How can you perform a thorough user access review for an IAM audit and assessment?

The User Access Review (UAR) process begins by identifying critical user groups, focusing on those with privileged, shared, or external accounts, and individuals with recent role changes. It reviews access to sensitive data and critical systems, basing evaluation on job function necessity, least privilege adherence, and duty segregation. UAR frequency and duration are tailored to regulatory, organizational, and risk factors, with detailed documentation for auditing. Roles within UAR are clearly defined, ensuring compliance with standards like GDPR, HIPAA, SOX, ISO, etc. This approach enhances security, compliance, and aligns with organizational needs and risks.

While doing the scoping exercise, we should also focus whether the UAR process is manual or automated. In case of a automated process we will have to focus on the tool being used to trigger the UAR periodically and the stakeholders involved in the end to end process.

When creating user login credentials, it's essential to provide basic access initially. Subsequently, a thorough review of user profiles is conducted to determine specific business requirements. The necessary approvals are obtained, and users are granted the minimum access essential for their roles, aligning precisely with their operational needs. This approach ensures a controlled and tailored access environment, promoting security and adherence to business requirements.

Clearly define the scope of the user access review (UAR), including the systems, applications, and resources to be audited. This will also clearly state the objectives of the review, such as identifying and mitigating access risks, ensuring compliance with regulations, and improving overall security.

One of the clear examples of the regular User Access Review (UAR) process is the annual (Sarbanes-Oxley Act) SOX controls, during which are checked - the correctness of granting access to users (employees and partners) and re-consent from supervisors - reconciliations between the IAM system and end systems (we exclude unauthorized actions of administrators) - compliance with the SoD rules Frequency and duration depend on control aims.

The collection or inventory of the data is critical. You can only protect what you know requires protection. Ensure IT ticketing system is in sync with HR systems. You need end-to-end visibility of your IAM data. Pay special attention to non-standard and any Exception data. Get it analysed, authorised and tag the specialist data in particular

Role-based access control (RBAC) - This type of model assigns each user a specific role with a set of access rights. System administrators can assign user roles and manage access for each role. It is easiest to imagine role models as a modification of discretionary ones. In order not to make huge access matrices for enterprises and institutions where many people work, roles are built instead of specific users — sets of rules that give sufficient access to solve a certain type of production tasks and then determine which users perform these tasks. Sometimes roles can not only grant additional rights but also remove them.

The most successful and most accurate user access reviews are those that put the onus on people with the most knowledge to make the decision to retain or remove access, such as direct managers or application owners. Capture their input by automating the process using an IGA tool. Avoid making audit or IAM people be the intermediaries.

Before moving to the next step, let's briefly mention the foundations: an access control system has to been working properly (which - unfortunately - is not always necessarily the case). Situations such as the entry time (on the 1st day of a newcomer) not being booked in the system must not happen, as any attempt of data validation will be severely reduced or impossible.

Review user access rights against the documented policies and business requirements. Identify and document any deviations from the expected access levels.

Highlighting the outcomes of UAR (User Access Reviews) holds utmost importance during security committee meetings. In cases where stakeholders have not taken necessary actions, it's crucial to emphasize these concerns as potential risks in these meetings and ensure that reviews are enforced across all departments.

Monitoring of idle user IDs is very important, in today's scenarios of high attrition for both FTEs and Outsourced work force, it is very important to have a robust process.

Link the UAR to your HR procrsses to ensure TIMELY revocation of access rights for departuring users rather than waiting for the next UAR cycle which is planned after few months.

Cloudflare is not only a CDN BUT!! Most people know Cloudflare for being a CDN solution but goes beyond a CDN. For example, Cloudflare and IAM (Identity and Access Management) serve different purposes but can work together to enhance security and control access in the cloud. Cloudflare is a content delivery network (CDN) and security service that helps protect websites from various online threats, such as DDoS attacks. IAM, on the other hand, is a framework that manages user identities and their permissions within a system. integrating an IAM with Cloudflare within organizations can enhance security, enforce access controls, and mitigate risks associated with managing Cloudflare's services and APIs.

Whether your UAR process is manual or automated using an IGA tool/app, the user experience is critical. Strive for self-service but know that a bad UI interface on an IGA tool (I'm looking at you Oracle Identity Manager) makes your life and your users lives difficult.