THANK YOU FOR SUBSCRIBING
A featured contribution from Leadership Perspectives, a curated forum for enterprise security leaders, nominated by our subscribers and vetted by the Enterprise Security Magazine Editorial Board.


A brief highlight of understanding how the past can drive the maturity of the present.
How did we get here?
Most of us reflect on our lives, attempting to understand our choices to get where we are today. Through this introspective reflection, we can often find the points in our lives where critical crossroads or small decisions were the ultimate cause for the current state of our careers or came to define a large part of who we are. This reflection can lead to a re-evaluation of priorities, changes in direction, or confidence in our current path. When done correctly, an introspective reflection is a process by which an individual can better know themselves - to know yourself means where you came from, where you are now, and where you are headed. It may be straightforward to understand how an individual retrospective benefits an individual; however, the same kind of retrospective is also beneficial in systems analysis and driving a culture of solving for the long term. The process of self-healing for a system begins here.
Identity and Access Management (IAM) Systems Analysis – The challenge
Now, imagine the typical hiring situation of a senior director or higher. They find themselves thrust into a new position with the expectation, near demand, that changes and outcomes are brought swiftly to their organization or project. The management tends to only allow for a short ramp-up and integration period for familiarization before the expectation of changes. These ramp-up periods often leave the incoming resource feeling unprepared, overwhelmed, and, at worst, inferior to the challenges presented by the current situation of their business group, division, or team. The challenge here is that changes are expected to be made to drive specific long-term or short-term outcomes, but how does the incoming resource know if they are the right choices?
We don’t, well, at least not generally with high certainty.
Now, to those reading, the prior example may not resonate with your current state; however, let me pose this question – can you drive the expected results without knowing the root cause of the issues you are facing?
While we can’t ever give 100 percent confidence in a decision, we know how to drive decisions with a better, holistic, root-cause-focused view of the current state. The key to creating this perspective is not attempting an impossible feat of deep dives for each aspect of the current state of your environment or program but instead asking targeted, framework-based, strategy-focused questions. These better questions allow the newly hired or enterprise-careered professionals to make decisions and drive change more confidently to empower their team’s outcomes.
Knowing Where You Are – Current State of Systems Analysis
Before diving into the potential questions that can be asked to guide an influential retrospective, the most critical aspect is to discern which variables of the current state to analyze. It would be easy to assume that this type of retrospective should be geared toward the current state’s most pressing and critical issues. This assumption would primarily be incorrect. In general, if you are actively solving a problem, you are most likely amid the content of a later retrospective. The content that tends to be best suited for a retrospective that accelerates maturity is the area that seems over-engineered, has many exceptions, or is a traditionally avoided area of review due to lack of ease of access. Having read the previous statement, the areas for review may seem slightly on the nose to some. Coincidentally, these same areas give the most turbulence in the maturation, merging, or improvement of IAM programs.
Knowing Where You Came From – Retrospective of Systems Analysis
We are often asked to perform current state-to-target state gap analysis, where the central perspective desired is only focused on where the system is headed, and the retrospectives need to be prioritized. The latter view arguably brings about the true holistic perspective of the current state that drives the improved outcomes discussed before. Acknowledging that every scenario is unique and each approach would require some customization to be the most effective, below are some example questions and their respective considerations that can be leveraged to usher in the beginnings of the retrospective within systems analysis.
What was the context in which the decision was made?
This question aims to understand the factors of a decision, not the requirements exactly, but a deeper layer to uncover what drove the need for those specific requirements. With this layer of knowledge, other conditions within the enterprise may solve what exists, and the process can be simplified or removed entirely.
What was the purpose of the original design, and was the outcome ideally fit for purpose?
While the question implies ‘ideal,’ the intention is to understand if the platform is a candidate for inclusion in a more systematic tools rationalization exercise. Organizations often purchase large platforms or toolsets where the accurate utilization is a small subset of the full capability. In addition to tools rationalization, the response can also assist in understanding if the original design had any missed efficiencies or flaws.
What was the tipping point of the decision?
Anyone would be hard-pressed to find a great example of a whimsical decision without any motivating factor to execute or communicate the decision. Essentially, we are driving toward the core of ‘Why was this decision made now?’ The answer to this can be anything from the size of the organization and position in the market to a change in leadership priorities and increased funds. Whatever the answer, it provides insight into the motivations and factors of the decision that, in turn, allows for an appropriate go-forward strategy foundation.
Knowing Where You Are Headed– Let’s Get There Together
In a world ruled by immediacy and expectation of change, it strains the mind to understand how to design and manage an IAM program that ensures security and ease of access. Getting the perfect answer at every turn in the journey is not always possible, but it is possible to get the best solution for empowering maturity and driving a culture of retrospection. It is good to learn from the mistakes we made over the past twenty years but don’t let our legacy cloud our thinking in designing for the future. Let’s work together to ensure that the way forward has been appropriately defined from the path behind.