Access Assurance
Access Assurance is Courion's comprehensive approach to identity and access management and compliance that unifies Access Governance, Access Provisioning and Access Compliance in the most complex, heterogeneous environments. Implementing Access Assurance enables organizations to ensure only the right people have the right access to the right resources and are doing the right things.
Organizations in today’s dynamic business environment are constantly striving to improve productivity and reduce overhead expenses. At the same time, they are concerned with strengthening security and improving compliance with corporate policy (authorization, segregation-of-duties, password strength), industry requirements (PCI DSS) and relevant government regulations (Sarbanes-Oxley, Gramm-Leach-Bliley, HIPAA, UK Data Protection Act.)
Access Governance
Access Governance focuses on defining corporate access policies. Polices vary from one organization to another, but common business policies govern such things as new hire and termination authorizations or segregation of duties, as well as IT policies concerning access rights, password integrity, auditing, etc. Access Governance defines business roles (senior teller, customer service specialist, sales manager, etc.) and aligns them with IT accounts and entitlements, using role lifecycle management to link access rights to mission-critical IT resources with corporate goals and objectives.
Access Provisioning
Access Provisioning is where policies, entitlements and roles are implemented and put into practice. Access Provisioning provides users with access to the systems and resources they require to effectively and efficiently perform their business function, consistent with the policies defined by Access Governance. User access provisioning enforces entitlements (what users can do), while password management enables user self-service and enforces passwords policies (password strength, min/max length, expiration). Managing the user access lifecycle includes modifying or revoking access rights as a users status changes (promotion, transfer, termination).
Access Compliance
Access compliance management enables the organization to monitor and validate users access rights and entitlements. Access certification meets the increasingly critical need to verify that access controls are appropriate and consistent with policy and relevant internal and external mandates. Access Compliance supports the ability to audit and attest that access rights are appropriate and report on compliance to relevant authorities. Where exceptions to policy are uncovered, it provides a mechanism for approving and managing exceptions, or modifying policy if the exceptions prove to have business value.
Access Assurance Lifecycle
The Access Assurance lifecycle links enterprise security and access policies with people, their access rights to enterprise resources, and their activities by enabling the organization to:
- Define policy
- Apply policy by enabling specific access rights
- Monitor and detect user activity
- Remediate access rights or policy
- Validate that user access rights are consistent with policy
Access Assurance Benefits
By adopting an Access Assurance approach, organizations of all sizes gain key benefits:
- Lower costs – Automation substantially reduces overhead costs associated with creating and managing user accounts. Help desk calls often drop by as much as 80% or more. The time and effort required to collect data to meet compliance mandates shrinks from days to minutes.
- Improve productivity – New hires are productive on day one, rather than waiting for access to the systems they require to perform their jobs. User downtime due to forgotten or expired passwords is eliminated. IT personnel can focus on exception handling rather than routine access management tasks. Business unit managers can respond to auditor requests quickly and efficiently, allowing them to focus their efforts on running the business.
- Enhance business agility – Companies can response much more rapidly to changing business circumstances, such as a merger, acquisition, divestiture or reorganization.
- Strengthen security – Instantly revoke access to mission-critical systems from ex-employees or business partners. Enforce security policies, such as password strength, that reduce the likelihood of sensitive data being compromised. Discover and eliminate “zombie” accounts that expose the organization to potential intruders. Ensure accurate and consistent security audit trails.
- Continuous compliance – Ongoing compliance processes allow managers to quickly and easily verify and attest their staff is in compliance with key regulations and policies, and rapidly remediate policy violations when they are uncovered. Compliance becomes a transparent part of daily business operations.
Organizations that adopt an Access Assurance approach to identity and access management and compliance management leverage Access Governance, Access Provisioning and Access Compliance to reduce costs, enhance security, and improve compliance by ensuring only the right people have the right access to the right resources and are doing the right things.
To learn more, join us for an open discussion of Access Assurance at Courion's Access Assurance Blog.