Caldera Systems: Sequencing Identity Investment After an Acquisition

First, reject the framing. 'Pick one' assumes the three close equivalent risk. They do not, and two of the findings need no purchase at all.

Do immediately, with no tooling (days, not months):

• Disable the 41 leaver accounts and the contractor's VPN access. Those are process failures with a manual fix; leaving them live while a procurement decision runs is indefensible at the audit committee.
• Freeze new nested-group Domain Admin grants pending the tiering work.

Then sequence:

1. SSO + SCIM ($60k) first. It is the enabling control: one authoritative identity source is the prerequisite for trustworthy certification data, and it directly addresses the lifecycle failure you can actually measure (the 11-day tail). It is also the cheapest, leaving budget headroom.
2. PAM ($140k) second. The 62% figure is a standing-privilege problem, and vaulting plus session recording plus JIT removes standing admin far faster than an RBAC cleanup will. This is the largest blast-radius reduction available.
3. IGA ($180k) last. Certification run against 340 groups, 210 of which are inert, certifies the mess. Buy it once the entitlement model is clean, or you will pay to attest to noise - and check overlap: if the IGA tool's deprovisioning duplicates SCIM, you are buying the same control twice.

The defensible line: fund the cheapest prerequisite now, request PAM in the next cycle with the tiering plan attached, and show the committee that the leaver gap was closed in week one.

Challenge the number's meaning first. 62% of accounts reach Domain Admin through nesting - that is a statement about entitlement path, not about need. Nobody has yet shown what those accounts actually do. Answering the question as asked would mean attesting to a measurement nobody made.

What to do instead:

1. Effective-access analysis, not group membership. Compute the transitive closure so you can state which accounts have a live path to Tier 0. That is the finding; nesting is only the mechanism.
2. Sample-based need validation. Take the highest-risk cohort (accounts with a Tier 0 path that also log in interactively or from unmanaged endpoints) and validate need with the line managers. Sample, do not boil the ocean in eight weeks.
3. Tiered admin model as the target. Separate Tier 0 / Tier 1 / Tier 2, remove interactive logon on Tier 0 for anyone who does not need it, and replace permanent membership with time-bound elevation via PAM.

Evidence package for the committee:

• Effective-permission report with methodology and the date of the data.
• The 41 leaver accounts closed, with the closure tickets.
• The contractor's 11-day tail documented as a control failure with the new sponsor-and-expiry design.
• A named list of Tier 0 path holders still awaiting validation - stated as open risk, not hidden.

Declaring '62% remediated' when you have merely deleted groups would be the worst outcome: the number improves and the exposure does not.

The failure is not sync speed. An 11-day tail on a nightly sync means there was no termination trigger at all - the procurement record never produced a leaver event. Fixing the latency would have bought you ten days of a problem that should not exist.

Design principle: fail closed, not fail faster.

1. Sponsorship. Every non-employee identity is created only by a named internal sponsor, with the sponsor recorded on the object. No sponsor, no account; sponsor leaves, identity expires.
2. Default expiry. Contractor accounts carry a hard expiry (e.g. 90 days) and access renews only by explicit sponsor attestation. The null action becomes revocation.
3. Single authoritative feed with reconciliation. Pick one source of record per population and reconcile weekly: directory vs. active vendor roster vs. VPN/SSO login logs. Anything active in the directory but absent from the roster gets disabled automatically.
4. Event-driven termination. Wire the procurement system's contract-end event and the sponsor's offboarding into the same deprovisioning path as the HR feed; SCIM handles delivery only if a trigger exists.
5. Detective backstop. Alert when a non-employee account authenticates after its sponsor is inactive or its contract end date has passed.

Judgement to record: automation is worth less here than the expiry default. Sponsorship plus expiry means every missed event self-heals within the account lifetime, which is why it is preferable to chasing sync frequency.