Todd Wiedman: IGA with the Power of ServiceNow

Great. Thank you very much.

Good day, everybody hope you're doing well and had a great lunch. So today I'm gonna talk a little bit about what I see with IGA and the power with ServiceNow to get started. I'd like to first just cover a little bit about our environment.

As I said, Landis and gear is a utility supported company. We have locations across the us AMEA and Asia Pacific. We do have on-premise cloud applications. We also use software service for delivery with our customers as well. We have about 6,000 employees that are, that are split across all those locations as well. From a service now perspective, we started our service now journey in 2019, and it was really focused around implementing this some security and compliance modules that was specifically used for my team. We also started the CMD, the buildup at that time.

And then in 2020, we added two additional focuses. One was ITSM in general. So ticketing and changes and problem management, as well as customer experience. So helping make giving away for our customers to, to be managed better in environment from an identity management perspective.

We have, we, we have had in the past multiple solutions, very specific regionalized solutions, as well as one off solutions to manage track and review our access. It was also managed very manual. So we had a lot of user access reviews and things like that that we had to do in a very manual fashion. It was a project started in 2019. That was a global project to deploy a solution across the entire organization for all the applications in our environment. This also included working on the solutions for the customers that we support.

So in the terms of the old David Letterman, top 10, I thought I would list my top five value ads that we have seen with IGA on service now. And so number five development skills are based on service.

Now this was something that in the past, I've worked with a lot of identity management tools, and I always ran into the problem of trying to find the right people that have both identity management solution skills, as well as have the ability to develop on the code base that the, that the tools run on that was a bit difficult to find the right, the right employees, the right skill sets in that space. Usually I'd find very heavy coders that didn't really understand. I IM or I'd find somebody that was in the IAM space that didn't have a lot of coding experience.

So it was very difficult to find both what we found with the solution that we're running today is that ServiceNow has a very easy rapid development environment that it's built on. It also has a lot of, of resources in the industry that understand and know that that code base.

So we've had a very good luck in being able to find resources that can come in and, and really drive the solution forward for us from an IAM perspective, and also work with my ServiceNow partner and my ServiceNow team to actually get the, get the information in the system set up correctly so that we can use it appropriately. So it's been a very big help for us. Based on that four underlying services use takes the burden off the IG team. So this was a big one as well. When it comes to implementing the tool, we rely on ServiceNow for the interface, the U user interface.

We rely on ServiceNow for the workflows, the look, and feel the reporting. And so all those, the ability to, to, to really utilize the underlying functionality of ServiceNow to deliver the IGA system has, has really benefited us in the way of how we implement as well as just how we ongoing support the solution. Number three, IGA integration simplifies compliance requirements. So we did implement the compliance module of ServiceNow. We have our entire compliance framework and ServiceNow, which includes all the controls that we have for every control that we have.

We also require what's called net testation, which basically requires our control owners to attest or tell us that they're actually doing the control as, as defined. So with the integration of, of IGA, all the controls that we have around user access or user review, we can, instead of doing those attestations manually, we can just point those controls to the IGA system and show the user access reviews that have been done, or the process that's in place to, for people to request access.

So this gives us a really good integration from a standpoint of not having to have resources manually a test to these controls every so often, number two, a one stop shop for users. This was really big when I decided make the decision to go in this direction, because we had such a diverse and, and different kind of environment with our user access provisioning. Nobody really knew exactly where to go, or they had to go to multiple systems to, to really get the access that they needed.

So we really wanted a one place to go, to be able to, for people to be able to facilitate getting that access was ServiceNow. And, and the way that we use ServiceNow to request like computers or mobile devices, it was just a great fit to, to also focus that on asking for application access or for user access.

And so, so that was a big win for us. Also, when we, when we looked at user access reviews, we have managers that had to go to ServiceNow to do approvals for tickets or to for changes. So they also can now go to, to ServiceNow, to do approvals for the, for the user access reviews, which is also a, you know, a good tie in. And then finally from a support team perspective, we do have the need to have support teams do some provisioning because we don't do all automatic provisioning.

So this allows us to have the support teams working out of the same system as they do when they're doing change issues, change tickets, or issue resolution. So having one system that has kind of the same interface for all these, all these areas, including our IGA P pieces has been a big help. And finally, number one is the use of CMD DB and the ability for us to connect and integrate into the CMDB for, for the information that we need. And this is, this has been a, a big one for us because we started our CMDB journey last year.

And we, with the goal of pulling all of our systems, all of our applications, all of our processes into the CMDB system, so that we had it all in one place, we could connect everything together and really drive the value out of the data. When we started looking at putting the I IGA system on top of that, we started immediately being able to take advantage of things like, you know, the applications that are defined in the CMDB, the owners of those applications can be tied to the IGA so that we don't have to keep up with the ownership. We can just have the CMDB, give us that information.

If there's re if there's systems that need requested to be, to be given access to, we can query the CMDB to get some of that information as well. So this is a big one that we see as we go forward in this journey that will be utilizing a lot of the information that CMDB not only to drive the base information that we need to set up the, the I IGA system, but also, you know, in the bigger picture of things, look at how we can use the CMDB to kind of drive those process tie in.

So if there's a process that someone needs access to look at the process, look at the systems and kinda use the IGA solution to drive giving access across all the, all the systems that would be needed to support that process. So those are the value ad, the top five value ads that we have seen so far with IG on top of ServiceNow, obviously there's also on the other side, some risks that we've seen. So I wanted to bring that, bring those up as well. And the first one is, is no on-prem option.

Now I know there is not some op opportunities to put ServiceNow on prem, but generally speaking, it's a cloud-based solution. And so this was something that we looked at initially, because we wanted to make sure that having information about our users information about the access and the systems was appropriate to be done in a cloud solution. We believe that that risk is acceptable based on how we set it up and the, the security that we can put within ServiceNow.

But I do think it's something that people have to think about when they're, when they're looking at putting an IGA solution on top of service now required use of mid service for app connectors. So ServiceNow has a, a function called a mid server. That is actually the servers, the, the, the physical servers that go on-prem that allow you to connect ServiceNow to other systems within the environment. And they're pretty robust servers, but they are, you know, managed by ServiceNow. You have to follow the ServiceNow kind of methodology around those systems, their Java based systems, too.

So there is a potential that you could run into concerns or risks with, with having to use mid servers, to do all the connections, to all the, to all the applications that you're wanting to provision to automatically, or all the systems that you need to provision provision to automatically. We have not seen any issues with this, by the way, but in talking with clear sky, we, we have, you know, had these conversations about it.

If it, you know, to make sure that we did, we don't see any limitations or we know what limitations we have, so we don't get into trouble going forward. And lastly, this is something that's, that's caused us a little bit of pain, which is you, you are required to, to follow the service now releases. And so you really need to work closely with your service now, teams, to really understand how those releases are gonna be handled service.

Now, I believe usually does two big releases of year. And so if your company is planning on following that schedule, you just have to realize from a, from an IGA perspective that you need to ensure that you're ready to the new releases when they come out, that you might have to have some time that you can't do any development work as the, as you, you know, test those releases through your dev U a T or production or other environments that you may have.

And then just know that every, you know, every two year or every twice, every year, there could be some changes that are gonna come into play, which hopefully will be good changes with clear sky, but you need to make sure that you're on top of those as well. So that the, the service now releases is really gonna probably drive for the next few years, those schedules on enhancements, as well as impacts. So to summarize my talk for today, we've found a very high value in putting a clear sky on top of service.

Now, not only from a user base in the sense that they've been very happy in what they've been seeing, how they have utilized the tools so far, but also from a support perspective, as well as an overall ID identity management kind of solution it's, it's worked very well. We've been able to leverage ServiceNow to get to, to some functionality that we needed quickly, for instance, like reporting some things like that has been very good. We do also see that there, there potentially could be a lot of value within the service.

Now, IGA integration, some of the areas that we're looking at is in security operations. So in security operations module, we, we use that to look at all the security incidents that come into our company and analyze those. And then task goes out based on the incident or the vulnerability that we see having an integration with an IGA tool could give us the ability to do things like if we see a risk from a system or a server that we could initiate a removal of access on that server through the IGA solution, which would, which you know, which would decrease that risk.

If we saw the same thing from an application, we could do the same thing we could remove access from that application very quickly in an automated fashion. So that could help us potentially be, be more proactive with our security, instant responses. We could also get, we get alerts for high risk accounts.

So if we know a risk account is being is risky based on something that the systems have seen, then we could utilize IGA to come in and, you know, remove access to certain systems or disable the account, things like that through IGA as well, which we think is, would be a really good integration from a compliance and risk based perspective. We really wanna do some more integration with that.

We really wanna drive some of those control attestations in, in, in more detail, we'd like to show a little more how we can define the risk around our compliance frameworks and show how we're mitigating some risk based on the access that we're giving with IGA. And then around automation, being able to automatically tie the CMD B into IGA to do things like automatically add an application to IGA. If an application shows up in our CMDB, those kind of things I think would be very valuable as we move forward, working with the IGA on top of the ServiceNow solution.

And with that, that finishes my presentation for today. I'm not sure if there's any questions.