1 1 State of Oregon Identity and Access Management John Radford, State Controller Department of Administrative Services State Controllers Division

2 2 Agenda Approach Approach Vision Vision Current State Current State Problems Problems Potential Remedies Potential Remedies Successes Successes Q&A Q&A

3 3 Approach Access control identified in a vulnerability assessment as a critical security issue Access control identified in a vulnerability assessment as a critical security issue Initial funding through Certificate of Participation (COP) Initial funding through Certificate of Participation (COP) Procured IBM Tivoli Software Suite Procured IBM Tivoli Software Suite Developed I&AM Infrastructure Developed I&AM Infrastructure Development/Test/Production Development/Test/Production

4 Vision Create an enterprise solution that is: Standardized Interoperable Cost effective Identification of authoritative data source Identification of authoritative data source HR Personnel Data (no PII included) HR Personnel Data (no PII included)

5 5 Current State All environments fully functional All environments fully functional Agencies in development/test/production Agencies in development/test/production Directories/application for two agencies in test Directories/application for two agencies in test Directory and applications for two agencies in production Directory and applications for two agencies in production Requirements definition continues Requirements definition continues Two new agency directories Two new agency directories Existing agency applications Existing agency applications

6 Ongoing Efforts Updating Business case to determine future direction In-source vs. Out-source Development of new funding model Transition from a project to a program E-government Portal integration Single entry point for employees, citizens and business partners to all facets of government

7 7 Problems Encountered Concurrent I&AM build with new State Data Center Consolidation Concurrent I&AM build with new State Data Center Consolidation Hosting Cost Hosting Cost Lack of standards Lack of standards State has multiple systems State has multiple systems No standards for User Identities No standards for User Identities No standard Password Policy No standard Password Policy Enterprise solution is not mandated Enterprise solution is not mandated

8 Potential Remedies Establishment of a governance structure Solution is not mandated Solution is not mandated Agency commitment to meeting project schedule Agency commitment to meeting project schedule Currently funded via agency assessment Currently funded via agency assessment Bringing the right people to the table Bringing the right people to the table Proper mix of business and technology Proper mix of business and technology

9 9 Successes New agencies seeking to participate New agencies seeking to participate Completed development for Citizen and Partner interfaces to directory structure Completed development for Citizen and Partner interfaces to directory structure Demonstrated reduction integration time after two integrations with one agency Demonstrated reduction integration time after two integrations with one agency Third effort required less than 30 days Third effort required less than 30 days

10 Q & A