- Identify the business owners of every application.
- Instruct business owners to classify the data in their applications. Corporate policy should define the different classifications.
- If there is no policy on periodicity of access reviews based on the data classification, create one. I would suggest access to high-risk applications should be reviewed quarterly and every application should have a review conducted at least on an annual basis.
- The business owner should identify the departments that use its application(s) and approve or reject them. I recommend this approach because the business owner may not know what individuals should have access to the application, but they should know what departments are and what level of access is appropriate for those departments. At the end of this step there should be two lists: Approved departments and rejected departments.
- Notify the managers of the rejected departments that all of the people in their department will have their access removed from the application(s). I would give the managers two weeks to negotiate with the business owner before removal.
- Send the managers of the approved departments a list of all their employees with access to the applications and give them two weeks to approve each individual. There should be two new lists at the end of this step: the approved individuals and the rejected individuals.
- Remove access of the rejected individuals.
- Make sure that all of the approval transactions are recorded in an auditable manner.
Also, a separate but important best practice is to make sure separation of duties among developers, data custodians and IT administration is well defined and documented.
There are some great products on the market that can help with this process. They are auditable, provide workflow engines, and some even interface with automated provisioning solutions. SailPoint Technologies Inc.'s Identity IQ and CA Inc.'s Eurekify's Sage are products worth investigating.
For more information:
- Learn best practices for implementing and maintaining enterprise user roles.
- Privileged account management implementation made simple: Check out these steps.
This was first published in February 2009