• Overviews of IBM Security Secret Server and IBM Security Identity Governance and Intelligence
• Requirements for integrating Secret Server with Identity Governance and Intelligence
• Demonstrations of use case.
• Tips for troubleshooting
• Answers to questions from audience

These labs show a day in the life of a line of business manager, who uses IBM Security Identity Governance and Intelligence (IGI) to manage accesses for his team members.

Overview
IBM Security Identity Governance and Intelligence, or simply IGI, is an appliance-based integrated identity governance solution. This solution employs business-centric rules, activities, and processes. It empowers Line of Business managers, auditors, and risk managers to govern access and evaluate regulatory compliance across enterprise applications and services.

This lab provides a real business user experience. You imitate a day in the life of a Line of Business manager, who uses IGI to manage accesses for his team members.

Feel free to explore each of the applications in depth and work with the data in any way you like. This is a live and fully functional Identity Governance environment, with many sample user records, roles, and risk definitions.

The Identity Governance and Intelligence user interface is divided into two areas. The Administration Console is reserved for administrators, while the Service Center is where the applications for business users are contained. In this lab we use the Service Center only.

Objectives

• Overview of the Service Center
• Working on pending requests
• Submitting a request
• Evaluating, approving or rejecting requests as a user manager
• Verifying the new role
• Requesting roles for team members
• Requesting a role for a team member
• Evaluating and approving requests
• Verifying the new role
• Certification campaigns
• Evaluating running certification campaigns
• Redirecting evaluation to another reviewer
• Tracking progresses
• Generating certification campaign reports

OpenID Connect (OIDC) Provider grants the administrator the flexibility to configure and use an external user registry to authenticate and authorize users to access each UI: Service Center, Administrator Console and Virtual Appliance (LMI).

This course will enable you to configure OIDC Provider with an external user registry, understanding its limitations and how to utilize this functionality to better control access to your system.

Topics covered

• Default behavior

1.  Internal User Registry
2.  External User Registry

• Additional Information

1.  Authorization to Service Center
2.  Authorization to Administration Console
3.  Authorization to LMI Console

• Limitations

1.  Group Filter
2.  SSL vs Non-SSL (Group Filter validation)
3.  Security Directory Server

• Troubleshooting

Open Mic presented on 29 October 2020 by Victor Orlandi and Gabriel Rebane

Duration: 42 minutes

This video shows you how to change the default password in Identity Governance and Intelligence.The default password across the IGI database schema is “ideas”. It is always recommended to change the password before the IGI database configuration.

This video discuses configuring an IBM DB/2 database for IBM Security Identity Governance V5.2.3. This includes providing pre-requisites for DB2 configuration and installation and configuration of the DB2 Server.

Password synchronization is the process through which a user maintains a single password across multiple applications. Administrators can associate account configurations with a password sync group and then define password policies to manage password synchronization for the password sync group.

This video shows IBM Security Identity Governance and Intelligence users the steps to deploy and configure the IBM Security Verify Bridge for Provisioning to a test active directory domain. It demonstrates deployment of the required bridge components and the configuration in the Security Verify tenant.

Key Areas of Competency

1. IBM Security Identity Governance UI from an admin and end user perspective
2. Identify the key IGI features
3. Understand the benefits of using IGI for identity and access governance.

Commercial course TW401

IBM Identity Governance and Intelligence is an advanced identity governance system. This course provides the foundational skills necessary to operate, administer, and accomplish the major business functions and analyses provided by Identity Governance and Intelligence. This course provides instruction and hands-on labs for managing the import of data and data exchange with target applications, managing the lifecycle role, modeling access risk control, running certification campaigns, designing workflow processes, and designing and administering reports.

This video describes the whys and wherefores of Identity Governance, starting with the "pain chain" of the gaps between auditors, business managers and IT when it comes to answering the question, "does an employee have the proper access privileges to perform duties per our company's policy?" The video explains key capabilities such as access certification, role mining and modeling, separation of duties and access risk analytics. These capabilities are provided by IBM Identity Governance. The video concludes with a role play of a company that's failed an audit and must address that failure within a 6 month window.

IGI leverages on the Enterprise Connectors application to align its data with the peripheral target systems.

This course demonstrates how to achieve data alignment between the centralized database of IBM Security Identity Governance, and peripheral target systems. The first part of the video focuses on configuring a connection with a peripheral target system, while the second part demonstrates account creation and removal on a remote Active Directory domain.

This video demonstrates how to manage passwords and approve, reject or redirect pending access requests from your mobile phone, using the IBM Security Access Request application.

This Open Mic session was broadcast live from Think on 19-Mar-2018

Chris Weber from the IBM Support team delivered the "IBM Security Identity Governance and Administration Data Integrator (ISIGADI) Tips and Troubleshooting" Open Mic LIVE at the 2018 Think conference.

Agenda:

• Logs and logging settings
• IGI SDK
• Creating new IGI admin ID
• Verify assembly line
• ISIGtoISIM assembly line
• Delta assembly line
• Validate assembly line
• ISIM person attribute mapping

IBM Security Identity Manager (ISIM) product experts answered client questions about identity and governance during this Security Learning Academy Live session at Think 2018, 19 March 2018.

This guided video demonstrates how to integrate applications and systems with the centralized database of IBM Security Identity Governance.

The first part of the guided video focuses on configuring a connection, while the second part demonstrates account creation and removal on a remote application.

This video explains the whys and wherefores of Identity Governance, starting with the "pain chain" of the gaps between auditors, business managers and IT when it comes to answering the question, "does employee Jane Doe have the proper access privileges (and no more) to perform her duties per our company's policy?"

The video continues on to explain key capabilities such as access certification, role mining and modeling, separation of duties and access risk analytics. These capabilities (and more) are provided by IBM Security Identity Governance (formerly CrossIdeas IDEAS).

The video concludes with a role play of a company that's failed an audit and must address that failure within a 6 month window, applying the capabilities described in the first half of the video.

This Open Mic web seminar was originally broadcast on 16-May-2017

• Support Files contents
• Accessing different logs and other files through the IGI appliance interface
• Changing logging levels
• Logging statements in rule code
• Miscellaneous issues

IBM Identity Governance and Intelligence is unique among identity governance tools in basing access recertification and SoD detection on conflicting business activities rather than application permissions.

The business activities approach uses plain English rather than arcane IT terminology to make sure the requester, approver and risk managers easily understand the access being requested and the risk it implies.

The Access Risk Controls module of IBM Identity Governance and Intelligence (IGI) enforces Segregation of Duties (also known as Separation of Duties, or SoD) checks, based on relationships established between the Business Activities layer (BA) and the Role-Based Access Controls model (RBAC).

This video shows how to provision and manage temporary accounts in IBM Identity Governance and Intelligence.

This lab provides a real business user experience with certification campaigns in IGI, and focuses on certification campaign redirections.

Certification campaigns are a formal process that automates the periodic review of a given relationship, and enables critical access decisions by nontechnical line of business managers.

These labs show how administrators configure certification campaigns to satisfy the company's business needs, and how business users (campaign reviewers and supervisors) operate and interact during a certification campaign.

Overview

This Identity Governance Clustering and High Availability Open Mic webcast was broadcast on 14-July-2017

Agenda:

• Overview and Architecture
• Virtual Appliance setup and configuration
• Front-end: Web Load Balancer
• Back-end: DB2
• Back-end: IBM Security Directory Server

Goal:

• Provide guidelines about how to set up clustering and high availability in IBM Identity Governance and Intelligence, presenting a sample solution by Virtual Appliance, front-end and back-end points of view.

This video describes the Data Model of IBM Security Identity Governance and Intelligence, with the dependencies and interactions among the key elements.

The video provides a brief tour of:

• Identities and users in IGI
• Users and entitlements
• Business activities, risks and mitigations
• Connecting the role-based and the business activities models

Overview: This course demonstrates how to use IBM Identity Governance and Intelligence to manage user accounts and support data, such as Groups, Folders, and Secrets on the Secret Server solution.

The first part of the video focuses on creating and configuring an Enterprise Connector between IGI and Secret Server, while the second part demonstrates some relevant integration features, like user account creation, entitlement management, groups, folders, and secret shares management.

Overview

This course demonstrates how to use IBM Identity Governance and Intelligence to manage users, and user accounts, on the CyberArk Privileged Account Security server.

The first part of the course focuses on installing the adapter and configuring a connection with a CyberArk server, while the second part demonstrates some relevant adapter features, like user and account creation, entitlement management, account suspension, password change, and finally, user deletion.

Overview

• Tour of the Administration Console
• Tour of the Service Center
• Access Governance Core
• Managing the exchange of data
• Loading data by using the Bulk Data Load tools
• Loading data by using the Enterprise Connectors
• Role lifecycle management
• Exploring roles
• Exploring role mining
• Access risk control modeling
• Certification campaigns
• Reporting
• Automating tasks
• Tour of the Virtual Appliance console

IBM Security Identity Governance and Intelligence Performance and Tuning Guide 5.2.5 covers the following topics.

Topics covered:

Overview

• Role definition
• Creating a new role
• Adding entitlements to a role
• Publish the new role
• Add scope to the new role
• Assign the role to a user
• Verify success
• Role consolidation
• Observing and consolidating existing entitlements
• Analyze the new role for impact and risk
• Publish the new role
• Add scope to the new role
• Consolidate the new role
• Verify success
• Role mining
• Prepare for the role mining process
• Create a data snapshot for data exploration
• Review the analysis for potential roles
• Use role mining to discover a new role
• Analyze the discovered roles
• Release the role to Access Governance Core
• Publish the new role

A role identifies the set of permissions that are assigned to a user. These permissions are assigned to a user to allow access to the resources of an organization. These labs will teach you how roles are created and managed in IGI.

Overview: The Identity Governance and Intelligence, or IGI, Rules Development Toolkit is a project for the Eclipse Java IDE, designed to assist the IGI administrator in developing and troubleshooting Java rules for IGI.

This video demonstrates how to download, install, execute and use the IGI Rules Development Toolkit.

The IBM Identity Governance and Intelligence Virtual Appliance is an appliance-based solution that delivers the Identity Governance and Intelligence application.

This video demonstrates how you can install the Identity Governance and Intelligence Virtual Appliance, and perform the initial configurations.

This video shows how you can monitor the main resources of the IBM Identity Governance and Intelligence (IGI) Virtual Appliance, and demonstrates how you can investigate and troubleshoot issues.

The first part of the video demonstrates the usage of the widgets on the main Virtual Appliance Dashboard, and the Monitoring menu facilities that you can use to monitor the memory, CPU, and storage used by the IGI Virtual Appliance. The video also shows how you can monitor the IGI Virtual Appliance remotely from any SNMP monitoring application, accessing to hundreds of status variables.

The second part of the video demonstrates how you can configure an appropriate log level to capture enough logging messages and access specific log files. The video then demonstrates how we can create and download the Support File, a single package that captures all the log files at once, after an issue occurred or after having successfully recreated an issue to troubleshoot. The Support Files captures logs from both the Virtual Appliance and the Identity Governance application, and it is ultimately required and used by IBM Support to assist in troubleshooting issues.

This video is an overview of the IBM Identity Governance and Intelligence Virtual Appliance, and demonstrates how configure the main appliance parameters using the Command Line Interface and the Virtual Appliance console.

The Command Line Interface is particularly useful during the early stages of an installation, when the application has not been deployed yet, or to troubleshoot any condition that prevents you from accessing the graphical Virtual Appliance console. In the first part of the video we demonstrate how to use the Command Line Interface to move across menus, work with Virtual Appliance partitions, check fix packs installed, configure the main network parameters, and test the main connection parameters.

 We also demonstrate how to use the Virtual Appliance graphical console for the initial configuration and basic maintenance. We show how to configure the connection to an external database server, install a fix pack, and configure the NTP protocol to synchronize time among all components of the Identity Governance solution.

This video describes the initial loading of data into IGI from external sources as well as the exchange of data between IGI and authoritative data sources and target applications, using the Identity Brokerage Adapters and the Enterprise Connectors mechanisms.

Identity Brokerage Adapters allow managements of targets, where a target represents a user repository for a resource, such as an operating system, a database application, or another application that IGI manages. For example, a managed resource might be a Lotus Notes® application, and a service can be defined for a Lotus Notes User Repository.
A large number of Identity Brokerage Adapters are already supported, and new adapters are being added.

Enterprise Connectors are an alternative choice for periodic HR feeds, or any integration where data changes over time, even on a hourly or daily basis. Enterprise Connectors can be easily scheduled for periodic execution.

Note: This video was recorded during the IGI v5.2.0 Train-the-Trainer session (August 2016).

This is the Instructor Demonstration of the Virtual Appliance Command Line Interface and Virtual Appliance console as in the TW400G IBM Identity Governance and Intelligence Foundations class - Unit 1 - Lesson 2. This video does not include audio. It is intended that the instructor provides narration for the students.

A multi-step certification campaign is a review that involves multiple sequential review steps. The exercises in this lab describe the steps to create and run a multi-step certification campaign. You act as the managers involved in the review, and as certification supervisor.

Bulk Data Load allows the administrator to add a large quantity of data to the AG Core database. This method is suitable for large quantities of data that do not change over
time. Bulk Data Load is therefore appropriate for the initial data load following a new installation and when important changes are in the AG Core database.

Note: This video was recorded during the IGI v5.2.0 Train-the-Trainer session (August 2016).

This video shows how to configure Enterprise Connectors to import user identities via a CSV (Comma Separated Value) file, as the student exercise in Unit 3 - Exercise 2 of the TW400G IBM Identity Governance and Intelligence Foundations class. This video does not include audio. It is intended that the instructor provides narration for the students.

This video shows how to find, run, download, and customize reports. The video also demonstrates how to assign report entitlements to manage access to the sensitive data often contained in IGI reports.

Note: This video was recorded during the IGI v5.2.0 Train-the-Trainer session (August 2016).

This is the first video from Amrin Maria Khan from her IGI 5.2.3 series. She will discuss the Firmware Upgrade of IBM Security Identity Governance and Intelligence Virtual Appliance from V5.2.2 to V5.2.3 using firmware update transfer utility.

IBM Identity Governance and Intelligence version 5.2.3 delivers enhancements in the virtual appliance deployment, product and security integration, and in the technical foundation.
New features include:

• Support for US FIPS 140-2 (Federal Information Processing Standard)
• Improved account management
• Converged Target Administration with Enterprise Connectors module
• Fulfilment status visible in the user interface (a.k.a. What is and what should be)
• Password management via custom rules
• SSH session timeout
• Option for authenticating users from an external user registry to the Local Management interface
• Usability improvements
• Additional language support, bidirectional support
  

This video demonstrates how to configure and use the main new features and improvements of IGI 5.2.3.

IBM Identity Governance and Intelligence version 5.2.4 introduces some enhancements, and a new look and feel, to the user interface.

This video demonstrates the new functionalities on the Service Center, available to a Business User.

Agenda:

• Updates in the Service Center User Interface
• Customization of the login and logout pages
• Column customization in Access Certification
• Signoff updates in Access Certification
• Password synchronization
• Feedback survey

IBM Identity Governance and Intelligence version 5.2.4 introduces some enhancements, and a new look and feel, to the user interface.
This video demonstrates three scenarios with some of the new user interface functionalities available to a line of business manager.

Closed captioned in English, Italian and Spanish

In this Open Mic from 26 June 2019, you learn how to use and troubleshoot the IBM Security Access Manager Adapter (also known as the ISAM Combo Adapter) with the latest level of IBM Security Identity Manager (ISIM) and IBM Security Identity Governance and Intelligence (IGI).

This is a recording of the 10 June 2020 Open Mic about IBM Security Information Queue (ISIQ) installation and configuration. It also tells about the integration of IBM Security Identity Manager (ISIM) and IBM Security Identity Governance and Intelligence (IGI) using ISIQ.

The exercises in this lab describe the steps required to manage and govern users and groups on a Windows domain, by using IBM Security Identity Governance and Identity.

The exercises in this lab describe several configurations that you can perform to customize your IGI environment to fit your company branding, visual identity, and preferences.