Preventing a major IT security incident requires learning from mistakes. You can wait until your company makes these mistakes, or you can save time and learn from others. To keep your data safe, study these access management mistakes. Please choose one or two of these mistakes and discuss them with your IT security colleagues.
1. No Access Management Review Process
Access management needs to keep up with changes in the organization. For example, senior management may decide to acquire another company. The marketing department may expend its use of consultants. All of these changes mean that last year’s access management arrangements require an update.
To test whether your company is making this mistake, consider your review process at two levels. First, ask whether the IT security department conducts access management reviews on a regular schedule. Second, survey your managers to ask if they are periodically checking the access privileges for their direct reports. Without both review processes, your access management implementation will gradually become out of date. An out-of-date access system means you are at an increased risk of hacking or worse!
2. Failing to Manage Privileged Users Accounts
In the access management world, privileged user accounts present a unique challenge. On the one hand, this set of users has the authority to make fast changes. That helps to maintain flexibility in your organization. However, there is a downside. Privileged user accounts — which can add, change or remove many other kinds of accounts — can cause tremendous damage if they fall into the wrong hands.
To properly manage privileged user accounts, start by recognizing that these users have tremendous authority. On a quarterly or annual basis, review this user list, and see if any of these user accounts can be reduced.
3. An Inconsistent Offboarding Process to Remove Access
Employee turnover is a fact of modern life. People are going to change jobs, accept promotions or leave the company. When somebody leaves a specific job, their access privileges need to be changed right away. For example, a customer service representative may have access to customer records so they can answer calls. However, that access needs to be removed when they leave that job.
Most organizations understand this principle. The challenge lies in removing access consistently. If you are unsure if your company is making this mistake, collect some data first. Make a list of the last 50 people who left the organization or changed jobs. Once you have this list, compare the dates of the job changes and the dates when their access was changed. You will probably discover a significant gap, which means people are retaining access they should not have.
4. Missing Or Insufficient Use of Multi-Factor Authentication
The days of exclusively relying on a traditional password are fading. Banks and companies like Facebook and Amazon have already introduced multi-factor authentication. There are certain situations where adding another layer of authentication protection makes sense. Picture this: A manager is about to enter a pay raise for one of their employees in the pay system. That is a major change! It is essential to verify the identity of the person making the change. That is one situation where using multi-factor authentication makes sense. Further, you may require employees to use multi-factor authentication along with VPN security when they are working from home.
Tip: If you are struggling to make the business case for multi-factor authentication, do your research. Find out which companies use multi-factor authentication with their customers. If possible, find companies in your industry that are using MFA because those examples are likely to be more compelling to your leadership team.
5. No Access Management Reporting or Metrics
Without regular monitoring and metrics, you will never know whether or not your access management program works. Don’t fall into the trap of assuming that a lack of IT security incidents means that your access management system is functioning appropriately.
Now, here’s the good news! You do not have to start from scratch in terms of metrics. Use our article on access management program key performance indicators (KPIs) for a few ideas to get started.
6. Relying On Manual Access Management Processes
Are you still relying on manual checking and inspection for access management? That way of running your program is bound to fail eventually. Here’s the reason why.
A successful access management program requires a consistent approach to every single user account. Imagine if one or two user accounts are ignored during your team’s regular reviews; you have a problem. Login details from those accounts may be abused or fall into the wrong hands. Also, a manual approach to inspecting every single user account gets boring. Reviewing one user account is one matter. Are you reviewing hundreds of user accounts every month? That’s a much more draining task.
Adding new IT security software to your company is sometimes difficult. Start by adding software that will provide immediate productivity improvement. With Group Requester, you manage large groups of user accounts quickly. That means managers and IT specialists no longer have to spend hours comparing user accounts to make sure they are uniform. Instead, you can use a standard profile for all employees who have a similar job role (e.g., Customer Service Representatives all use one access profile while finance analysts use a different profile).
7. Failing to Protect All Systems With Access Management
Has your company added new apps in the past year? If the answer is yes, your access management needs to be connected with those systems. Unfortunately, some companies fail to keep their systems adequately updated. If another year passes, your access management system will fall further behind. To prevent this mistake, ask your managers and project managers to check with IT security regarding new apps and services.
How to Get Capacity to Solve These Access Management Mistakes
Each of these access management mistakes requires a different solution. However, all of those solutions require time. You need time to carry out user account reviews. Your managers need time to discuss new software and SaaS apps with IT security. To get all of these mistakes fixed, you need some capacity. To save hours each month on password resets, get Apollo.
