EmpowerID Role-Based Access Control
Centralized role-based control automated by your business
 Today's business environment demands that organizations automate permissions management processes while adhering to regulatory and compliance mandates. However, relying on traditional processes and systems to manage the challenges of granting and maintaining such access for thousands of users connecting to thousands of systems, applications and devices creates far-reaching problems for even the smallest of organizations. In almost all cases, these processes are labor intensive, expensive, inefficient and error-prone. They are not scalable or easily distributed and are inherently difficult to secure and to audit. The result is that most companies have no idea of who should have access to what, and what's worse, no easy way of finding out. What is needed is a platform that unifies visibility, audit, and enforcement over all enterprise systems in a single security model. The concept of Role Based Access Control (RBAC) was built upon the premise that access to an organization's data resources should be controlled and managed using a set of pre-defined roles. RBAC simplifies administration by reducing the number of direct permissions assignments between people and resources that need to be maintained. RBAC also improves the delineation of privileges and accountability based on job responsibilities to grant only appropriate access rights while maintaining separation of duties. Unfortunately, RBAC implementations have proved challenging for organizations often requiring dramatic process changes and long consulting engagements. These processes typically analyze an organization's business structure through intensive interviews for each process to determine who does what in each business process (top-down), or they analyze large amounts of system permission data (bottom-up) to determine who currently has access to what. The goal in both approaches is to cluster people into "candidate roles" that map the greatest number of people into the fewest number of roles required to grant the expected level of access across all systems. After this arduous process, organizations must migrate into this new permissions model and frequently reassess to ensure that roles are still optimal as the business changes. EmpowerID solves these challenges and dramatically simplifies this entire process by offering a truly innovative RBAC model that eliminates most of the problems encountered in typical RBAC implementations. EmpowerID allows you to easily bring role-based identity and access management to your business. Using a uniquely powerful and flexible framework comprised of Organizational Roles, Organizational Zones, and Resource Roles, EmpowerID makes rolling out RBAC a non-disruptive process that allows for immediate value while supporting continuous improvement and optimization rather than requiring months of planning and deployment. EmpowerID's RBAC model solves many of the challenges by offering permission assignment using a polyarchy model. This simply means that the permissions assignment model is flexible and allows access to a resource to be granted based upon the combination of what a person does in the organization (Organizational Role) and where they work (Organizational Zone). This enhancement to RBAC dramatically reduces the number of roles required in situations where employees with the same job title (e.g. Bank Teller) work in many different locations and need access to many of the same resources but also deviate specifically based upon their location. Without the dual assignment model, a Bank Teller Role would need to be created for every possible bank location. This "role bloat" typical of other systems, reduces the value of RBAC and dramatically increases complexity and the amount of manual work required by a system. With EmpowerID, users can be manually assigned to multiple Organization Zones and Organizational Roles or automatically assigned and removed based upon live queries against your business systems. Another significant extension to RBAC is the Resource Role. A Resource Role is an application or resource type-specific definition of a set of rights that make sense for that particular system. A common example might be the Contributor Resource Role for Microsoft SharePoint. Membership as a Contributor is meant to convey a specific level of access in that application. EmpowerID allows these Resource Role definitions to be defined for every type of resource that will be managed by the EmpowerID entitlement management system. These Resource Roles then codify a specific level of access in each of your applications which is enforced so you can ensure that "Contributor" in SharePoint always has the specific rights you have defined via your policy. This centralization of resource-specific role definitions ensures consistency and auditability of permissions. More importantly, it allows a seamless migration process to RBAC by allowing the discovery of existing users' permissions in resources and the mapping of their EmpowerID RBAC identities to these Resource Roles. Role bloat is avoided because roles are managed via definitions for a type of resource, instead of requiring that separate roles be created to grant access to each specific resource. EmpowerID's role governance and role administration can be delegated by policy to allow the right people to make the right access decisions. The entire process is managed through a configurable, easy-to-use graphical user interface that gives business users and IT personnel the tools to manage roles and access. Built on a services-oriented, standards-based architecture that is easy to deploy and manage, EmpowerID integrates seamlessly with your existing IT infrastructure and is designed to scale with your business. |
      |