Overview
West Midlands Police selected the Core Access Assurance Suite to ensure that access to information, buildings, and systems were given to the right people at the right time.
Key Results:
- Increased operational efficiency and transparency
- Strengthened security
- Improved compliance
- Delivering fast time to value and the lowest total cost of ownership
Background
West Midlands Police, the UK’s second largest police force, needed to equip its 15,000 officers and support staff with a comprehensive Identity and Access Management (IAM) solution to ensure that access to information, buildings, and systems were given to the right people at the right time. The need for strong identity management is also mandatory for managing and certifying access to national systems such as the Police National Database, which provides a consolidated pool of nationwide police information and intelligence.
To address these needs, the Gateway Program was established in 2005 in response to the ACPO/ACPOS Information Systems Community Security Policy. This required all police forces in England, Scotland, Northern Ireland and Wales to provide corporate access systems and manage role-based access to applications, buildings, and information. This ground-breaking program was tasked to deliver 13 projects in five years, ranging from smart card deployment to physical and logical access control, and managing visitors and contractors on police premises. The Gateway Program was the largest endeavor ever undertaken by the West Midlands Police Force. The common thread binding all of these projects is Identity and Access Management, with the Core Security IAM solution being the last phase to be deployed.
The Challenge
The ability to share information of a highly confidential and potentially life threatening nature rapidly across all police forces is vital. But with such access comes access risk and the necessity of ensuring that the right people have the appropriate access to the right information and locations, and that such access can be tracked while users requesting access to such information can be identified and verified.
It was critical for West Midlands Police to control access to both police premises and police information systems. They needed an automated IAM solution that offered the appropriate tools and processes that would strengthen their access risk management strategy through automated compliance attestation, sensitive data management, and user provisioning.
Previously, the Force’s IT department had to plod through a labor-intensive, manual process, which took up to two weeks to grant users access to new areas. In addition, access changes for movers, joiners, and leavers added further complications. It was essential that the Force be able to access information and systems immediately during emergencies; and they needed a comprehensive IAM solution to reduce the time to grant user access from days to just minutes.
The Approach
The Force identified a need for automated identity and access risk management, and the Access Assurance Suite fit the desired strategy perfectly.
Nowhere is access risk management more critical than dealing with sensitive data that could potentially save lives, and the Access Assurance Suite delivers the tools for effectively and securely creating, managing and monitoring user access rights. By overhauling and updating its IAM processes, the West Midlands Police Force has made great strides; delivering on the specifications set out in the ACPO/ACPOS Information Systems Community Security Policy; generating time- and cost-savings for IT and general staff; and also ensuring robust certification and compliance management and auditing capability.
West Midlands Police uses role management capabilities to automate the creation and management of roles, enabling the Force to grant and revoke access privileges automatically based on the user’s rank. Access to applications, physical property and information are now seamlessly and accurately managed, limiting the chances of unauthorized personnel being granted more than least-privileged access. In addition, a robust audit trail is created by the system.
Access certifications and attestations for staff can be accomplished in minutes, rather than weeks, and Provisioning has enabled the Force to automate the new hire, promotion/transfer, and termination process, while Password Management automates the self- service creation, update, and retrieval of passwords.
The Result
Today, West Midlands Police better serves and protects its community with the Access Assurance Suite providing complete identity, access risk, and compliance management, easily identifying, quantifying and managing the risks associated with information access. This comprehensive approach has enabled West Midlands Police to increase operational efficiency and transparency, strengthen security and improve compliance while delivering fast time to value and the lowest total cost of ownership.
“What won it for Core Security was the solution’s ease of implementation and simplicity, combined with the fact that it offers so much functionality behind the scenes.”
See Identity Governance Solutions in Action
Find out how the right identity governance solution can help you mitigate identity risk in your organization.