Access Certification: The Importance of Certifying Regularly

What Is Access Certification?

Access Certification describes the process where an independent auditor verifies whether the access granted to a user is necessary and appropriate to their job responsibilities. The purpose is to simplify how organizations review different employees’ user access privileges across different systems and applications.

A thorough user access certification process makes sure each employee has the correct authorization they need to access what they need to carry out their role while ensuring the security of internal data.

The access certification process therefore helps organizations reduce the risk of unauthorized data breaches and safeguards confidential information.

Why Access Certification is Important

At a fundamental level, identity governance and administration (IGA) is all about ensuring that the right people have access to the right resources to do their jobs. However, as workforces grow and extend further and further outwards, access requirements can change on a dime.

As businesses rush to enable employees, third-party contractors, auditors, and seasonal workers to perform their roles, they may unknowingly provide them with too much access that is unnecessary for job performance. This can cause serious security risks and/or lead to missed audits.

Important areas for access control

Maintaining a current roster of who has access to what, and having a plan to remove access rights or entitlements that are no longer needed, sits at the core of any successful IGA program.

There are a huge number of variables that dictate what access and entitlements should be granted:

Business resources

Different people require access to different types of applications, whether it’s infrastructure like Azure, AWS, databases, communication applications like Teams or Slack, CRMs like Salesforce, or ITSM tools like ServiceNow.

Certain applications are only required for certain groups of the workforce, while some of them are all-encompassing. The most straightforward example is that all members of an organization should likely have access to email.

Working locations

Depending on where people work, they may require access to different things, including physical locations like offices, or be routed to log in using different VPN locations, geographic subsets of applications, or specific customer data in order to adhere to local data privacy laws like GDPR or CCPA

Job function or status

Job function is mostly tied into roles. For example, a person working on an assembly line is granted access to manufacturing-type systems, whereas a back-office worker will have a completely different set of entitlements to corporate finance and accounting applications.

Another variable might be employment type, where full-time employees should be granted different access rights than temporary workers and have access to things like workplace benefits. It is always important to identify roles and contexts as being a critical component of managing and governing access on a continuous basis.

These variables, which are often context-driven, can also be granted based on events: either regularly occurring and scheduled, or those that occurring at a moment’s notice. A couple of things that come to mind are:

1. Audits. Come audit time, organizations need ways to prove that only certain people have access to certain systems. They may also need to assign additional people with access to databases and different applications to help gather data needed for a specific audit.
2. Busy season. Particularly within retail, this typically revolves around the holidays; however, different organizations have varying ‘busy seasons’ that may coincide with hiring additional staff to help on a short-term basis, leading to a surge in temporary workers.
   Busy periods also require an all-hands-on-deck approach, where people are reassigned access to certain high-priority resources. In these cases, it is vital to remove said access when the season passes.

Benefits Of Regular Access Management Certification

Regular access management certification allows your organization to verify that the right people continue to have access to the right resources to do their jobs, while also identifying inactive and abandoned accounts.

It’s important to validate the correct access assignment for the different business roles, so that you can minimize organizational security and compliance risks.

What Is Access Recertification?

User access recertification is a reviewing process where user identities and access privileges are periodically checked and updated to ensure appropriate access to systems and resources. Put into simpler terms, access recertification is the regular process of evaluating access rights within a system.

Access Certification Campaigns

With all of these things to account for, organizations need ways to continually certify that access is accounted for, managed, and still needed.

Access certification campaigns are a way for organizations to audit entitlements and formally validate that identities’ access rights are appropriate.

When we think conceptually about what these campaigns aim to do, they are meant to remove unneeded access if it’s no longer needed or approve access permanently to things that were previously granted ad hoc.

When constructing certification campaigns, organizations should strive to:

1. Gather data of who is accessing what, when, why, how often, etc.
2. Set up surveys that are quick to answer for business users and quick to set up for administrators
3. Gather granular data so as to inform smarter business decisions
4. Interpret the results in a way that is easily actionable by security and risk management teams, so that least privilege is maintained
5. Prove compliance to auditors
6. Automate processes that were previously manual

Craig Ramsay and I discuss some of these points in finer detail in the on-demand webinar Certify Access with Regularity (and Confidence!). We outline the challenges with access certification campaigns, provide helpful pointers on how to avoid the common pitfalls of legacy approaches to certifying access, and do a live demonstration of how easy it is to set up tangible, targeted certification campaigns and surveys with Omada.