CIO —
How do you launch a multimillion-dollar identity-management effort at a company that has 129,000 employees in seven business sectors, spread across 50 states and 25 countries? For defense contractor Northrop Grumman, the answer is simple: one well-planned step at a time. “We think it’s better to take a somewhat measured pace and minimize the risk of disruption, rather than go for a big bang,” says Keith Glennan, VP and CTO.
About a year and a half ago, Northrop Grumman began looking into identity-management systems to improve security, facilitate regulatory compliance, make it easier for users to log on to multiple systems (without using multiple passwords), and reduce the cost of provisioning and password-management burden on IT. Glennan’s team ran a pilot with a few hundred users across the company in early 2004. In addition to automated provisioning, the pilot also used smart cards and linked user network log-ins to application log-ins.
The pilot was successful on two fronts: It showed how identity management could make life easier for users and for IT, and it highlighted identity-related policy issues that needed to be ironed-out before such a system could be implemented companywide.
“Policy is at least as big a challenge as the technology, because you have to make a lot of decisions about what rules you’re trying to enforce,” Glennan says. “It gets into cross-functional jurisdictional issues in terms of who can create identity, what is the authoritative source of identity within the company, and how you deal with outside people who need access to your systems.”
When the pilot was completed, a steering committee that included representatives from HR, IT and security debated policy issues. They decided to make the HR system the authoritative source of identity so that it would drive the identity-management process, including e-mail provisioning. “Effective identity management requires the elimination of multiple points of identity creation,” Glennan says.
The team also decided that Northrop Grumman’s procurement organization will create identities for suppliers and business partners that need access to the company’s systems. (In the future, Northrop Grumman plans to move to a federated identity-management architecture to ease the process of working with suppliers and business partners not on its network.
Glennan plans to re-architect directory services and to roll out an automated provisioning capability, which will take about 18 months. Once the infrastructure is in place, he says, his team will work its way through Northrop Grumman’s entire application portfolio, prioritizing which apps should be linked to the identity-management system for user provisioning and sign-on. Apps with the largest number of users will be enabled first, and those with only a few users may never be enabled.
