Many IT security professionals still regard role-based access and identity management as hopelessly complex because the predominantly manual approach used to review and manage roles is not scalable and the dynamic nature of roles themselves often get out of sync with reality.

The challenge of discovering established roles, defining new roles, connecting roles to IT infrastructure, ensuring roles meet compliance requirements and managing roles through their natural life cycles has proved to be too complicated and cumbersome to be practical. As a result, many have written off the roles concept as a failure. But roles are essential for sound governance, and the right roles-based access governance systems can simplify an IT security manager's job.

There are three key objectives to keep in mind for determining the success of any roles-based access and identity management initiative:

1. The people who manage roles should understand them. Role definitions should describe, in business terms readily intelligible to any IT security, audit/compliance or business manager within your organization, what a person assigned to that role does.

2. Roles should simplify users' view of access. Everyone that uses the roles-based access governance system should be able to see easily who has access to what and understand whether that access is appropriate (entitlements fit the role or are out-of-role, or create a compliance violation).

3. Roles should make the management of access more effective. Roles should speed up access delivery because adding a user or making a change to user access is now expressed by what roles the person has, which simplifies administration. Additionally, leveraging roles makes compliance easier because clear visibility exists for what is appropriate and inappropriate access. When entitlements are added to a role, or roles are combined, decision support is provided to proactively identify potential compliance violations or risks.

The best way to accomplish these objectives and establish the best role set for your organization is to follow these steps:

-- Engage key stakeholders who are involved with governing user access. Their input is essential to create a framework that drives what business abstractions will form the basis for representing access to information resources, as well as for role discovery and modeling. These abstractions are tied to business context -- such as job context, process context and compliance context -- or technical context scoped to a subset of the IT infrastructure. Collaboration on a role framework and role design between IT security teams and the business will ensure the best chance of success when roles are put into production.

-- Determine the existing access entitlements of all users. It is critical to have an automated access-governance system that can collect data from every possible repository of user entitlements, normalize and aggregate the data, and then put it into a user-friendly business context.