EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
How EY can help
-
Our Cybersecurity strategy, risk, compliance and resilience teams help organizations with their current cyber risk posture and capabilities.
Read more
1. Legacy ecosystem management is increasingly challenging
Most organizations have some form of identity ecosystem in place — typically on premises, increasingly complicated thanks to organic additions of tech and various apps over the years. These legacy ecosystems can frequently involve an identity governance and administration (IGA) product of some sort connecting with other custom bespoke systems, adding complexities, redundancies and inefficiencies. While an effective identity and access management (IAM) system is mission critical for every business, as the cloud era evolves, they are becoming increasingly inefficient and costly to manage.
Maintenance demands an extended team of experienced tech professionals who understand both the wide variety of digital identity product technologies and how to run an overall IAM ecosystem. Individuals with that skill set are becoming increasingly scarce as the industry migration to cloud technologies continues in a tight labor market where cybersecurity workers are already in short supply. This kind of reliance is more than challenging — it now leaves companies vulnerable. A full transition to simplified cloud-based operations with reduced staffing requirements and simplified access protocols is now essential for both best-in-class business operations and mature cyber risk management.
2. Identity becoming key to unlocking change
Like any utility, identity is largely ignored until something goes wrong. But according to the 2022 State of Enterprise Identity Report¹ from Saviynt and the Ponemon Institute, identity, in fact, has become both a significant organizational risk factor and one companies are ill prepared to mitigate. Even though 56% of enterprise organizations averaged three identity breaches in the past two years, 46% of those organizations failed to comply with regulations due to access-related issues.
While identity governance plays a critical role in all businesses, it can also have a significant impact on companies undergoing change: mergers of organizations and the unification of disparate IAM tools and tech platforms or during times of divestiture when identity is the key to critical access for the new company. Those organizations looking to benefit from future cloud-enabled business efficiencies transitioned to the cloud must begin by tackling IGA transformation, a process that will necessarily involve rationalization of the tech environment and initiating supportive change management.
3. Simplify and streamline to take advantage of the cloud
As costs and time to manage systems escalate, more successful business leaders are seeking ways to rapidly simplify. That process includes the migration from resource-intensive, on-premises systems to streamlined password-free environments with cloud-based apps that require minimal infrastructure-related maintenance. The best simplified identity environments are cloud enabled but support multiple capabilities beyond IGA including third-party access and privileged access management with the goal being to reduce the number of vendors in the ecosystem as well as required investment from chief information security officers (CISOs) in product tooling.
4. Enact change management for success
Leading-class cloud migration demands two strategic imperatives. First, chief information officers and CISOs must take a leadership role in gaining the buy-in of executive management to drive an understanding that the rules for cybersecurity are changing. Doing this will help sell required process changes to business unit leads across the organization. Second, companies will benefit from the involvement of a strategic partner that can bring several critical elements to the table, including the expertise to help navigate the selection of cloud platforms, consolidate tools, and rationalize tech and data for cost savings and efficiencies and deep capabilities in helping enact and communicate internal culture change throughout the enterprise. For many organizations, identity governance systems were designed two decades ago. The world of cybercrime has changed dramatically since then, and it’s time for CISOs to help their organizations catch up.