IGA on Sinetris's viewpoints

Access Management

Mon, 15 Jul 2024 16:27:00 GMT

Why you need access management

Some important points are:

It allows to properly document granted access history for auditing and security purposes
- Who had access to a specific system, what kind of access, why, at any point in time
- What did they access, when, and why (via integration with SIEM systems)
- When they are doing operations on a system, this allow to check if they are allowed
Monitor drifting between desired state and actual state and what caused it
Keeping track of users accesses allow to better refine them
- Did they had granted more access than needed for their work?
  
  Grant them access based on principle of least privilege

[Truncated]

Advices

Sun, 16 Jul 2023 18:20:00 GMT

Assets and people

Ensure to have proper Orphan Account Monitoring (for example, people leaving the company) and delegation (for example, people in sick or parental leave) for people assigned to managing assets (Asset Owners, Application Administrators, Infrastructure Administrators, etc). Take into consideration that people might be out of office because in vacation, out sick, at a conference, etc.

Identity Lifecicle Management

Sun, 16 Jul 2023 18:20:00 GMT

HR-Driven Identity Lifecycle

The HR department is the one that knows who is joining, who is leaving, who is moving to another job within the company, who is on vacation, sick leave, parental leave, etc. Their system should expose for each employee at least the name that should be used for them within the company (might be diﬀerent from their legal name, which is only required by HR to sign contracts), the start and end dates (if applicable) of the contract, department, role, line manager, and absences.

[Truncated]

Identity Security

Sun, 16 Jul 2023 18:20:00 GMT

Orphan Account Monitoring

It’s important to find missing identity associations or assets assigned to wrong identities (for example off-boarded employees).

Examples:

An account is associated to an asset but is not assigned to any identity
- All accounts should be associated with one (and only one ) identity.
- If the system allow only one account (for example only one admin), access to that account should happen trough a system that keep track of all actions (see PAM and Just-in-time credentials).
- If credentials to the account are shared it will be hard to know who performed an action.
Asset role (for example Owner or Admistrator) assigned to an Identity that left the company
Employee assigned to a line manager that transferred to a different department

Adaptive Authentication

Varying authentication methods based on runtime evaluation of risk factors.

[Truncated]