Ask a CSO to name a manual process that acts as a drag on time and resources, and you might hear identity access management (IAM) get called out.
Managing access is the bread and butter of security – but it often boils down to a small group of highly privileged users (in an IT network sense) manually managing the verification process. This is difficult as verification in practice involves a multitude of stakeholders – most notably HR departments. And this makes for lots of touchpoints.
Take the process of onboarding a new employee, for example – there are lots of tickets for HR to raise with IT for a user account to be created and given the required level of access to different software and services in an organisation. And the reverse applies to employees leaving the organisation. There’s lots of room for communication between other departments and IT to fail and subsequent risk of security vulnerabilities.
Recognising such risk, the cybersecurity community has embraced zero-trust security models – which means not trusting users and devices by default in favour of an “always verify” approach. In theory, organisations that adopt such principles treat all users the same and always ensure adequate authentication and authorisation before granting access.
Realising this vision, however, requires a shift towards just-in-time validation. This means cutting out the manual processes in favour of automation that helps security teams more proactively manage access without adding to workloads.
Zero trust isn’t new
Today, many IAM solutions are billed as enabling zero trust. Broadly, this is true – modern IAM solutions facilitate much more stringent access requirements. The issue is that such solutions often act as a silo – another separate console and workflow operated by a highly privileged user.
From our experience, we think IAM is effective when it slots into an individual organisation and how it actually works. Such IAM can be delivered through the A-Ops platform. A rich set of integrations, limitless automation and no-code workflow builds help organisations using A-Ops better plumb IAM into the business.
Here’s one example. Imagine a user is given temporary access to a network drive with files related to company finances. The user’s role changes and shifts at the end of the temporary arrangement, but their access rights aren’t subsequently updated. That presents an obvious security risk. A-Ops can be used to monitor such risks and automatically contact business stakeholders with an alert prompting recipients to review the access and act or else the access will be revoked. This is automated management of privileged access in action.
Building and maintaining an automated strategy
A-Ops can be helpful right from the outset of internal changes to move closer to a zero-trust model. Sourcing input from internal stakeholders on applications and processes can be automated for essential indexing of all network assets, resources, and data. Security teams can then assign risk ratings across their environment to put appropriate access rules in place.
A-Ops helps organisations get better at Data Loss Prevention (DLP). The critical process of enrichment to evaluate security incidents is well suited to a platform like A-Ops that can pull data from various sources, internal and external, to inform the automated incident response. Thinking end-to-end, A-Ops facilitates the identification of unusual user behaviour, elevates that risk, and then delivers a response – like a prompt to a business owner. This is all automated.
A-Ops also makes IAM run more smoothly. Disparate solutions holding employee details can be connected in a workflow to better synchronise that data, so IT and HR are working from a single source of truth. An A-Ops workflow can deliver self-serve prompts to users locked out of their work accounts so they can remedy access issues themselves without raising a ticket that IT needs to manage manually.
In these use cases, A-Ops acts as a strong IAM solution and a time saver for security and IT teams.
A hint on potential
This blog has addressed IAM as managed by security and IT teams. But A-Ops facilitates better communication between those teams and other departments relevant to IAM, like HR – it also enables those departments to have a stake in automation. While dependent on internal buy-in and use cases, A-Ops’ no-code, drag-and-drop interface makes it perfectly possible for non-technical users in the HR team to build and run their own automation workflows. This compliments any other platform workflows used across the business to streamline overall operations.
A final point. In harnessing A-Ops for IAM purposes – existing IAM solutions don’t need to be ditched. They can also be connected to an A-Ops workflow. The point is that A-Ops makes IAM more integral and connected to the wider business. That’s a powerful proposition that IT and Security leaders should consider.
Reach out to the team today to find out how A-Ops can improve IAM in your organisation.
