Courion Locks Down Bank IDs

Case Study: Courion helps SunTrust Banks manage its identity needs.

Courion Corp. identity management and provisioning tools have helped SunTrust Banks Inc. create staff efficiencies while reducing both data entry errors and the time needed to get new employees up and running.

Atlanta-based SunTrust Banks has retail offices in the Southeast and mortgage and commercial offices throughout the United States. The bank employs about 33,000 people, with the largest distinct group being tellers.

Tim Callahan, group vice president in charge of access control and support services, said Courions tools have been key in enabling SunTrusts IT department to effectively manage the shifting identity needs of a banking operation.

/zimages/3/28571.gifClick here to read about a plan to share identity-theft data among financial institutions.

"We achieved ROI [return on investment] within about six months, which, in my view, was remarkable," said Callahan. "Our greatest opportunity for identity provisioning was in our retail bank offices. We have a lot of tellers—thats a good entry point into the company ... but then they are promoted, move between branches or move to different jobs. So we see a lot of churn in this large group of employees."

In 2000, said Callahan, SunTrust Banks went from operating as 28 different banks to a single bank charter. Security tasks, which included many manual operations to grant user access to bank systems, were controlled by different site owners and area coordinators. Access-control operations—including granting user names and passwords, as well as password resets and auditing access controls—were handled in this decentralized environment.

The bank rolled out Courions AccountCourier in 2003 and then implemented Courion components including PasswordCourier and ComplianceCourier.

The result, in Callahans view, is enviable: "We took a process that required about eight days down to just a matter of a bank manager accessing a Web site and inputting a few pieces of information to grant virtually immediate functional access."

About 70 percent of the banks employees are now in the Courion system, and Callahan expects all employees will be integrated in September.

The Courion system was instrumental in the quick integration of about 5,000 employees who came on board as part of a recent acquisition, said Callahan. "This project would have, under the old system, taken the equivalent of about 30 people working two weeks," he said. "We did it with an effective staff of about three in a week."

/zimages/3/28571.gifTo read a review of Courions Enterprise Provisioning Suite 7.2, click here.

All employees initially were mass-loaded onto the system with basic rights so they could access human resources systems. SunTrust IT staffers then made two more passes through the new employee group to provision each person with credentials based on his or her job function.

The Courion system helped IT staff not only process these new employees quickly but also process them with few errors. "If I had used the old system, with 30 people setting up these 5,000 new employees, the potential for error would naturally be pretty high," said Callahan. "When you are providing access for [new] employees during a merger, you have to be sure that the people who are meeting the customer ... have access to the IT services they need."

Technical Director Cameron Sturdevant can be reached at

/zimages/3/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Security Center Editor Larry Seltzers Weblog.