Ask the Expert

How to conduct a periodic user access review for account privileges

Where could I find a template or example version of a written standard for periodic access reviews? Something that would help with ensuring all the right areas/topics are included in the standard. This would be used as a sort of guidance for data/IT security analysts, internal auditors, application owners, data custodians and delegated administrators, ensuring all were working from the same set of directions and expectations.

    Requires Free Membership to View

I'm happy to share the high-level overview of my periodic user access review standard:

  1. Identify the business owners of every application.
  2. Instruct business owners to classify the data in their applications. Corporate policy should define the different classifications.
  3. If there is no policy on periodicity of access reviews based on the data classification, create one. I would suggest access to high-risk applications should be reviewed quarterly and every application should have a review conducted at least on an annual basis.
  4. The business owner should identify the departments that use its application(s) and approve or reject them. I recommend this approach because the business owner may not know what individuals should have access to the application, but they should know what departments are and what level of access is appropriate for those departments. At the end of this step there should be two lists: Approved departments and rejected departments.
  5. Notify the managers of the rejected departments that all of the people in their department will have their access removed from the application(s). I would give the managers two weeks to negotiate with the business owner before removal.
  6. Send the managers of the approved departments a list of all their employees with access to the applications and give them two weeks to approve each individual. There should be two new lists at the end of this step: the approved individuals and the rejected individuals.
  7. Remove access of the rejected individuals.
  8. Make sure that all of the approval transactions are recorded in an auditable manner.

Also, a separate but important best practice is to make sure separation of duties among developers, data custodians and IT administration is well defined and documented.

There are some great products on the market that can help with this process. They are auditable, provide workflow engines, and some even interface with automated provisioning solutions. SailPoint Technologies Inc.'s Identity IQ and CA Inc.'s Eurekify's Sage are products worth investigating.

For more information:

This was first published in February 2009

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: