Creating an identity and access management process

Abstract

This thesis addresses a method of developing an Identity and Access Management (IAM) process. IAM includes all the policies, technologies, and processes that are used to manage digital identities and control access to different data and resources within the organization. IAM is an important part of the organization’s security practises, and the possible complexity of organization’s infrastructure creates a need for a standardized process model.

The study explores the basic components, challenges and best practises of IAM and lists what should be noted when creating an IAM process. The study emphasizes that there is no one-fits-all process to IAM. Findings of this research highlight that IAM process creation requires careful consideration of organization's user base, business requirements, security demands and other characteristics.

The result of this thesis is a tailored IAM process for a large, Finnish organization. A specific Design Science Research Methodology (DSRM) was used to create the process. The basic steps of the methodology are to identify the problem, plan what the solution needs to do and develop an artifact to answer the need. The steps taken in the creation of the process and the key results are shared in this thesis. This thesis also offers a set of guidelines to follow when creating an IAM process.