Enhancing the Identity and Access Management (IDAM) process strengthening Cyber Security

The purpose of the Identity and Access Management (IdAM) project was to ensure the Department of Transport has the appropriate framework consisting of policies, processes and systems in place to allow an individual to have the right access to resources secure by design in an efficient way through automation minimising cyber risk to the organisation. The delivery mission statement is "The IDAM project will streamline identity and ensure the right access is granted to the right user/entity at the right time for the right duration. It will have controls that help to keep staff, data and applications secure and meet compliance requirements.".

The primary challenge overcome on the project was the understanding of the current state (As-Is) environment encompassing Technology, People, and Processes, a task that has been completed, and to proceed with formulating the desired future state (To-Be). For the scope of applications and services, various application lists were present across the Department for Transport (DfT). Through a group discussion involving relevant stakeholders, the main outcome was the development of a comprehensive view of applications and services within DfT using Erwin (an architecture tool). This approach includes establishing links to repositories for additional information on each application and addressing the identification of unknown cloud services. In terms of Key Stakeholder Engagement, user engagement sessions were conducted with key stakeholders to gain a clear understanding of the current (As-Is) and desired (To-Be) states for Identity and Access Management. This involved identifying pain points in Technology, People, and Processes, documenting them, and ensuring comprehensive capture for potential remediation during implementation. Architectural Diagrams were employed to map the existing architecture, illustrating data flows for discussions on future design with the Project Sponsor and other key stakeholders. Additionally, these diagrams were utilised to represent both the As-Is environment and the envisioned To-Be state. Data Analysis played a crucial role, involving the examination of data extracts to validate data quality. This analysis aims to facilitate solution design and draw attention to pain points that require resolution. The ultimate goal is to establish a single source of truth for managing digital identity.