The Problem: For decades, organizations have relied on provisioning platforms — access request workflows and static role assignments — to manage who gets access to what. The intent is sound: apply least privilege, grant only what's needed. But the execution degrades over time into permanent entitlements that...
To provide business agility an organization’s Identity Governance program should constantly manage user access change requests, while ensuring compliance and manage access risks. In order to manage access risk, it is important to identify, quantify, flag and take actions through the Identity Governance process. Two of...
Organizations must perform Access Certification to effectively meet audit and compliance requirements, and improve its overall risk posture. However with large number of applications and use access reviews, organization go through “access certification fatigue” i.e. Reviewers do not have entitlement information and context necessary to...
An application access is generally expressed as a business function/permission on a set of resources/assets/datasets. Each application has its own access control model (ACLs, RBAC, Discretionary/Mandatory access control etc.). To simplify administration, these fine grained authorization policies are published as a set of "entitlements". Application delegates...
Dormant access is a user access (account/entitlement assignment) that has not been used recently for certain period of time. Time period after which an access is termed as "dormant" may be different for different application/entitlement. Organizations, typically, attempt to govern dormant access by conducting access certifications...
One of the most common source of insider threat is user/system acquiring unauthorized access to an application bypassing in-place Identity Governance processes (Ex. modifying application's security configurations/policy by application administrator). End-point security, Reverse proxy, IDS/IPS systems will not be able to prevent/detect such seemingly benign...
Business need: A holistic view of information security management in an organization with the purpose of: Measuring effectiveness of a security control or policy. How realistic were my ROI forecasts and its trend? Design, develop, and optimize organization's security strategy. Improvise effectiveness and productivity. Do...
Identity Governance and Administration (IGA) has evolved into a business driven compliance and risk-based program with capabilities focused on entitlement management and access certifications. Entitlements management involves maintaining entitlements, and providing a means to capture, organize, and assign entitlements and associated permissions, that determine user...
This famous quote has been attributed to W. Edwards Deming, and for data analysts it captures their underlying “data-driven decisions” belief. Data is key for organization to improve efficiency, performance and to gain insights from information, in order to compete and lead the change. The quote...