Symantec Identity Governance and Administration Reviews

The most valuable feature is probably the role-base access granting, so we actually control everyone's access through roles. There are ad hoc accesses, but for the most part by being on-boarded as an employee or as contractor, you get a different set of baseline accesses. Those are managed through the Identity Management suite. Those will give you things like email, active directory account, access to our remedy ticketing system, and access to CA PPM.

It also allows us to manage different types of users in different scenarios and different structures in active directory. For example, if you're a union warehouse employee, you don't need an email address. Or, if you're a contractor, it doesn't matter where your location is because you'll never be treated as an employee. All those different attributes are managed through Identity Manager.

Before we had this role-based control, we manually requested the security team to create a profile in the right place and to give individual access for each new hire. Now, Identity Manager reduces the manual requests for on-boarding someone. It helps ensure that when a new hire comes in, they automatically have the same access as everyone else on their team.

We are using the IDM solution for customer identification and authorization. We just started the project about a year ago. We have already implemented IDM on our website and our mobile applications. So far it's looking good. It's an interesting question because what we are getting back from our customers, they're quite afraid of what's happening because we have actually gone down from three identifiers on our website to two. In our mobile applications, we are now enabling one identifier and we have just implemented fingerprint recognition. Our customers were calling us and asking "look we are seeing cyber attacks happening, identification being stolen all over the world. How are you actually going down and using only this parameters for identification?"

I think that the CA product enables us to do that. Get more security with lesser need of user identification.

There are actually quite a few nice things on the CA roadmap in the future. I think to have ability to enable our customers to have different roles, because we have customers that they can be a private customer, they can be part of an organization or a corporation and they need to have different roles. I think that's still something we will see in the future. We have some basic product to do that and we are starting to implement it but it will take us some time to get there.

We use this solution for pre-provisioning, large cycle management, and governance, i.e., access review.

The product is relatively easier to use than other identity management products, such as Oracle Identity Management, Micro Focus Identity, or IBM Security Identity Manager. Also, it offers a few free connectors for connecting to applications like SAP, Aruba, etc.

The range of provisionning possibilities, such as native connectors and tools which facilitate the development of new ones.

• The automatic creation and removal of the accounts
• Passwords change process organized and controlled by the user
• Least priviledge rules applied
• Profiles easy to configure, so less people are needed to administrate the solution
• All processes around user accounts are simplified
• Assets and business modeling improved

One of the primary features we use is the password reset. The challenge we had was that our helpdesk had to manually reset customers in the field and reset their passwords one at a time, so we implemented CA Identity Manager to allow us to automate this self service reset of passwords.

One of the biggest benefits is the reduction of calls to the help desk. We reduced by a third our calls for password resets because users of the system could then reset themselves using the challenge questions and you know, people forget passwords it's an easy function. That was a huge benefit.

The primary uses cases are:
- The analysis of privileges to generate roles
- Revision of segregation of rights based on client rules
- Certification of privileges (compliance)
- Fulfill the cycle of existing privileges, under review / approval and delivery to the IM solution to materialize the changes and maintain the standard

In the processes where we need to analyze data, IG has enabled and facilitated the analysis of privileges, generation of roles to cover RBAC and integrate with the solution of Identity Manager, as well as the compliance aspect by the certification of privileges “Compliance”.

Additionally it helps us in analyzing predefined SoD rules for SAP and any others applications where the client defines their business policy rules.

• The xPress technologies (connector xPress/Policy xPress/Config xPress)
• Integration with API Management and other CA solutions
• Facility to publish the web services of any task of Identity Manager
• Ease of integration to leverage authentication processes managed by Identity Manager and called by external applications
• You do not depend on the supplier to change screens and validate field, create notifications, etc.
• True integration between CA Identity Manager and CA Identity Governance for better use of compliance approved roles, data exchange and improved customer experience
• Availability to implement in the cloud
• Take advantage of important features of Identity Manager and Identity Governance on the Portar offered by Identity Suite (best user experience) and less technicall knowlegde need

What about Identity Governance and integration with Identity Manager?
This solution makes a seamless integration, leveraging the power of Identity Manager connectors it import the data obtained to Identity Governance; in the opposite direction, the results campaigns from Governance have the ability to update in automatic way the information in Identity Manager, enabling materialization of privileges changes and fulfilling a RBAC model (It is the business strategy to the lowest level of privileges in applications)

Through the implementation of "Identity Suite Virtual Appliance" have created a supremely quick and convenient way to install (Identity Manager / Governance / Portal) with even high availability. Multiple scenarios available on a single console.

It has increased our automation and maintenance of SLA security functions. Additional compliance of all activity relate to provisioning, self-service, and all critical transaction of security management.

The most valuable features to us are:

• Provisioning engine (on the back-end, separate from front-end components, that's part of layered architecture);
• Access-request system (to manage on- and off-boarding of users); and
• Mobile interface (ability to manage workflows and user requests from smartphone).

Through the centralization and automation of access management functions, and providing a baseline for identity and security analytics, we've improved our security.