About Automobile Association (AA)
The Automobile Association (AA) has provided its members with breakdown support since 1949, and now offers many other services including motor insurance, driving lessons and the production of maps and guidebooks. The AA serves a membership of more than 15 million drivers across the UK.
Challenge
The AA established its motor insurance division in 1967, and it has grown to become the largest home and car insurance broker in the UK. The AA must comply with Financial Services Association (FSA) regulations and guidelines, and the publication of a white paper on financial crime risks in information security led the AA to consider the security of its IT systems.
The Association's existing processes for managing users on its network were based on SAP Human Resources software. The creation and deletion of user identities was a largely manual process, and it was difficult to track changes to the user database. A low level of control over user identities was putting the organisation at risk—and if the network were compromised, senior management could be held responsible.
"The AA is essentially an insurance company, and we had to ensure that the right security was in place," said James McNeilly, Senior Architect at the AA. "We needed the ability to audit our IT environment and easily identify users and access rights."
Novell Solution
The AA implemented a solution based on Novell Identity Manager and Novell eDirectory™, running on Novell SUSE® Linux Enterprise Server. The new solution will be integrated with the Association's existing SAP Human Resources system, ensuring that user identities are correctly synchronized across the organisation.
"SUSE Linux Enterprise Server is a flexible platform which enables us to leverage the potential of open source technologies," said McNeilly. "It is a highly reliable environment for the Novell identity management solution, and the combination of Novell products gives us a simple, single-vendor support structure."
Novell eDirectory keeps track of all the AA's assets—from servers and workstations to employees—by organising them into a logical tree. An object's position in this tree determines its access rights, which makes it easy for system administrators to implement access controls both globally and on an individual basis.
Novell Identity Manager will be used to synchronize account information between eDirectory and SAP Human Resources, and extend it across all internal systems, enabling consistent control over user access.
"Novell Identity Manager and Novell eDirectory will provide us a huge degree of control over user management," said McNeilly. "At the same time, we anticipate that the new system will be much simpler to use, and will save time and reduce workload for our IT team."
The creation, deletion and editing of user identities is now highly automated, relieving staff of manual processing duties. More important, the new solution ensures that AA employees can get access to the systems they need and prevents unauthorised users from accessing sensitive information.
"The Novell solution helps us ensure that current employees have the correct account privileges, and that staff who have left or moved within the organisation do not have unauthorised access to systems," said McNeilly. "This increases security and considerably reduces our business risk."
Results
Critically, the new solution enables the AA to audit its identity management—the Association can get a clear view not only of which users have which rights, but who granted those rights, and when. This will aid compliance with FSA guidelines by establishing a better information security framework, enabling the AA's IT staff to provide management with full audit reports on network security and to monitor the success of IT policies and processes.
"Using Novell Identity Manager, we can remove access rights from a user within seconds when they leave the organisation, and the change is instantly reflected across all systems," said McNeilly. "The importance of compliance with FSA security guidelines is not just that it reduces business risk. It will also allow the AA to reduce its capital offset obligations, freeing up money which can then be invested elsewhere in the business."
By simplifying and automating its user provisioning processes with Novell Identity Manager and Novell eDirectory, the AA expects to significantly reduce the workload for its IT staff, making accounts easier to create and delete.
Released from routine administrative duties, the IT staff will be able to concentrate on optimising its environment and introducing new functionality. Novell Identity Manager is open and flexible, so the AA will be able to integrate any new systems into the same central identity management solution quickly and at low cost.
"The Novell solution is an excellent fit for the AA, helping to increase information security and reduce business risk while keeping costs under control," said McNeilly.