Information Technology Reference
In-Depth Information
The Modern Enterprise - A Reality Check
So You Think You're Going to Change the World
If you're reading this document, it's probably because you're an enthusiastic
and idealistic change agent who wants to shake up their organisation with a
simpler, faster and cheaper model. That's great, but we're painfully aware
that even our simple and cost-effective approach may not work for you,
because your organisation may just not have the right culture to accept
solutions like this.
What makes it really hard to implement an IAM system isn't the technology.
You would be half right if you thought it was data. Yes, cleaning and
reorganising huge volumes of legacy data are moderately hard tasks, but
they're not exactly insurmountable. What can stop your IAM initiative in its
tracks is that elusive beast known as organisational culture.
Here are some killer characteristics we have identified. If you perceive a
scarily close resemblance to your own organisation, stop reading this paper
right now. It will only frustrate you needlessly.
Brand-Name Idolatry
: Some organisations will only buy “reputed” products
from big brand-name vendors. We've heard all the arguments about risk that
are raised in such organisations, and our cynical observation is that this is
more about political risk to decision-makers (i.e., “Nobody ever got fired for
buying IBM”) than any real risk to the organisation. In our experience, the
brand-name path involves plenty of effort and expense, and a rather low
probability of success
5
, for reasons we cover in a later section. If this is your
organisation (especially if your security auditors put their faith in products
rather than in adherence to principles), you should probably fall in line and
console yourself with the thought that they deserve to waste their money
anyway. Cost-effective solutions take a back seat to political survival at such
organisations.
Hostile Fiefdoms
: People and systems need to play ball, at least to some
extent. If there are areas in your organisation that require to be brought
under the ambit of IAM, but they refuse to change the way they work and
5
Projects that greatly exceed budgets should also be counted as failures.
