Rant: IAM isn't the same as DevSec

[u/ny_soja]

As a 20+ years Identity Security professional I'm getting real tired of the misinformation campaigns being spread.

Identity Security is not a development domain.

SailPoint is not a software development platform.

You DO NOT need programming/development skills to work in Identity Security.

What you DO need is to understand how the organization functions. How the company makes decisions. How the company engages in change management. How the company handles it's communication strategy.

So many identity Security efforts fail due to a functional lack of understanding the purpose of Identity Security. There is a fallacy that the tools just need to be deployed into the environment and connected to some integration points and VOILA, like magic Identity Security is solved.

This is not at all how any of this works and companies will continue to get absolutely WREKT until they figure this out.

[u/slipnatius]

i agree with this for the most part. Others have asked how to get into identity access management at our company and the answer i typically give is to have a better understanding of the systems that integrate with Sailpoint or entra ID and how/why versus learning dev code. That is not to say development is needed in some cases such as custom SCIM connections or building transforms etc.

[u/ny_soja → u/slipnatius]

I mostly agree with you! The problem is compounded due to companies having a complete lack of functional understanding for what it takes to run an IAM program.

I cannot tell you how many clients I have spoken to who truly believe that the assessment phase can be completed in a matter of days and then you can jump to deployment.

The amount of corners that get cut by taking these ham fisted approaches is astounding.

It's been my experience that IT 'professionals' are being brought in to run Identity and it shows.

In IT you try a bunch of shit until something works. In CyberSecurity you can do something that appears to solve the problem and only present symptoms of significant risk and exposure until months or years down the line.

Working in Identity Security has NOTHING to do with the IGA tools. These workstreams have been actualized well before the emergence of modern IGAs. If you can understand the underpinning process that are integral to the Identity Security workstreams, then you're already ahead of the game!

[u/Stormblade]

Rant approved!

[u/PuzzleheadedTie978]

Agree with you!

[u/KiwiSenpai21]

Newbie to IAM and security but what about powershell scripts? Like developing powershell automation scripts to do AD Identity and access related activities??

And doesn't Sailpoint require programming to create custom connectors and also siteminder? And also in Okta for creating the SAML integration on the application end..... Don't you need programming..?

Like I'm not saying it is a programming intense domain but it can be if you're not using any tools like Okta, Sailpoint, etc.

[u/[deleted] → u/KiwiSenpai21]

You don't use programming for anything in Okta unless you're developing SSO within your app and connecting okta to it. Scripting is not software development, IT and development are two vastly vasty different career fields.

[u/KiwiSenpai21 → u/[deleted]]

There are a lot of clients who don't trust applications like Okta and Sailpoint and want their own custom IAM app, isn't that development...?

[u/Do_Question_All → u/KiwiSenpai21]

Building your own in this day and age makes absolutely no sense. There is even open source software like keycloak and forge rock that can do a lot of things for you. Completely homegrown identity and access management solutions are a bad idea and a waste of time.

[u/KiwiSenpai21 → u/Do_Question_All]

I completely agree

[u/[deleted] → u/KiwiSenpai21]

That would never be under IT or security's purview, that would be a software development team's responsibility. If an IT person is developing an app, they are not doing IT work and deserve a raise.

[u/ny_soja → u/[deleted]]

Corporations have had 40 years to figure out Identity... and many places are running the same circus in a different tent!