Simplifying Identity Management with Roles
Key Points
- The speaker proposes a role‑based approach that can shrink identity‑management size, cost, and complexity by orders of magnitude, making security easier because simplicity reduces vulnerabilities.
- Managing permissions per individual user creates a tangled “spaghetti” of unique entitlements that are hard to track, especially when users leave the organization.
- Introducing **business roles** (e.g., doctor, nurse, lab technician) groups users by function, while **application roles** group the underlying permissions needed to perform high‑level tasks.
- Mapping business roles to application roles lets administrators assign a single role to grant all required entitlements for a task (like admitting a patient), dramatically simplifying provisioning and de‑provisioning.
- This layered role model streamlines operations, cuts costs, and improves security by reducing the number of granular permissions that must be administered.
Full Transcript
# Simplifying Identity Management with Roles **Source:** [https://www.youtube.com/watch?v=5v4v-MPoEOs](https://www.youtube.com/watch?v=5v4v-MPoEOs) **Duration:** 00:09:00 ## Summary - The speaker proposes a role‑based approach that can shrink identity‑management size, cost, and complexity by orders of magnitude, making security easier because simplicity reduces vulnerabilities. - Managing permissions per individual user creates a tangled “spaghetti” of unique entitlements that are hard to track, especially when users leave the organization. - Introducing **business roles** (e.g., doctor, nurse, lab technician) groups users by function, while **application roles** group the underlying permissions needed to perform high‑level tasks. - Mapping business roles to application roles lets administrators assign a single role to grant all required entitlements for a task (like admitting a patient), dramatically simplifying provisioning and de‑provisioning. - This layered role model streamlines operations, cuts costs, and improves security by reducing the number of granular permissions that must be administered. ## Sections - [00:00:00](https://www.youtube.com/watch?v=5v4v-MPoEOs&t=0s) **Simplifying Identity Management with Roles** - The speaker explains how adopting role‑based access control dramatically cuts the size, cost, and security risks of managing individual user permissions by replacing a tangled per‑user setup with a streamlined, reusable role structure. ## Full Transcript
what if I could show you a way that
would reduce the size and complexity of
managing user identities by two or even
three orders of magnitude it would cut
down on cost it would make the operation
more efficient and it would make it more
secure because it was more simple and as
I mentioned in other videos complexity
is the enemy of security
so let's think about managing these
identities without user roles and then
with user roles and I'll show you the
advantages of using roles so what we
think about first is we've got a bunch
of users here who need access to
Applications
simplistically it sounds like this I'm
going to give this guy access here and
here and I give this guy this access and
that's all they really need that's what
it seems like but in fact it's more
complicated than that
what happens is inside of these
applications there may be individual
permissions that are necessary for
instance it could be an administrator
access it could be read only access it
could be read write access there could
be a lot of different underlying
permissions that need to be granted so
in fact instead of this gross level of
permissions that I'm giving in fact what
I really need to do is give this guy
these access rights and this guy needs
these
and this guy needs these and it
continues before long you end up with a
spaghetti mess that you've got to manage
every user is a one-off every user is
unique every user is complex and when I
have to unroll all of these access
rights when the user leaves the
organization it gets even more
complicated and more costly and more
difficult to accomplish
so let's look at a different approach
where instead of doing individual user
to permission or entitlement accesses
I'm doing those mappings I'm going to
introduce another concept we are now in
the middle I'm going to have this idea
of user roles so I'm going to create a
set of roles at a business I'll call
these business roles for instance
there's a role uh let's talk let's say
this is a hospital so we have a doctor
we might have a nurse we might have a
lab technician those are the business
roles so business roles are a collection
of users
I'm also going to create a second
abstraction of application roles and in
this case these are going to be high
level functions that need to be
performed so maybe the high level
function is admit a patient or discharge
a patient or update a patient record
so those are high level things in fact
those high level features might involve
multiple underlying permissions in
different applications
so now you see it gets a lot more
complicated but what I'm trying to do is
reduce that complexity
so once I've created these two different
tiers of roles business role is a
collection of users application rolls a
collection of entitlements or access
rights then all I have to do is come
back and say okay to admit a patient
what do I need to be able to do well I
need to be able to have access to these
two features along with this one which
is actually in a different application
imagine in a complex organization there
might be six or seven applications that
need to be involved in performing a high
level function
so to discharge a patient maybe I need
these and to update a patient record I
need these
now I've mapped out the application
entitlements up here all I need to do is
say which ones are these people are
doctors okay here are my doctors
here are my nurses and here's my lab
tick
now I've created the collection of
business roles and those users the
collection of application entitlements
and all I have to do is connect the dots
I'm just going to say doctors can admit
patients discharge patients and update
patient records nurses cannot admit and
discharge but they can update records
and lab techs when they get in the lab
results can update patient records
that's all I have to do the beauty of
this then is the flexibility that
happens over time let's say later I need
to add in a new entitlement here
and this now is required anytime I
update a patient record
then all I have to do is add in this and
the update capability now involves that
entitlement
and all the people who have the update
capability in this case it's all of
these users now have this new capability
and if later I decide for whatever
reason I'm not going to allow uh nurses
to perform a perfect particular function
I just take that function out of the
nurse role and all the nurses now lose
that capability or add something in all
of those users
instantly gain that capability
by separating these two different layers
I don't end up with a spaghetti I end up
with something that is much simpler to
manage and it feels like now instead of
managing what might be 5 000 users it
feels like I'm managing three users if
I've got three roles so I've taken the
the magnitude of the problem and reduced
it dramatically
so let's think about what are some of
the best practices then in role
management if we want to carry this
through and there's a number of things
you can do here
for instance don't make the mistake of
letting the perfect become the enemy of
the good
in doing so I've seen organizations that
try to Define this in a perfect way that
will meet all the needs for all time and
the fact of the matter is we don't need
to do that it needs to be flexible it
will change over time one organization I
worked with took a year to Define their
roles that was a delay on the process
because they were letting the perfect
become the enemy of the good the second
best practice is related to that first
aim for more like an 80 20 split
try to cover your role entitlements and
accesses with about eighty percent of
the cases with something like this and
then let the other 20 be exceptions and
we can handle them as one-offs more like
this but I've still reduced the problem
space dramatically
other things I can look at is role
design or role engineering where I sit
down as I've done here kind of as a
tabletop exercise and envisioned how
these roles should should be I can
Envision that these are the different
types of users these are the different
access rights and we do that kind of an
exercise this is more of a top-down
approach
the bottom up approach is more of a role
Discovery process and there are tools
that will allow you to go out and see
all of the entitlements that a user has
and what function they perform and then
you can go through and see all of these
users who are peers seem to have the
same access rights so let's create a
role around that and therefore we're
essentially discovering the roles that
already exist in the organization that
just have not been explicitly stated
I would actually recommend using both of
those the top down and the bottom up the
design and the engineering and let them
meet in the middle and then we apply
some of these other principles
principles that I've talked about in
addition to these uh we also should use
good tools that allow us to do this
discovery and there are Enterprise class
identity governance tools that will
allow to do this allow you to manage it
and manage this over time as these roles
need to change we'll need to make those
kind of changes and then finally the
thing that I've Illustrated here and
that is use multiple tiers of roles
because if we try to use a single roll
structure we'll overload it here I
separated out the groups of users from
their entitlements that way I have more
separation I can change the entitlements
without changing the users I can change
the organization of users without having
to change their underlying entitlements
that gives me the maximum level of
flexibility and it keeps me from that
sort of analysis paralysis that I
mentioned the other organization I
talked about hit so you can see I hope
with this that I can take a very complex
space reduce it to a much more
manageable space therefore with this
more manageable space it's cheaper it's
more efficient and I'll argue even more
secure because complexity is the enemy
of security and this is simpler
thanks for watching please remember to
like this video And subscribe to this
channel so we can continue to bring you
content that matters to you