Compliant Access Delivery for Cloud and On-Premise Applications

Organizations are undergoing a dramatic transformation as they realign their business models and sharpen their value propositions for the digital age. This “Digital Transformation” is the very key to an organization’s survival and a clear and effective strategy is essential in ensuring they achieve maximum impact with delivering their mission. Two key components make up an effective digital transformation strategy: to leverage technology to deliver your organization’s key value proposition better, and to outsource/offload areas that aren’t core to your business.

This strategy has proven successful but, unfortunately, has often led to a fragmented heterogeneous digital landscape in an “employ the best technology wherever you may find it” approach. Admittedly, this does increase worker productivity, agility, and an organization’s ability to collaborate and innovate, but the downside is that users are consuming a patchwork of applications and services (and often from hundreds of providers in the course of their daily work). This practice further complicates and creates new challenges for IT security and compliance teams who must deliver access and ensure compliance for an ever more complex web of on-premise and cloud applications at all times.

In this short article, we will look at the key challenges that organizations face in providing compliant access delivery for cloud and on-premise applications, including:

• Access Delivery for New Employees
• Defining Compliant Access for an Organization
• Inefficient Access Self-Service
• Outsourced Access Delivery
• Password Problems
• Delivering “Real-Time” Compliant Access
• Verifying Access Compliance

Defining Compliant Access for an Organization

The volume of work required to provision Compliant Access to such a large number of systems isn’t the sole challenge here. Indeed, the lack of a definition for provisioning appropriate access for each type of employee or supplier to each of these hundreds of systems further complicates the issue.

Commonly, this lack of role definition means appropriate and correct access assignments for specific positions are, quite simply, unknown. Lacking such guidelines, IT organizations are unable to automate the assignment and revocation of access. Consequently, their only recourse is to resort to more costly and inefficient manual processes.

Indeed, one all too widespread practice is for IT staff to clone access from users in similar job positions. The references they use are, typically, from users who’ve been with the company for a prolonged period. This is because, from the admin’s perspective, it’s going to remove any provisioning issues or headaches and, of course, get the new user ‘up and running’ quickly. However, because of their very longevity, these users likely occupy multiple positions and have accumulated access that a new employee does not need and which will likely make them non-compliant. This lack of appropriate access definitions for job positions make it unlikely that, when employees move between roles or departments, access is ever removed.

Inefficient Access Self-Service

If the reference user does not have all the entitlements required for the new user, then additional access must be manually requested. Either the new employee’s manager will do this, in advance of the new employee’s arrival, or it will be done by the user themselves on their first day. Unfortunately, these paper or electronic requests often present users with unrecognizable technical names and confusing descriptions—they neither know the company, the naming conventions used, nor what they need access to. As they are unable to identify what they need on the form itself, this often results in users resorting to filling in the manual note section and attempting to describe the access they want. This not only dramatically increases the cost of fulfilling requests but also leads to larger numbers of errors and new security vulnerabilities. Furthermore, a significant percentage of access coming from manual non role-based requests greatly increases the workload of managers during access recertification. This is due to both the volume of direct technical entitlements as well as to a lack of clarity in their meaning.

Outsourced Access Delivery

The lack of a role-based definition for Compliant Access eliminates the opportunity to automate access management. This, in turn, leads to a large volume of costly manual tasks to manage access as well as to fulfill end-user access requests. These end-user requests often lack clarity, thereby further decreasing the efficiency in processing them in volume. This all contributes to the huge workload of access management tasks for hundreds of heterogeneous systems that are impossible for organizations to process quickly. If you think that sounds expensive, that’s because it is. Unfortunately, and all too frequently, the need to bow to budgetary pressures and restrictions sees most large organizations outsourcing this work to the lowest offshore bidder.

Naturally, the sheer volume of these manual access management tasks and the number of systems involved necessitates large teams to manage them. The major issue here is, with using outsourced contractors, all are given direct access to the applications’ admin consoles and with privileged user credentials. Even worse is these outsourced teams have high employee turnover rates. This creates three distinct problems: First, this necessitates constant and expensive retraining on the application-specific user interfaces and security models needed to manage access for hundreds of applications. Second, and a major red flag severe security threat for your Enterprise, is the sheer number of privileged admins that exist in this rapid turnover external user population. And third is the large attack surface you’ve given them admin access to.

Note: according to Forrester, in 2017, 24% of attacks were via an internal attack. However, and as shown in Figure 2, 50% of these were due to malicious intent (2017).