When Leonardo Morales from Siemens first attended the European Identity and Cloud Conference, he tried to gather experience and knowledge from others to avoid common mistakes on his IAM journey. Now he is giving a keynote speech Siemens AG: Real-World Enterprise IAM at Scale on Wednesday, May 11, at the European Identity and Cloud Conference 2022 to help others overcome the same hurdles.
To give you a sneak preview of what to expect, we asked Leonardo some questions about his presentation.
Why is IAM important?
IAM is important for Siemens to do business and be a better competitor in the market. Siemens needs to move from the intranet to the Internet. We need to implement architectures to verify authorised access from anywhere and from any device for the purpose of security in our hybrid environment, but also to automate the provisioning of new employees. Therefore, we need a very well implemented IAM system that also has the responsibility to verify the authenticity of people in relation to their identity and to perform the appropriate lifecycle processes according to business and control regulations. This is why IAM is so important for Siemens.
What are the biggest challenges you’ve faced so far?
Yes, I remember when I started this journey, I thought we knew what we were going to do and how we were going to do it. But we hadn't considered the biggest challenge, our data quality and the many processes around identity and account management. That was a nightmare. We were dealing with more than 100 identity data providers, more than 200 Active Directory providers and different processes. And we've had to find out time and time again that not all of them are compliant. This is because of the data, incorrect and inconsistent data that requires continuous data cleansing. That was the biggest challenge, to create reliable and trustworthy automated processes.
What is the most common mistake organizations make in IAM projects?
This question is very good, because I have to think about our start. It was not just about choosing a simple process or tool, but more than that. It's a really holistic perspective, an assessment that everyone has to make in order to meet the right expectations. The biggest mistake at the beginning of the project was that we didn't have a clear idea of what we wanted to achieve, and we found that out quite late. The second mistake was underestimating the effort and the costs. I think it is obvious that it is not a one-time implementation, but a process that goes from the beginning of the project to the enforcement and implementation of new processes and regulations that become part of daily working life. That, in my view, is the biggest mistake.
What is the one thing you would like people to take away from EIC?
Yes, when I first participated in the EIC, I tried to gain experience and knowledge from others to avoid making the same mistakes or falling into the same traps. For me, it was important to know and learn from others. Therefore, I would like to share our experiences, recommendations and future expectations on the topic of IAM in a large company like Siemens, which has different business units in many countries and is constantly changing.