Identity Management: Critical Infrastructure

Why an Identity Management Infrastructure is like a Highway Interchange.
Why migrating to it requires similar practices to those employed in the complete reconstruction of the interchange below.

As-Is: Marquette Interchange Completed: 1969	To-Be: Marquette Interchange Construction: 2005-2008

Road Infrastructure is a very good analogy to an Identity management Project. The two pictures here are an actual photo of a major freeway interchange in Milwaukee Wisconsin, prior to total replacement (left) and a computer generated model of the interchange as it will exist after upgrades in the design and total replacement.

How does this relate to IDM?

1. Data flow is already going on; your business operates... everything is "working"... perhaps not optimally, but it is functioning. Just like the old freeway interchange on the left is "working." In fact, prior to the freeway interchange, city streets existed that "worked," to a point. But the city grew to a point where a better way was needed.

So, engineers analyzed current performance of the interchange... throughput, delays, dangers, failure potential... and proposed a new model for solving existing problems and meeting projected traffic needs. Similarly, you've identified weaknesses, strains, inefficiencies in the way your company manages Identity Data. In most cases, implementing IDM is more akin to implementing the interchange to replace a mesh of "surface streets" that are inadequate for the needs of your business.

2. Desire to improve requires clear definition of the existing process, and identification of opportunities for improvement. What specific business needs does the IDM "interchange" solve? What isn't working? Where are we experiencing the most "data" crashes? What is too complex? What is dangerously impeding traffic? What bottlenecks to efficient transport can we eliminate?

Identifying opportunities for improvement requires REAL understanding of how the process functions currently. An accurate "As-Is" model. Implemented in 1969, the original interchange model is no longer adequate. Areas of inadequacy are identified and prioritized (numeric callouts in the picture). Details can be found at http://mchange.org if interested.

3. A New model is proposed to best address the areas requiring improvement. (picture on right) Migration from "as is" to "ideal Model" depends on having a VERY well planned ideal model. Knowing what "done" looks like.

Example: The old interchange had left-hand exits identified as causing too many lane changes, and hence more accidents. A principle of the new model was, "We will design an interchange to eliminate left hand exits."

An example you may face in IDM terms: "We have four different LDAP systems, each containing partial authentication information; this results in excessive client configuration, and administrative maintenance." This might result in a design principle like, "The new Identity Infrastructure will provide a single, authoritative LDAP authentication system for the enterprise." It is this kind of concrete, explicit design principle that can be used later, during construction, to weigh and validate proposals that do or do NOT meet the design criteria. All contractors understand the desired end-goal and are building to meet that design.

Will your Identity Management infrastructure be built on principles, or on ad-hoc decisions forced by short term pressures?

4. Migration from "As Is" to "To Be" depends on step by step sequence for achieving model with minimal impact to existing services. Which on-ramps will you shut down first? Where will the existing traffic go during construction?

Your business, and the data flow that supports it, must continue during the changes. The people affected by the changes must be notified of the new "detours" or permanent routes established. Processes will change... will the owners of the process know it in advance?

5. Migration from one process to another ON-TIME and UNDER BUDGET was achieved in this freeway project, because the scope of the project was so meticulously planned. Is your Identity Management implementation going to come in on-time and under budget?

6. When complete, the system is still complex, but strengthened to better serve the present and assumed future needs. Your environment will continue to evolve, however, so don't expect the new version to be permanent. Just best for now, based on all known needs.

Copyright 2007, Rob Schneider; HyperX Systems, LLC