Quantitatively measuring recertification campaign effectiveness

• US 20170063872A1
• Filed: 09/02/2015
• Published: 03/02/2017
• Est. Priority Date: 09/02/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Turcol, Stephen James, Matthiesen, Brian Robert, Chia, Gee Ngoo, Hidden, Jean Elizabeth
• Granted Patent: US 10,243,994 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An identity management system is augmented to provide a methodology to generate an objective measure of administrative effectiveness with respect to account certification. In the approach, erroneous account information is intentionally inserted into a recertification campaign. The erroneous account information is tracked through the recertification process and used as a measurement to evaluate whether a particular manager/administrator whose accounts are impacted is successful in recognizing the erroneous account information (e.g., as a percentage of erroneous account records located). The dummy information is tracked and used to generate a quantitative measure of the effectiveness of a particular recertification campaign or a particular manager who is responsible for recertifying accounts. The results can also be used to drive other enterprise metrics and compliance systems.

Claims

1. A method to determine the effectiveness of a recertification campaign, comprising:

selecting accounts for recertification in accordance with a recertification policy to generate a list of accounts;

augmenting the list with one or more dummy items;

providing for approval the list including the one or more dummy items, the list being provided to an approver entity;

responsive to receipt from the approver entity of an approval to initiate the recertification campaign, determining an effectiveness value for the approver entity.

2. The method as described in claim 1 wherein the recertification campaign is associated with an application, and a dummy item identifies one of:

an individual having an account on the application, a named account associated with the individual, and a group affiliation associated with the individual.

3. The method as described in claim 2 wherein the individual is one of:

an individual associated with an enterprise but not authorized presently to have the account on the application, and an individual not associated with the enterprise.

4. The method as described in claim 1 wherein the effectiveness value for the approver entity is a function of a number of dummy items augmented to the list, and a number of the dummy items identified by the approver entity.

5. The method as described in claim 1 further including associating different dummy items to each of first and second accounts.

6. The method as described in claim 1 further including associating different weights to each of first and second dummy items.

7. An apparatus, comprising:

a processor;

computer memory holding computer program instructions executed by the processor to determine the effectiveness of a recertification campaign, the computer program instructions comprising;

program code operative to select accounts for recertification in accordance with a recertification policy to generate a list of accounts;

program code operative to augment the list with one or more dummy items;

program code operative to provide for approval the list including the one or more dummy items, the list being provided to an approver entity; and

program code responsive to receipt from the approver entity of an approval to initiate the recertification campaign to determine an effectiveness value for the approver entity.

8. The apparatus as described in claim 7 wherein the recertification campaign is associated with an application, and a dummy item identifies one of:

an individual having an account on the application, a named account associated with the individual, and a group affiliation associated with the individual.

9. The apparatus as described in claim 8 wherein the individual is one of:

an individual associated with an enterprise but not authorized presently to have the account on the application, and an individual not associated with the enterprise.

10. The apparatus as described in claim 7 wherein the effectiveness value for the approver entity is a function of a number of dummy items augmented to the list, and a number of the dummy items identified by the approver entity.

11. The apparatus as described in claim 7 wherein the computer program instructions further include program code to associate different dummy items tp each of first and second accounts.

12. The apparatus as described in claim 7 wherein the computer program instructions further including program code to associate different weights to each of first and second dummy items.

13. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, to determine the effectiveness of a recertification campaign, the computer program instructions comprising:

program code operative to select accounts for recertification in accordance with a recertification policy to generate a list of accounts;

program code operative to augment the list with one or more dummy items;

program code operative to provide for approval the list including the one or more dummy items, the list being provided to an approver entity; and

program code responsive to receipt from the approver entity of an approval to initiate the recertification campaign to determine an effectiveness value for the approver entity.

14. The computer program product as described in claim 13 wherein the recertification campaign is associated with an application, and a dummy item identifies one of:

an individual having an account on the application, a named account associated with the individual, and a group affiliation associated with the individual.

15. The computer program product as described in claim 14 wherein the individual is one of:

an individual associated with an enterprise but not authorized presently to have the account on the application, and an individual not associated with the enterprise.

16. The computer program product as described in claim 13 wherein the effectiveness value for the approver entity is a function of a number of dummy items augmented to the list, and a number of the dummy items identified by the approver entity.

17. The computer program product as described in claim 13 wherein the computer program instructions further include program code to associate different dummy items tp each of first and second accounts.

18. The computer program product as described in claim 13 wherein the computer program instructions further including program code to associate different weights to each of first and second dummy items.