POLICY-BASED ACCESS CONTROLS Access Controls Governor

 

Control fine-grained identity access rights embedded in security roles to meet rapidly changing technology needs, compliance regulations, and cyber threats.

As organizations adopt an increasing number of business applications along with the expansion of data sources and devices, security risks are growing at unprecedented rates. Identity Governance and User Rights Management are more complex and the security design can impede the benefits of a modern digital business platform. Role-Based Access Controls (RBAC) available in ERP applications, Identity Governance, and IT Service Management systems are no longer sufficient to deal with the modern digital paradigm, especially when it comes to policy-based cross-application access management such as Segregation of Duties, User Access Request Orchestration, Periodic Access Certification, Privileged Access Management, and Data Protection.

Managing and controlling identities that grant users access to enterprise applications, databases, servers, and cloud infrastructure is challenging without effective policy-based access controls in place. Complex ERP security design can impede the deployment of a modern digital business platform without specialized solutions and knowledge.

Business needs for effective access controls have evolved, beyond the general IGA capabilities in response to growing compliance mandates and increased cyber security risks. As a result, IGA customers are now demanding specialized capabilities based on new control objectives to address the following gaps in the general-purpose IGA systems. 

 

Policy Management - Segregation of Duties and Privileged Access Policies

Detects access policy violations to control financial, operational, fraud, and cyber risks.  Define policies in terms of risk descriptions, impact, likelihood, and fine-grained rules that constitute discrete and fuzzy logic in terms of IT system security entitlements and privileges for governance models such as Segregation of Duties, Sensitive Access, Data Protection, Trade Secrets etc. Eliminate false-positive filters to improve risk analysis and response. A high-performance policy engine rapidly analyzes millions of security attribute combinations and permutations across all enterprise IT systems and ERPs and business application security snapshots to report violations. Violation Manager eliminates exceptions where risk is accepted with compensating controls, using advanced filters. Remediation Manager issues corrective actions using closed-loop workflows that expedite risk response, reduce risk exposure and automatically update violations reports to ensure audit evidence is accurate and timely. We provide:

·         RULES MANAGEMENT

·         SECURITY SNAPSHOTS

·         VIOLATIONS MANAGER

·         FALSE POSITIVES

·         REMEDIATION

·         COMPENSATING CONTROLS

Policy-based Access Lifecycle Management

Digitalization and the constant evolution of business and IT landscapes together with the increased adoption of hybrid work models, hundreds of cloud applications along with legacy on-premise applications have materially increased the risks in user access request management.

Organizations with complex enterprise systems, require Identity Life Cycle Management solutions to control access for on boarding employees, contractors, and third parties. Any change to work assignments, or departures from the organization requires immediate updates to security privileges in compliance with access governance policies to ensure users only have access to what they need while removing access they don’t need. Policy-based access management also improves user productivity while preventing unauthorized users from accessing business-critical systems.

READ MORE

Integrated Fulfilment – Prevent Risks in ITSM User Request Management 

Today many businesses use ITSM tools to fulfil access requests using roles that are manually configured as catalogs. The downside: the manual management of roles at a high level created audit findings where the attribute level details in the business application do not accurately reflect in the Catalog role.  For example, a role of Payables Inquiry available in ServiceNow does not prevent the risk of fulfilment where the user may also be granted access to the role in the Oracle ERP Cloud application that enables supplier creation – causing and significant risk to financial statements – enabling a user to create suppliers and pay suppliers. 

Furthermore, the lack of integration with business application increases the risk where the access requests in the ITSM system do not match the actual user access in the business application where the access is granted within the application or through multiple provisioning workflows or systems, SafePaaS enables integrated user request fulfilment to prevent fine-grained access violations. 

READ MORE

Enterprise Access Certification - Periodic Access Review Workflow

Periodic access review of users' privileges is a key control for publicly listed businesses that must comply with Sarbanes Oxley section 404. Management must review access to enterprise applications that affect financial disclosure to the public.  Businesses often perform access reviews each quarter. This process often creates a tremendous burden to collect user access data, then send out error-prone spreadsheets waiting for replies from control managers and process owners.

SafePaaS, can streamline the access review process with automated workflows to reduce the cost of SOX compliance and mitigate cybersecurity risks.

SafePaaS customers can prevent the risk of application access control failure by completely automating the enterprise certification process for ALL IDENTITIES across the application and ALL other data sources, including IDM, IGA, ITSM, Database, and Servers. We provide:

 

·         INTUITIVE REVIEW UI

·         CENTRAL MONITORING

·         SOAP / REST / JDBC

·         FINE-GRAINED CONTROLS

·         REMINDERS / ESCALATIONS

·         CHANGE REQUEST

Roles Manager - Simulation and Entitlement Management 

 

Many organizations face challenges in granting business application roles that fit the user access responsibilities and rights to comply with enterprise information policies.

SafePaaS allows you to automate role design and simulate security before violations get introduced into the system.  You can discover role entitlements by scanning access to application privileges and data using the security structure of your business application. Improve application security and user productivity with effective role design. Configure application security components by including new access rights to excluding existing security rights. You can limit user access to data by applying security rules, profile options and personalization based on data role, privileges, organizational unit and other security attributes available within the business application. You can set up change control workflows to ensure that any changes to role design are reviewed and approved by the authorized manager before releasing those changes for user assignment.

Advanced Access Analytics - Security Risks and Policy Violations Analysis 

 

Access Analytics is a key component of an enterprise access governance solution as it can improve the effectiveness of controls and provide real-time insight to mitigate emerging threats. SafePaaS customers use access analytics in many ways and rely on results to safeguard their business against cyber security risks and insider threats from access policy violations.

 

Analytics is also a catalyst for digital strategy and transformation as it enables timely and more accurate design of the business roles and application entitlements in complex and fast-changing business contexts to optimise productivity.

 

Today’s data-driven enterprise can leverage the Identity data stored in the information system using SafePaaS analytics to ensure successful digital transformation including policy-based access governance for sustainable value creation.