integrated and centralized framework for building rapid automation of workflows and processes without the need for process redesign, and siloed automation and workarounds.