App Identity Modernization

The identity fabric playbook: Driving change and securing buy-in across the enterprise

This promotional graphic for "The Identity Fabric Playbook" by Strata outlines key benefits for IAM professionals exploring identity fabric architectures.

Managing identity systems across multiple clouds and platforms is an almost impossible job. With identity and access management (IAM) at the core of enterprise security, getting it right is one of the most important aspects of digital operations today. As an IAM leader, you understand this better than anyone.

An identity fabric helps solve your biggest IAM challenges. It offers a unified approach to managing and securing identities across diverse environments. Through it, app identity modernization can be done in months instead of years for a fraction of the labor and infrastructure costs of manual modernization. Risk is significantly reduced, and innovation can soar when you’re not buried in tech debt.

Identity modernization is the process of transforming from old identity systems into modern ones that can accept the latest and most effective security services. Generally when we talk about having a modern app, it was either built in recent years based on standards, like SAML or OIDC, or an older, legacy app that has (most likely painstakingly) had the code refactored to accept modern standards.

It’s not difficult for you as identity professional to understand the value of an identity fabric, but you’re not the only one who needs convincing. Since IAM touches so many departments, getting buy-in for your projects and budgeting for the necessary tools can be extremely frustrating.

Let’s make it easy.

In this guide, we tackle the common arguments and objections you may find yourself up against when trying to get buy-in for an identity fabric. You’ll learn how to approach and win over:

  • App owners
  • CISOs
  • CIOs
  • Finance

By the end, you’ll have everything you need to confidently negotiate with all the departments in your organization. You’ll be able to show anyone why an identity fabric is critically important in the current cybersecurity landscape and why they should prioritize its implementation.

“Organizations need to evolve their IAM from a set of distinct tools and processes that manage users and entitlements toward a highly flexible, integrated identity fabric that is secure, interoperable and distributed.”

Untangle the chaos: Overcoming legacy identity architectures holding you back

Traditional identity architectures are a complex mix of legacy and modern tools that don’t integrate well. As a result, identity leaders are forced to manage inefficient, expensive systems that require an outsized amount of resources to maintain.

Instead of a simple, interoperable system, identity and access policies are scattered, fragmented, and frequently siloed, putting your organization at risk and increasing the attack surface.
On top of that, your CIO and CISO expect you to support high-level priorities like:

  • Achieving zero trust identity
  • Reducing IAM complexityLowering identity infrastructure spending
  • Adhering to regulatory compliance demands
  • Increasing cybersecurity insurance requirements

But those demands aren’t possible with your identity architecture the way it is. So, what’s the way out?

The universal truth behind the enterprise identity architecture

The problem isn’t you — it’s that your identity architecture isn’t designed for today’s systems. And to successfully face future challenges, this has to change.

To truly modernize, you need to make a fundamental shift in your approach to your identity infrastructure because identity is not going to stop evolving. To get ahead, and stay ahead, any solution you implement has to be exceptionally flexible — permanently.

Luckily, that’s what an orchestrated approach to identity brings to the table. Applying orchestration to your identity architecture will help you make your company more secure and innovative, simplify your job (and the future of identity), and help you look like the identity hero that you are.

And it all begins with implementing a custom identity fabric.

Cheat box: The identity fabric

The identity fabric supports all your business and IT goals — and bypasses the critical problems of the current system — because it’s:

  • Flexible, composable, and agile
  • Vendor agnostic
  • Developer friendly
  • Low-code with little rewriting required

As an abstraction layer, your identity fabric unifies distributed identity providers and infrastructures like MFA, directories, databases, APIs, authentication, and authorization providers.

It allows you to use Identity Orchestration and the abstraction layer to easily switch identity providers (IDP)s, add multi-factor authentication to on-prem or complex applications, layer in identity continuity, get off legacy identity providers, and integrate with other security components.

Turn doubters into advocates and secure buy-in across departments

Identity is mission critical, but so are all the other executive team’s priorities. To get buy-in for an identity fabric implementation — and make it easier to manage identity everywhere — you have to quell the concerns of other departments who may not fully understand its value. Yet.

So how do you convince your boss — and the wider team — that building a shared fabric will be benefits everyone? How do you manage internal politics, app owner resistance, competing priorities and resourcing?

It’s a complicated, intricate dance — so instead of figuring it out all by yourself, let’s walk through the steps together!

Step #1: Become the identity fabric champion

Fully understand the combined value the identity fabric brings to your organization

Understanding the value of an identity fabric for identity and security teams is one thing — clearly showing its business value to executives, finance and app owners is another. As a champion, you’ll need to be able to describe their problems and show how the fabric solves them.

Cheat box: The problems with your identity infrastructure

  • Your infrastructure isn’t interoperable. Everything was built on disparate systems at different times, so your various solutions don’t naturally connect. This can make simple tasks — like users logging into an application or granting access during an M&A — take longer than they need to and slow teams down.
  • You’re locked into specific vendors and maintenance cycles. Whether it’s legacy vendors nearing their EOL, vendors that simply don’t integrate with specific sets of apps, or products that don’t have the modern services you need to improve your security posture and reduce friction, being stuck curtails what you can do.
  • App modernization requires manual code rewrites. Rewriting an app isn’t a one-and-done task. It’s a never-ending cycle where certain non-standard yet critical apps have to be rewritten again and again every time you want to add a new service. (Even ‘modern’ apps can struggle to integrate with certain components.)
  • Traditional identity infrastructure is inflexible. You can’t easily change, adjust or improve it. But modern identity shifts and mandates move fast — to meet demands, you have to as well.

Cheat box: How a custom identity fabric supports enterprise organizations

  • End identity fragmentation and improve security by eliminating identity silos. Integrate identity across multiple cloud platforms and on-prem systems.
  • Speed up identity projects by more than 85%. Automate identity workflows like authentication, access control, migration, and last-mile integration across different identity platforms — on-prem and in the cloud. Accelerate work-from-anywhere deployments by rapidly making apps available and secure outside the firewall.
  • Save millions in measurable hard costs. Reduce the costs of moving platforms, integrating identity with apps, and rewriting apps to work with different identity systems.Break vendor lock-in and enjoy agility and choice. Use the solutions that make financial and business sense by using a composable identity fabric. Eliminate the
  • need to rewrite apps when migrating identity systems.
  • Zero-touch deployments. Streamlined implementation means minimal disruption to apps, infrastructure, or user experience. Zero-code connector integrations eliminate the need to custom code.
  • Distributed, multi-cloud identity support. Support multi-cloud distributed apps that require consistent identity across multiple clouds.

Step #2: Build the right internal foundation

How introducing an identity fabric affects different teams

While there are very real security and functionality challenges with your current identity architecture, it does have one major point in its favor — it’s mostly working.

Disruption — via the introduction of a new solution — is inherently risky. It introduces unknown quantities into finely balanced workflows. That’s why — to win different teams over — you have to understand both the real and perceived impact introducing the identity fabric may have on them.

While everyone ultimately wants the same thing — a secure, innovative business that runs smoothly and generates more revenue for investors and fiduciaries with each passing quarter — approaches, visions, and KPIs tend to vary. Dramatically.

The key to unblocking the path for getting buy-in for an identity fabric comes down to understanding which teams it impacts, capturing their concerns, and figuring out how it could make their lives easier.

Cheat box: Identifying key stakeholders and planning your approach

Every large-scale identity project needs support and buy-in from critical stakeholders. So, while there will be some variation based on your company, these are (some of) the people you’ll need to convince.

  • The IT/ IAM/ security teams. As the ones behind implementing and managing identity security policies and procedures, these teams must understand that the fabric won’t create any new risks. You need to uncover their concerns and address them first.
  • App owners. The fabric plays an instrumental role in the user experience of their app, and app owners might need to handle configuration. To make your case, you’ll need to understand their objectives and draw a path to the improvements the fabric will make.
  • Your CISO. It’s up to your CISO to ensure the identity fabric supports and meets necessary security requirements. You’ll need to show them how it helps secure apps today and in the future.
  • Your CIO needs to understand how the identity fabric supports the overall business objectives and the IT infrastructure. This is the stakeholder you’d likely approach last — after aligning with other teams. (And the approach may be led by your CISO.)

Cheat box: The top teams impacted by the identity fabric & how it supports their needs

An identity fabric empowers all teams to use Identity Orchestration and get their work done.

  • IT and security. With multiple modernization projects needing attention, teams have to be ruthless in how they prioritize. The identity fabric helps tackle security for end-of-life components, supports the way different departments do their work, and helps improve overall security posture.
  • Finance teams. An identity fabric enhances security and streamlines access management. It improves compliance with regulatory requirements and can help automate key user processes, reducing unauthorized access and improving ops efficiency. An identity fabric allows teams to move as fast (or faster than) competing enterprises.
  • App owners. An identity fabric allows for IDP co-existence, simplifies user access management, makes it easier to control access, and allows you to tap into Identity Continuity to keep mission-critical apps available, no matter what. It also supports the unique requirements for custom integrations, speeding up processes like identity proofing.

Step # 3: Rally the team and build consensus with stakeholders

To make saying yes to an identity fabric easy, you have to show each set of stakeholders exactly what’s in it for them because it’s really what you do with your unique identity fabric that matters.

You must align what an identity fabric can do with each person’s priorities — likely centered around security, compliance, and operational efficiency. By presenting real-world scenarios and leveraging statistics, you can articulate the tangible benefits and ROI of implementing an identity fabric.

Don’t throw the whole kitchen sink of benefits at every group. Instead, be strategic about what is going to get the attention of each individual. Think from their perspective and aim to answer the question, “What’s in it for me?”.

For example, if your CISO’s top concern is achieving a zero trust security posture, demonstrate the value of an identity fabric with the ability to quickly and easily get MFA in front of every application, no matter if it’s modern or sitting on an IDP. Also, focus on how the identity fabric allows you to have consistent policies across platforms to greatly reduce the attack surface.

Cheat box: Winning buy-in before you need it

  • Get to know the critical priority each team is focusing on so you can tie in the identity fabric to it. Talk to key stakeholders from each team so you can understand their concerns, needs, and expectations.
  • Tie in the fabric to measurable objectives. Once you know what each team is trying to do, you can show them how they can do that more efficiently with the fabric — and tie it all to real-world, specific concerns, not conjecture.
  • Show the value of the identity fabric in business terms. Present case studies, ROI analysis, or examples of how an identity fabric can enhance security, streamline processes, reduce costs, and improve user experience.
  • Align with compliance and risk management goals. Show how the identity fabric can help meet regulatory requirements and reduce security risks.
  • Be open about what an identity fabric can and can’t do. Identify and address any concerns or objections that stakeholders may have regarding the identity fabric, whether related to cost, complexity, or integration with existing systems. (Our team can help with the specifics, if you ever need us!)

Cheat box: Building your coalition of support and successfully navigating organizational dynamics

  • Understand team needs and pain points. Talk to different teams to understand their specific needs, challenges, and pain points related to identity and access management so you can show how the fabric will solve their needs. Focus on business outcomes like reducing risks, enhancing compliance, and accelerating digital transformation..
  • Leverage existing relationships. Identify allies in other departments who already understand the importance of identity management. Use these relationships to build a coalition of supporters. Having internal advocates can help spread the message and build credibility across the organization.
  • Involve stakeholders early in the process. Engage key stakeholders from various departments early on, even during the planning and design phases. Ask for their input and incorporate their feedback. This inclusion helps build ownership and reduces resistance, as stakeholders feel they have a voice in shaping the solution.
  • Show how the identity fabric moves business objectives forward. Position the identity fabric not just as an identity measure but as a tool that can enhance productivity, streamline processes, and improve the user experience. Departments are more likely to support a project that they see as directly benefiting their operations and contributing to their success.

Cheat box: Tips for talking to IT/Security

What IT/Security says:
Your response:
What will I have to do to implement an identity fabric? I need to know how much work this will be for my team.
Strata helps you make the implementation as easy as possible. We provide a quickstart program and service hours to walk you through each step.
I don’t want to add another layer of middleware. I’ll just have more to manage, not less.
It actually helps with the great culling to reduce tech debt. It enables us to identify and remove outdated vendors and services so we can slim down our tech debt.
We can’t have PII stored or replicated in yet another third-party environment.
The identity fabric with Strata is a run-time service that doesn’t store any user credentials or personal information so there is no data to be breached.

Cheat box: Tips for talking to Finance

What IT/Security says:
Your response:
There is nothing in the budget for an identity fabric.
An identity fabric will eliminate the cost of refactoring applications for modernization. Many inflight projects could benefit from the fabric approach. We can use it for moving legacy applications behind modern auth for compliance reasons and to ensure business continuity when there is an identity outage.
How does an identity fabric save money?
Maverics accelerates modern authentication implementation, cutting manual refactoring time drastically. This means the risk from legacy authentication is off the books more quickly as well. It costs a lot less than cleaning up a breach.
How does an identity fabric help us with our strategic initiatives?
Maverics helps us achieve cybersecurity insurance requirements by having phishing-resistant MFA on all of our applications. It also helps us adhere to regulatory compliance mandates with modern security.

Cheat box: Tips for talking to App Owners

What IT/Security says:
Your response:
I don’t have time for this. My focus is on creating great core functionality for the application, not identity and security.
Security is everyone’s responsibility. All applications will have to be modernized to mitigate the risk of a breach. The good news is, using the identity fabric to modernize now is significantly less disruption and time than rewriting the code each time a new identity service needs to be added.
It could cause disruption to the user experience.
The transition will be invisible to the end users, who will be none the wiser that their login experience has changed. More importantly, your legacy app will now work seamlessly with the modern IDP, protecting the rest of your organization’s applications for a single, consistent UX.
There’s nothing wrong with our legacy IDP. It’s doing everything I need.
Everything you get from your current IDP will be available on the new one. Your application will work just the same. There’s also zero risk involved if you need to rollback a change, as nothing was hard coded at the app level.

Conclusion: Building your identity fabric with Strata

Persuading your team that an identity fabric will make solving your IAM challenges possible — both today and in the future — is the first step. The second step is to find the right solution that’s flexible, vendor-agnostic and works with all the solutions you already use. That’s exactly what Strata’s Identity Orchestration platform (where you build your identity fabric) provides:

  • Integrate with anything, anywhere. Strata is completely vendor-agnostic. Thanks to universal app integration without the need for connectors, you can secure all your apps no matter what architecture they use. Zero app disruption during the modernization process means users enjoy a consistent experience.
  • As much support as you need. You’ll get access to our identity engineers and enhance your team’s identity skills so you can solve any use case. And all the training, tools, and assets you need to make your identity orchestration project a success.
  • Smart pricing designed to encourage growth. Strata supports unlimited app users, so you can grow exponentially without ever worrying about user-based pricing.

It’s time to build your identity fabric — and make modern identity work. Everywhere. Connect with our team of experts and we’ll help you get through to all your stakeholders to make everyone a believer.

1.Gartner. Identity and Access Management Primer for 2024. Michael Kelly. 6 August 2024. Gartner is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.

Originally published October 22, 2024 9:31 AM, updated October 24, 2024