The Solution
First, Pionen needed to understand the Department’s problems and develop requirements to fix them – both the functional elements (what the solution would do) and the non-functional elements (how the solution would work with other capabilities). Working collaboratively with the Department’s identity and engineering teams, Pionen developed the requirements and gained approval.
Pionen then worked through their checklist of standard non-functional requirements to determine the technical constraints, and based on this work, Pionen was confident a commercial off-the-shelf Privilege User Access Management (PAM) solution would be suitable for the Department.
After assessing available products against the requirements, Pionen compiled a comprehensive compliance matrix with strengths and weaknesses. The Department’s buying team used the matrix to run a competitive procurement to select from the top three identified vendor platform products.
Once a product was selected and procured, Pionen worked with the vendor (CyberArk), to develop a design roadmap and plan and high-level design artefacts to commence governance. The first stage of this process was to create a reusable capability design – a solution-agnostic view of the system to mitigate the risks introduced when privileged users are not effectively managed.
Pionen then completed the complex solution design to allow privileged user management for over 500 privileged users. The design successfully met all the Department’s strict governance standards (based on the Government Security Policy Framework) and was approved by the Design Authority. The design was also scrutinised by the vendor and approved as only a CyberArk approved design would be supported.
In parallel with design, Pionen ran a Business Change Programme. They developed a Future Operating Model, documented existing use cases for all privileged users and created ‘to-be’ use cases documenting how processes would work with the new solution in place.
The first phase of implementation was data gathering using the CyberArk tool called DNA; Technical Data Gather which scanned the network and showed all privileged user accounts.
The second phase was to install the full CyberArk solution software components then onboard a friendly user group parallel to normal operations.
In the third phase, Active Directory synchronisation and further user groups will come on board, again in parallel to existing user accounts to ensure no disruption of service.
The fourth phase will start enforcing CyberArk only access. When all accounts are tested and in daily use, all existing legacy accounts (accounts not managed by CyberArk) will be removed or access denied.
The final phase, scheduled for 2023, will integrate SailPoint, which adds automated user lifecycle management to PAM. This step will add the power of efficient privileged user management and automate joiners, movers, leavers processes.
