When Did NHI Take Over My Day?
Trying a little dramatization of real adjacent events in a sort of Phoenix Project style story…Tell me what you think?
A little over two years ago I was reviewing my notes from a trip to Identiverse and came to the obvious conclusion “Hey, this non-human identity thing is going to be big,” and I even started looking at vendors and tools. For those of you in IAM and IT in general we all know that looking at tools before you’ve documented your headaches, summarized your policies, and procedures, and reviewed what you already have in-house as far as tools are concerned is a mistake. We also know that’s rarely how it gets started. Sometimes you do need a little inspiration from the market to show there is greener grass on the other side to gain.
That said, I was just tinkering around with it. Take in some demos, listen to some podcasts, engage in some debates. No harm in that, right?
Then the normal day to day work got in the way, the pushback when you started asking questions that meant others had to engage. In short it got deprioritized, not forgotten, just moved lower down the list of things to do. After all, no one has set any timetable on any of this, right? It’s just a novel and trendy thing in the space to look at….right?
So six months pass and what you thought was harmless looking around is pretty much sidelined. You get called in for a discussion.
“Hey we’re finding out that maybe our Application Accounts aren’t being managed the best way they could be, people are taking notice that maybe all the owners aren’t always doing the right thing and keeping tabs on things as they should. We’re going to spin up a project to have you do some house cleaning.”
Okay, that’s fine, we’ll retire some old accounts, beef up some language in our standards and policies. This really isn’t a big deal. We start down this path and slowly other questions start popping up. Eventually the question comes back a year later “Are we managing this right? Maybe we need a better inventory system for this?” At this point I think I’m ahead of the curve and remind them of some of the vendors I’ve already spoken to. It gets batted around and comes back, “No… no… let’s build this ourselves, we can do that and not invest or lock us into anything. Besides we have a few tools that might already help us out in the space, we don’t want to overlap.”
This makes sense—not as clean as I would like, and not as straightforward, but from a business perspective it does make sense. But that building of a new tool wouldn’t be an IAM project right? We’d just be a stakeholder right?… right? Well… yeah you won’t actually build it, but they are going to build what you ask them to. That way it does what we need both from an IAM perspective and a IT perspective. It’s a win-win scenario, and it’s most likely going to be less expensive.
Here’s the rub: I’m not a SME in the space, nor is anyone else around me. So the eventual path is take what you have, modernize it into a new platform and overall clean up the data you have. We’ll call that phase 1.
Wait, there are phases? Hold on, how long are we planning on working on this?
That’s the question you should have asked over a year ago.
But you didn’t—you just followed the path of breadcrumbs in front of you and accomplished what was asked thinking once cleanup and migration is over this would just fade away.
Or will it?
What started out as idle curiosity migrated to a small project, and now other questions are popping up. How’s the certification process on these? How well have you kept track of things? Maybe we should start tying this home-grown system together with other data and see what that reveals. Hasn’t our IGA gotten into the NHI business like everything else has?
These are all good questions, but does anyone else see that this is no longer the couple-hours-a-week side work it was a year ago? Somehow this is now something a group of people are going to spend some serious time on over the next few months.
Is it going to stop there? I’m betting not.
Tell me your NHI or similar story—where a small task turned into a project with the potential to become a full program.
I’ll keep updating along the way as we start diving more into this arena. Let me know if you’d like to see what’s next and follow along.
Leave a Reply