Appalachian State University's IGA/IAM Program Straight Talk To Success

Addressing Technical Debt and Gaining Support to Build a Successful IAM Program

With a student body surpassing 20,000, changing academic and business requirements combined with growth in enrollment required the university to take a more strategic approach to IAM. Technical debt and resource constraints  were core challenges. At Appalachian State, Identity and Access Management (IAM) tools and processes developed organically as tactical responses to individual issues. It's homegrown system was difficult to maintain and adapt to the university's evolving needs. Its core IAM services were using a disparate set of tools including custom Banner tables, scripts, paper and electronic forms, and multiple directory service platform leading to campus-wide, manual laborious processes that were often the only control for authorization. The team lacked IAM Governance to help prioritize IAM efforts. Worse, it had multiple single points of failure. The university recognized the need to evolve its identity and access management (IAM) program to keep pace with technological advancements and the growing reliance on web-based programs.

Bryan Christ, a senior identity solution engineer from Bravura Security, highlights the significance of tailoring solutions to the unique challenges educational institutions face. Bravura's decades of experience in the IAM space allow them to understand and address these issues effectively.

Matthew McNaney, the IAM manager at App State, reflects on the university's journey. App State had amassed considerable technical debt and was outgrowing its existing systems. They needed a solution to help organize their homegrown systems and ensure better governance over their data. The university sought external assistance, marking the genesis of a comprehensive IAM project, the formation of an IAM unit, and the establishment of data governance committees.

Scott Wyant from Moran Technology Consulting played a pivotal role in assessing App State's needs. A critical point for the university was the realization that identity management extended beyond technical issues and required addressing business processes, collaboration across departments, and a shift from viewing identity as a technical problem to a programmatic one.

Overcoming Leadership Changes and Program Hurdles

The program faced challenges, including the departure of the initial IAM manager three months into phase one, highlighting the importance of leadership in such initiatives. McNaney himself had to quickly adapt to the complexities of IAM, from understanding banner tables to addressing the intricacies of access management for different user roles within the university.

As the program progressed, it became clear that IAM, often an invisible aspect when functioning correctly, required a proactive approach, outreach, and collaboration to revamp processes and garner trust from various stakeholders. The program's complexity underscored why many IAM projects struggle, given the extensive work, outreach, and data management involved.

"As time and technology have increased and gotten better...we found ourselves kind of at a deficit. And so we've reached out...to try to better organize our homegrown systems work within Bravura and also have better governance over our data."

- Matt McNaney, Appalachian State University

The Phased Approach: Laying the Groundwork for Continuous Improvement

App State's phased approach to its IAM project is indicative of the careful planning and execution required for such an expansive undertaking. With phase one nearing completion, the university's focus will shift to subsequent phases, including password management and request approval processes. The ultimate goal is not merely to complete a project but to establish a continuous improvement program that can adapt and evolve with the institution's needs.

"The program approach recognizes that if your vision is more than just select a tool and get it in place without causing too much ruckus, if the goal is larger than that and it's really to bring transformational value to your campus repeatedly over time, then identity and access management really needs to be viewed at the program level."

- Scott Weyant, Moran Technology Consulting

10 Key Recommendations

To ensure the success and sustainability of IAM, the following recommendations distilled from the Appalachian State University's experience offer actionable guidance for educational institutions embarking on their own journey to strengthen identity and access management.

"We really had to step back and...look at not just how is this program going to work for us and help us, but also how can we use this point of temporary chaos to also look at our business processes and try to make it not just fit the program, but just bring together the university in this process and try to make everything better."

- Matt McNaney, Appalachian State University

 

Strategic alignment involves ensuring that investments in Identity and Access Management (IAM) are in sync with the key goals and initiatives of an institution. It is crucial that IAM is seen not merely as technical middleware but as a pivotal facilitator for achieving broader objectives such as promoting diversity, equity, inclusion, implementing zero-trust security frameworks, and enhancing the digital experience for users. By aligning IAM strategies with these institutional goals, it can play a significant role in their successful realization.

To foster collaboration and outreach, it is essential to build and sustain relationships across various campus departments. By actively engaging with different stakeholders, the aim is not only to understand their needs but also to foster a collaborative atmosphere that supports the redesign of business processes and enhances data governance. This engagement helps in ensuring that the IAM program is responsive and tailored to the specific requirements of the institution.

A phased approach is recommended for implementing IAM programs. Rather than attempting to address all aspects at once—a strategy often referred to as 'boiling the ocean'—it is better to focus on specific functionalities and objectives at each stage. This method allows for more manageable work segments, provides opportunities for adjusting strategies based on feedback, and enables celebrating achievements throughout the process.

The continuous improvement mindset is critical, recognizing that IAM is not a one-off project but an ongoing program. It's important to put in place processes and systems that not only meet current needs but are also capable of evolving to address future demands of the institution. This mindset ensures that the IAM program remains relevant and effective over time.

Proactive leadership is key for the success of IAM projects. Given that changes in leadership can pose significant challenges, it is vital to have a succession plan in place. Building a robust team capable of driving the project forward, regardless of individual personnel changes, is also essential for maintaining momentum and continuity.

Educating and evangelizing the role and importance of IAM is another important step. This involves raising awareness among stakeholders who may not be familiar with IAM and highlighting its significance in the context of the institution's wider objectives and challenges.

Addressing technical debt is a necessity. It is important to identify any legacy issues that cause system inflexibility and create a modernization roadmap. This may require replacing or augmenting outdated, homegrown solutions with modern, supported technologies to streamline operations.

Effective data governance requires the establishment of clear policies and the involvement of stakeholders beyond the IT department. Such involvement ensures proper oversight and management of data access throughout the institution, thereby enhancing security and compliance.

Resource management is crucial for understanding the needs of both project execution and the operational side of the IAM program. Ensuring that the team has the necessary skills and capabilities to support the program's long-term objectives is vital for its success.

Finally, targeted implementation strategies should be employed when advancing access governance functionalities like request, approval, and certification processes. Identifying pilot groups or business units that can benefit early from these new processes helps to demonstrate value and refine procedures. Focusing on high-impact or mission-critical areas provides a strong starting point for broader implementation.

By adhering to these strategies, educational institutions such as Appalachian State University can effectively manage the complexities of IAM programs and establish a secure, efficient digital ecosystem that is well-equipped to face the challenges of a digitally connected campus.

Webinar Poll Insights: The State of IAM Dependency and Challenges in Higher Education

During the webinar, a series of interactive polls were conducted to gauge the reliance on and challenges of home-grown Identity and Access Management (IAM) systems within educational institutions. Participants, representing a range of institutions, shared insights on their dependency, the hurdles they face, and their approaches to stakeholder collaboration in IAM programs.

The polls revealed that a significant 63% of institutions are either completely or very dependent on their custom-built IAM systems, indicating a widespread reliance on in-house solutions. Specifically, 34% reported complete dependence, while 29% indicated they were very dependent. An additional 24% felt somewhat dependent, with only a small minority reporting little or no dependency.

In terms of challenges, an overwhelming 86% of respondents identified technical debt as a major obstacle in achieving a mature IAM program, followed by staffing shortages (61%), budget constraints (53%), and a lack of expertise (44%). Only 14% cited a lack of executive sponsorship as an issue, with 6% pointing to other unspecified challenges.

Regarding stakeholder collaboration, just over half (52%) of the institutions claimed to take a very inclusive approach, actively engaging with relevant stakeholders across various departments. On the other hand, 42% engaged stakeholders as needed, and a smaller proportion reported limited engagement, either within technical departments (10%) or with little to no effort to engage stakeholders outside of those areas (6%).

These responses were obtained through real-time polling during the webinar, offering a snapshot of the current state of IAM programs in higher education, as well as the collective experiences and perceptions of the participating professionals.

Partnerships in Appalachian State's IAM Journey

Moran Technology Consulting and Bravura Security can serve as strategic partners to universities and colleges seeking to enhance their identity and access management (IAM) systems. Moran Technology Consulting's comprehensive assessments and strategic planning align IAM initiatives with institutional goals. They support business process evaluation, solution selection, and implementation, ensuring that IAM solutions enhance user experience. Both firms offer change management, training, governance support, and continuous improvement strategies to ensure IAM systems are secure, compliant, and evolve with institutional needs. Together, they equip staff with the necessary tools and knowledge to manage and evolve IAM systems, ensuring they are robust, efficient, and strategically aligned. Meanwhile, Bravura Security provides end-to-end IAM and IGA solutions that automate and streamline identity lifecycle management, integrate seamlessly with existing systems, and offer robust access control and governance. Their advanced analytics and IDaaS solutions plus privileged access management ensure scalability and insightful data management, while their password management and governance services alleviate helpdesk burdens.

"The combination of either changing requirements we're maintaining that or staff shortages or loss of institutional knowledge can change that...that dependency on ERP is not just a source of authoritative information for identity, but actually playing a functional role in identity and access management can be a significant issue."

- Scott Weyant, Moran Technology Consulting.