What are the most relevant IAM security metrics for organizations with high employee turnover?

For organizations with high employee turnover, relevant IAM security metrics include access provisioning time and access revocation rate to ensure efficient access management. The security policy adoption rate and orphaned identities index are crucial for assessing compliance and minimizing unauthorized access risks. The average time to detect and respond to IAM incidents is essential for swiftly mitigating breaches. Additionally, the access audit rate monitors compliance and identifies inappropriate accesses. By prioritizing these metrics, organizations can strengthen their security posture and better protect their resources against internal and external threats.

For organizations with high employee turnover, focus on IAM security metrics that track account lifecycle management, such as the frequency of account creations, modifications, and deletions. Monitor privileged account usage, especially during onboarding and offboarding periods. Track access requests and approvals to ensure timely provisioning and deprovisioning. Analyze login patterns and anomalies to detect potential unauthorized access or insider threats. Implement periodic access reviews to validate permissions and minimize access creep. Regularly audit IAM policies and configurations to align with evolving security requirements.

The most important metrics are cost based. The cost of provisioning/deprovisioning, high cost (human touches) vs low cost (automation). If there is high turnover, cost management is even more important. The second tier are time based, and usually related to cost (i.e. human touches also take longer). Windows of vulnerability, time to resolve, for example. The article has numbers that aren't metrics.

The principle of least privilege is, in most cases, a mirage. The ask is for security people to understand every other job in the company so well they can figure out what the minimum necessary is to do the job. Or they rely on those doing it, and don't have a frame of reference to prove it's minimal. Focus on other data like number of role exceptions asked for/granted/denied and the rate of change of those. "Standard exception" is a surprisingly common term in use when least privilege is attempted.

Access violations are not just an indication of a misuse of access. They can also indicate a too-restrictive permission set. Violations should trigger a review of the permission set as well as the policy to determine if the user was trying to do the right thing and got blocked by "the system."

In my IT industry experience, I believe that the number of IAM audits and findings is a crucial metric for organizations with high employee turnover. IAM audits are vital independent assessments that evaluate the effectiveness and efficiency of IAM processes and controls. By monitoring and auditing these numbers regularly, organizations can identify and address any gaps or weaknesses that may impact IAM performance and security. A low number of IAM audits and findings signifies a high level of IAM quality and assurance, highlighting a robust security posture despite high employee turnover challenges.