Sidebar: The Delegated Administrator

Computerworld - Know when to delegate. Like the state of North Carolina, about half of PricewaterhouseCoopers' clients start their identity management projects to address Web-based access needs, says Gary Loveland, a partner at the consulting firm. Doing this successfully calls for a delegated administration system, which lets end users start the process of registration themselves and delegates management of their user identities to department managers or systems administrators.
Nowhere is delegated administration more critical than in a business like Covisint LLC, a Southfield, Mich.-based online exchange for automakers, their suppliers and industry trade groups. With so much competitive information at stake, Covisint must guarantee that the 100,000 users logging on to the exchange to bid on work and to access manufacturer specifications and other data cannot skip around to reach their competitors' data, says Dave Miller, Covisint's chief information security officer.
But managing all those user IDs was impossible to do centrally, Miller says, and the number will soon double when DaimlerChrysler AG is added to the identity management system. So, with the help of RSA Security Inc.'s ClearTrust identity management suite, Miller has brought the number of user IDs under his domain to a manageable 10,000.
To do this, he established a root administrator at each of Covisint's member organizations to manage their own in-house users accessing the portal, he says. Importantly, ClearTrust is also able to handle complex hierarchies of delegated administrators, since some of them are also responsible for managing accounts at their subsidiary companies.
Access approvals are finalized through an automated e-mail trail between the requesting administrator, Covisint and the manufacturer. Deprovisioning is also handled through e-mail.
Radcliff is a freelance writer in Northern California. She can be reached at derad@aol.com.

Read more about Security in Computerworld's Security Topic Center.