HR Pulse

How safe is sharing your company information?

Is it really a good idea to share your company information with individuals you don't employ, e.g. independent contractors? Many organisations now find themselves in the preliminary stages of sharing information from their company networks with independent contractors and other partners. A wholesaler, for example, may offer clients a portal where they can view inventory and order status, their customer details and outstanding invoices. Ensuring the safe exchange of information to outside parties is a whole other issue, as is the process of letting users authenticate themselves. However, the process is usually simple and easily managed automatically using HR technology.

Organisations are identity providers for external parties accessing their networks

Individuals external to the company who log in to the network, via a portal, must be able to authenticate themselves easily. The easiest method of achieving this would usually be via HR technology.

Most organisations choose to use their existing active directory for this authentication. After all, the active directory is an excellent credential store for employee's user accounts and a considerable active directory experience enables optimum management and continuity. An active directory account is usually chosen for external service providers who need to access their network. Organisations often enter into agreements with Microsoft to prevent client access licence (CAL) fees needing to be paid unnecessarily for infrequently used active directory accounts.

A drawback of adding external parties to the internal active directory is that the number of active directory accounts increases significantly. Organisations also often realise that they must have the identity lifecycle for third-party accounts fully under control. After all, if any external individual can log in via the portal, this could result in potential financial damage. This means that the organisation must ensure that their active directory is clean and up to date. All of this represents a major management burden for the IT department. These issues can easily be solved though using an identity management solution enabling real-time user account management for external customers.

The CRM solution as source system

Another consequence organisations face when deciding to add third-party accounts to the active directory is that it involves a source system other than the one used for internal employees. For them, HR technology is often used to create network user accounts, but customer data comes from a CRM system. More often than not, CRM systems do not contain clean and up-to-date information, making them problematic to use as a source system for user accounts. If organisations want to act as identity provider for external customers, this means they either need to optimise the content of their CRM, or look for another source system.

Organisations can address this problem by not populating the active directory until the customers log in to the portal the first time, enter their details and are granted access after internal validation. By creating a link between the CRM system and the active directory, it is then possible to add to the customer details using information from the CRM system.

Dean Wiech is the managing director of Tools4ever. Tools4ever supplies a variety of software products and integrated consultancy services involving identity management, such as user provisioning, RBAC, password management, SSO and access management.