Dean Weich

Ensuring Cloud Authorizations Are Correct

Cloud Authorization

Almost all organizations in every industry now use some type cloud application. This is because of cost, efficiency, ease of use and because many software companies are offering their solutions in the cloud. For example, Microsoft 365 and Adobe Suite are mostly utilized by organizations in the respective cloud versions.

Cloud applications have many benefits for both the organization and for the end user, but there also needs to be some type of guideline or solution in place to ensure that they are managed correctly. There are many account and access management issues that come with implementing cloud applications for your organization.

So what are some of the issues that organizations have with access management to cloud applications? Like with in-house applications, often two things happen. End users either are given too few rights and need to request additional access or they accidently receive too many rights to systems and applications that they should not.

cloud-systems

For the first scenario, employees can request additional access rights from the application manager at their organization, but this is very inefficient. They need to contact someone in the company who handles access and request that an account is created for them or additional access rights are made for them. This is frustrating for the employee and for the manager, since they are likely working on other projects. The employee has to then wait until this is created and may need follow up with the admin to see if the request is in the works.

For the latter problem, it is a major security concern for the organization. Often for convenience, an employee’s account is copied from another employee’s in a similar role to make. This potentially leaves the employee with additional access rights that they should not have, possibly to sensitive information.

The issue is difficult to manage and there needs to be someone who is manually creating access or checking to ensure that access rights are accurate. If you are a system admin, a CIO or other technology director, you know that either there is no one who is designated to complete these tasks, or this is something that is delegated to an employee with to an already full workload.

So enough about talking about everything that your organization is having issues with. How can this be resolved and what type of solution and guidelines should be put in place so that this doesn’t regularly occur?

An identity and access governance (IAG) solution is the first way to help ensure that all rights are correct. The company sets up a model of exactly the access rights for each role in the organization. For example, someone working as a manger in the IT department will need certain access rights to systems, applications and resources. This allows the person who is creating the account to easily do so without accidentally making any access mistakes; either giving the employee too many rights or too little rights.

Once an account is created for the employee how can it be ensured that going forward changes are made efficiently and the network remains secure?

Another solution that can be used is workflow management. These applications are a controlled, automated process with a defined sequence of tasks that can replace an otherwise manual process. This allows for a streamlined process for employee requests and their implementation.

Using a web portal, employees can request any additional access rights to their current applications or even new applications. A workflow is set up so that when a user requests a change, the request then goes through a predefined sequence of people who need to approve it before the change is implemented. The organization can set up the workflow process however they desire, so that depending on the user, and what they request, the process goes through a specific sequence. There is also no need for the employee to bother their manager to check on the request. They can easily access the web portal and see exactly where the request is and what steps still need to be completed.

There are also several ways to check access rights, as a double check, to ensure that everything is correct throughout the year or at any interval. These methods will allow someone to check everything is correct easily and efficiently.

One way this can be achieved is with reconciliation. This module in an IAG solution compares how access rights are set up to be in the model to how they actually are and creates a report on any differences. Anything that is not accurate can then be sent to the appropriate manager to check the issue and easily correct if needed.

Attestation is still another form of checking access and goes one step further to verify everything is correct. A report will be sent out to managers of a department, with all their employees, for them to verify that everything is correct. For example, the marketing manager will receive a report on the access rights of everyone in the marketing department. He or she will need to look over and either mark access right for deletion, change access right directly, or create a ticket in the helpdesk system to change the access rights. After looking everything over, the manager must give their final approval for the proposed set of changes to ensure that everything is correct.

For organizations to receive the best benefits from cloud applications there needs to be guideline and solutions in place to help manage the accounts in these applications. These are just some of the many ways IAG solutions allow for the organization to easily ensure correct access rights.

By Dean Wiech

Dean Wiech

Dean Wiech is managing director at Tools4ever US. Tools4ever supplies a variety of software products and integrated consultancy services involving identity management, such as user provisioning, role-based access control, password management, single sign on and access management solutions.

View Website
How Leading Organizations are Leveraging Big Data

How Leading Organizations are Leveraging Big Data

Seeing The Big Data Picture “Data will talk to you if you’re willing to listen”— Jim Bergeson. Few can dispute that. However, the challenge comes when data transforms into bundles and stacks of unorganized and unstructured ...
Machine Learning Explained: Understanding Supervised, Unsupervised, and Reinforcement Learning

Machine Learning Explained: Understanding Supervised, Unsupervised, and Reinforcement Learning

Machine Learning Explained Once we start delving into the concepts behind Artificial Intelligence (AI) and Machine Learning (ML), we come across copious amounts of jargon related to this field of study. Understanding this jargon and ...
Data as a Service

Data as a Service: 5 Strategies to Transition How You Access Data

Data as a Service Information wants to be free — at least that’s the saying. And like any good saying, you can read it in one of two ways. First, information seeks to be out ...
Avoiding the IOT ‘Twister’ Business Strategy

Avoiding the IOT ‘Twister’ Business Strategy

IOT ‘Twister’ Most organizations’ ‪ IOT Strategy look like a game of ‪ ‘Twister’ with progress across important IOT capabilities such as architecture, technology, data, ‪ analytics and governance; variables comprising a series of random investments and decisions. There is something ...
Biometric Authentication

Passwords: More Secure Than Biometric Authentication?

Biometric Authentication Biometrics has long granted or denied access to secure things like premises and vehicles. Now it is being seriously considered for the same role as regards connected services. A recent draft publication by ...
The Lighter Of The Cloud - Virtual Lunch Break
The Lighter Side Of The Cloud - Checking It Twice
The Lighter Side Of The Cloud - Bottlenecking
The Lighter Side Of The Cloud - Snowball Effect
The Lighter Side Of The Cloud - Autonomous Sleigh
The Lighter Side Of The Cloud - Fear Of Heights
The Lighter Side Of The Cloud - Without A Signal
The Lighter Side Of The Cloud - The Robo-Revolution
The Lighter Side Of The Cloud - Really Smart Machines

CLOUDBUZZ NEWS

Kaspersky Lab to open Swiss data center to combat spying allegations

Kaspersky Lab to open Swiss data center to combat spying allegations

LONDON (Reuters) - Moscow-based Kaspersky Lab plans to open a data center in Switzerland by the end of next year to help address Western government concerns that Russia exploits its anti-virus software to spy on ...
Rackspace Launches Kubernetes-as-a-Service with Fully Managed Operations

Rackspace Launches Kubernetes-as-a-Service with Fully Managed Operations

SAN ANTONIO – May 16, 2018 – Rackspace today announced Rackspace Kubernetes-as-a-Service, a highly-available managed service that transforms the way enterprises can utilize new container technologies, accelerating their digital transformation. Rackspace is focused on delivering true transformation ...
Facebook Joins FIDO Alliance Board of Directors

Facebook Joins FIDO Alliance Board of Directors

Aligns with other leading global technology, financial services and e-commerce companies in effort to reduce world’s reliance on passwords MOUNTAIN VIEW, Calif., May 15, 2018 (GLOBE NEWSWIRE) -- The FIDO Alliance announced today that Facebook has been appointed ...