Creating a successful identity and access management strategy

Executives who want to create a successful Identity and Access Management (IAM) strategy must focus on people, processes and partnerships, according to the views of three IAM executives who explain some of the opportunities and challenges associated with rolling out an effective identity strategy. Here are their best-practice lessons.

DHL Group – build business credibility 

Andrea Jacob, VP of People Tech at logistics giant DHL Group, stumbled into the IAM space seven years ago when a manager gave her a mission to fix the people data problem. She says it’s been a challenging and rewarding journey on which she’s learnt that strong technology foundations are crucial to IAM but are not the only success factor:

Often, we underestimate the impact of change and the cause of change on the organization itself. We have operations in over 220 countries, with 600,000 human identities and about 300,000 non-human identities. You can imagine the scale of the many different data models and HR systems.

Using SailPoint technology, Jacob has addressed the IAM challenge through effective processes, such as ensuring people have access to the right systems. Data was another key challenge with as many as 90% of DHL Group’s tickets were triggered because the data was wrong. A mix of technology and people-focused sessions are helping her team to address IAM concerns, according to Jacob:

This year alone, we’ve organized about 170 information sessions with our change agents in the regions and countries, constantly telling them the benefits of strong digital identities. We bring them along so that they can help us to achieve the goal we want.

Jacob’s team has now rolled out its IAM solution to more than 100 countries. However, the journey is far from complete. Another important lesson from the project is the importance of business credibility and broad stakeholder buy-in, particularly from human resources colleagues. Jacob explains:

We’ve gained so much efficiency with the automation process. Now, before someone even starts working with the organization, every credential is created for them. We know who is coming and when they’re coming. They have their passwords and devices ready from day one. That kind of efficiency is very much appreciated.

When it comes to skills development, DHL Group has a policy of building internal IAM skills because identity is seen as a long-term, business-critical capability:

We need capable people with knowledge. However, we also need people with a ‘bite’ quality – the vision, tenacity and resilience to continue that long-term journey and not give up until the mission is achieved.

University of Leeds – develop internal capability

Phil Worsley, Head of IAM at the University of Leeds, moved into IAM after he created a workable remote-working solution for the institution during the COVID pandemic. His successes during that challenge led to him being given an opportunity to work across departments and deal with the university’s IAM systems:

I built good relationships during COVID, so there was a lot of goodwill when I started playing back the risks associated with how people were working. So, we’ve helped people change their IAM processes.

Worsley selected SailPoint’s Identity Security Cloud after replacing the university’s legacy homebrew username system was considered an “impossible” task. However, the SailPoint service has been used for over a year and provides a strong IAM foundation. His team played a crucial role in this implementation. Worsley believes that you can teach IAM skills, but not leadership capabilities:

Half of them had IAM experience in the past, and half of them didn’t. However, we now have a broad range of complementary skill sets, and everyone brings different things to the team. We get things done because we can fill the niches. Where we do have technology gaps, we go and learn.

IAM success is all about people, he argues. The university had worked with multiple solutions providers previously, and the processes often weren’t great. After COVID, Leeds invested in a significant IT change program. Once Worsley built the IAM team, he used these skilled professionals to deliver transformation effectively:

They were able to get things done. We were always in a win/win situation with the business. We were then actually able to let the solutions provider go. We then completed the projects with the team at a faster pace.

Inter IKEA – become part of the community 

Martin Sandren, Identity Product Lead at Inter IKEA, argues that there may be many reasons why an organization might initiate an IAM program and create a specialist team:

Is it because you need to meet certain client requirements? Do you have to deal with audit findings? So, you must understand, ‘Who is your real sponsor, and what does success look like?’ You also need to understand that perception is always reality. If you don’t have that insight, it’s very hard to be successful.

Whatever the case, IAM programs need a pyramid of skill sets, he adds. Many of the junior capabilities might be outsourced to disparate locations around the globe, including places like India and Egypt, although such an outsourced approach raises an important issue when it comes to the long-term development of people with IAM skills:

So, the question is, ‘Are we then expecting our graduates to move to India for a few years to gather the kind of experience you need to be able to take on more senior roles?’ Unfortunately, I don’t have a really good answer for that question.

One key thing Sandren wishes he’d known at the start of the IAM journey was that it’s crucial not to underestimate the data problem, particularly when measuring system performance. He also said it’s important to build up a supporting community:

Make sure to leverage the content and connect with people with similar setups. Meet over a virtual cup of coffee every now and then and talk about what you’re doing and your challenges.