Protectable Data under one Roof – redundant Monitoring in Access Management

In many government agencies and public institutions, large amounts of unstructured data in the form of documents – often with highly sensitive content – are stored on file servers, SharePoint and applications. From a risk point of view, this form of data storage is particularly susceptible to misuse: After all, the transfer of file-based data is not an obstacle even for technical laypersons.

Need-to-know is the principle by which employees should only gain knowledge of data when needed. In terms of access rights, they should only receive those permissions that they really need for their daily work. This does not sound like a particularly difficult task at first, as there are more than enough technical possibilities to restrict directory access at the level of the various operating and directory systems.

Historical structures

In practice, however, this task is becoming increasingly complex. Due to the requirements of the specialist departments for nesting in the permission structure, interrupted inheritance, creation of cross-relationships and often ad-hoc assigned direct permissions of individual users past the well thought-out group concept, the permission structure quickly becomes unclear.

But how do such situations arise? Often the cause is a combination of permission dialogs oriented on technical users, countless configuration options, manual errors in the assignment of permissions and, ultimately, incomplete to completely missing documentation. In many cases, it is no longer possible to promptly and reliably track who is authorized to access which data – and above all: who authorized this access at what time.

Analyze & clean up – but then what?

Existing analysis tools give organizations the ability to get an overview of their current permission structure and to analyze, restructure and simplify it. But how can a permanent traceability be guaranteed with the constant change of an organizational structure, changing task areas and responsibilities?

The real permanent challenge in permission management is to document this continuous change process completely, while at the same time ensuring that the technical actual state actually corresponds to the released target state and that this cannot be circumvented.

The key to audit-proof access management is therefore the combination of extensive automation of the permission processes from application to implementation, continuous monitoring and comprehensive reporting: the core competencies of the BAYOOSOFT Access Manager.

Depending on the situation and operational environment, the users and data managers can trigger adjustments of the permission status directly via the Self Service Portal or another system via API. Combined with a continuous comparison of the actual permissions against the definition by the data owners, this approach leads to a transparency of the granted access permissions that has not been available so far.

The goal of automated access assignment via Self Service is to shift the responsibility and processing of access management processes away from administrators and towards data owners. Only if permissions are assigned via the specified application and release workflow and no more “past the system”, can the defined target status be maintained and unauthorized permissions be avoided.

Redundant monitoring

By involving the specialist managers in the access managament process and assigning the associated responsibilities, the respective decision-makers are sensitized to the issue of access rights to “their” resources, which significantly increases data security.

The automatic comparison of the technical actuel permissions with the defined target status as well as the automatic resetting of unauthorized changes, if necessary, increases the level of data protection and prevents new proliferation in the permission structure. To further reduce the risk of unwanted access to data worthy of protection, the Reapproval is additionally used for all managed access rights on file servers, SharePoint and in the Active Directory.  With an easy-to-understand operation via the browser, data managers can confirm or revoke access rights intuitively with ‘yes/no”. The possibility to define multiple data responsible persons per resource allows the processing to be distributed to different heads. This makes the recertification process as simple as possible. They are not confronted with mountains of paper or complex IT expertise and can process their task efficiently. This makes it possible to reduce the recertification hurdle, thus ensuring the success of redundant monitoring for data worthy of protection in the company.

GDPR Conformity

Knowledge of existing rights and their necessity is also a significant factor for compliance with the general data protection regulation. The evaluation via simple reports that are understandable for technical laypersons and can be generated at a push of a button without IT know-how ensures maximum transparency for the data managers and thus makes an important contribution to information security in the organization. In order to support the creation and maintenance of the Directory of processing activities, personal data must be identified in accordance with Article 9. Furthermore the purpose of processing must be defined. For this purpose, the Reapproval is combined with the data protection classifications based on the categories of the general data protection regulation. This means that data controllers are always in a position to identify what is essential: Who has access to which data, since when and by whom was this access approved?

Conclusion

Changes in permissions due to personnel or structural changes often lead to a deviation from the “need-to-know” principle and thus ensure a loss of data security in the long term through an uncontrolled growth in permissions. Through the approach of automation, the Access Manager offers permanent monitoring of file server, share point and active directory rights and permanently counteracts this creeping process. At the same time, transparency and awareness of data security will be increased in authorities and public institutions. The combination of data protection classifications as identification of data that is particularly worthy of protection with redundant backup through the easily understandable checking of the permissions situation, puts data managers under the obligation to take responsibility for the fulfillment of compliance requirements.

The BAYOOSOFT Access Manager is a proven tool for authorities and public institutions to secure data worthy of protection by means of automated access management, thus ensuring a permanent, audit-proof authorization situation with low operational effort.

Would you like to learn more about the advantages of automated access management?

Make an appointment today for an individual product presentation or visit one of our regular webinars. Our experts for access management will be happy to introduce the BAYOOSOFT Access Manager to you personally: