Usability vs. data protection: Does authorisation management always have to be so complicated?

Mobile working and the increasing networking of company data make the issue of data protection increasingly important. At the same time, known hacker attacks and data breaches are increasing the pressure on companies. The precautions to protect sensitive customer data are becoming ever stricter and more complicated. The more elaborate the measures, the more difficult it is for employees to comply with them.

Systems should therefore fulfil a dual function: The simpler and easier it is to implement, the more likely it is to protect against data leaks and attackers. Most of the time, the issue of data protection remains the sole concern of IT administration, although everyone should be concerned about it and must handle data conscientiously while working.

But which data must be protected?

Every company has a lot of data: Customer data, stored work processes, employee lists and company secrets. Some of this data needs more protection, some less. Therefore, you should aim for prioritisation. Which data is in daily use and which should be easily available to everyone?

Classifications make it possible to categorise data into different risk levels. Company secrets and personal data, for example, need to be protected much more than the brand of office furniture ordered or the slides of the last online meeting.

The need-to-know principle is suitable. In principle, you should check who needs access to all data. Is the knowledge that can be gained from the data really important for the work of the employees? The need-to-know principle is suitable for this, according to which only those employees who really need access rights are granted access.

In the case of highly sensitive data, you should also check whether there is a protection instruction.

In order to protect data, this restriction of usage rights is unavoidable and is therefore implemented in almost all organisations. However, it is precisely this circumstance that often complicates the work processes of employees: If permissions are missing, the first step is to go through the IT department. They, in turn, must first determine who is responsible for the data in the departments. At the same time, there is a lack of transparency as to who is authorised where.

As a result, authorisations are quickly assigned on a scattergun principle, data is copied into public areas or the revocation of rights that are no longer needed is often neglected. Recertifications recommended by auditors, in which data managers have to check the rights situation at regular intervals, often mean frustration due to additional work and paper mountains full of complex matrices.

Data protection is necessary. However, for success it is even more important to find a middle ground that considers usability and data protection equally and evaluates each process according to risk class and importance.

How can the complexity be mastered?

Those who assign authorisations according to the need-to-know principle run a significantly lower data protection risk. It is advisable to proceed as transparently and intuitively as possible: With an approach of self-service and automated implementation, these processes can be placed in the hands of the users and take place without IT administration. If permissions are missing, they can be applied for in an easy-to-understand manner and without technical details from those responsible for the data. After approval, the changes are automatically implemented in the target system.

Data- and user-centred evaluations enable a transparent presentation for technical laypersons. The use of time limits and the regular review of authorisations prevents an uncontrolled spread of authorisations and helps you to comply with all legal requirements.

Each access authorisation also statistically increases the risk of a successful cyber attack from outside, which can be reduced by controlling the number of authorisations. Automating authorisation management creates security and minimises the risk of a data leak. At the same time, usability is increased so that employees are involved in the process transparently and intuitively.

Good to know

As the automated and secure self-service solution for authorisation and identity management, the BAYOOSOFT Access Manager relies on the three building blocks of self-service, automation and monitoring and thus allows usability in these processes to be significantly increased.

Learn more about the BAYOOSOFT Access Manager

Would you like to get to know the BAYOOSOFT Access Manager directly? Sign up for a 30-day TRIAL.

Test it now

Usability vs. data protection: Does authorisation management always have to be so complicated?

But which data must be protected?

How can the complexity be mastered?

News