The situation
It's pretty common after an acquisition to have two (or more) separate companies that need to be consolidated into a single entity.
One of the first systems to get merged is usually HR. People have to be brought into the acquiring company's HR system so they can get paid. Once you have a system of record that can report on employment status and other positional information, you can design access controls. It starts with establishing a source of truth and building an identity foundation from there.
There is usually an outside deadline driving the timeline, and most of the time it's financial:
- Budget that needs to be used before the fiscal year ends.
- Licenses on the acquired side that will renew if people aren't moved off of them in time.
So the work tends to follow whatever is going on with the business at the time.
How we approach it
How far it goes really depends on the project. If there's a company-wide mandate (every application needs SSO and MFA, for example), we look at every application and all the ways users can access those applications, both internally and externally. If it's more targeted, like getting off a set of licenses or collapsing an acquired domain to reduce liability, we scope it around what you're trying to get done.
- Identity discovery and mapping. We start with the HR system and use it to trace every account in scope back to an actual person.
- Application access and SSO coverage. For each application in scope, we look at how people sign in, whether it's behind SSO and whether MFA is actually enforced.
- Governance and policy design. Once people are settled in the acquiring HR system, it becomes the source of truth. Access gets granted based on the information in it, so downstream systems all work from the same record.
- Gap and risk report. We write up what we found, where it falls short of best practice and any risk that was accepted along the way.
The takeaway
No matter how far the work goes, you end up with a clear and honest picture of your environment, and where the risks and gaps are compared to best practice.
Even if nothing gets fixed during the engagement, you'll know what needs to be fixed and what it would take. That includes the people and software you might need, and roughly how long and how much it might cost to get on the right side of it.
Where it gets complicated
Existing business applications are often not ready to be fully converted over to modern identity management at a moment's notice. For well-established or deeply entrenched applications that are reliant on legacy systems, it can be difficult to convert them in a timely manner.
When that inevitably happens, we work with the application teams to identify where best practice can be applied to their daily operations. Then we work with the owners of those applications to plan maintenance windows and security upgrades that eventually bring them fully into policy.