Start with the Data, Not the Org Chart

As I (Nick) mentioned in my previous post I had just picked up the reins of a troubled RBAC project, one that made me question whether such a thing could even succeed at the bank in question. Every previous run had begun with the org chart, and there was some evidence that this should work, I knew that John had recently created an org chart Role Structure at his last client and he said that it was the way to go. Someone would gather a department into a room and ask what access it should have. Nobody can answer that from a blank page, so the meetings multiplied, the drafts aged, and the reorg always arrived before the model did. Their RBAC program was burning money and generating nothing in value. I knew we had to do this another way.



I started from the opposite end of the problem. Pulled every identity and every assignment the bank already had, and asked a small question: which groups of identities share most of their access? The answer was sitting in the data. We didn't need a workshop to find it, just a toolset to turn it into something humans could read. It was a little surprising that this toolset didn't exist in the IAM system to begin with...

Thankfully our company did have just such a toolset. John had created it for a previous client, and if his advice to start with the org chart was bad, the toolset wasn't. But it did need some tweaks. It needed to not just create the analyses to be reviewed for roles, it needed to estimate their value in advance. Calculating the value of a role is a simple matter: it's just the number of people the role applies to multiplied by the number of pieces of access it covers. That's for a role that already exists. Finding the value of a potential role is only a little trickier, you need to make a guess at what access will be included in it based on numbers alone. The only thing you have to work with at this point is how common the access is, pick a value, a percentage, apply it across the entire set of access to look for commonality. Good thing we owned the source code.

I didn't try to make a job title model work - I just tried everything, all at once, with the power of data science tools (and some really hot CPUs) and found the ones that were most predictive of common value. The winning method didn't start with job title (department, division, etc.); instead, it examined every distinct population the bank had and ultimately found that job title was the best predictor of common access.

How could two role models that were wildly different from each other both succeed? Because they're different organizations, with different histories, different people and different access. Role Models are not one-size-fits-all, but finding the right Role Model was only the first part of the challenge...