To manage access to applications and data, enterprises turn to identity providers like Okta, Azure AD, Ping, Duo, and others. While identity providers enable IT teams to effectively manage who can access which app, they don’t have a way to manage who can access, share, change, and delete data within these apps. For example, while identity providers work great for managing who has access to AWS they can not manage who has access to the credit card information kept in a specific S3 bucket. Identity providers work great for managing who has access to Snowflake, but they can’t help you identify which users have access to schemas and tables that they don’t actually use. So while identity providers work great for granting access at scale they struggle to ensure that the access they grant actually adheres to your company policies, industry best practices, and regulation requirements.
What is risky access?
Risky access is when a user has permissions to apps and resources beyond the permissions that are necessary for that user’s job.
How does risky access happen?
- Excessive permissions. Identity provider roles don’t always reflect effective permissions. For example if a Sales Read-Only role actually grants admin access to Salesforce and Snowflake, your identity provider won’t flag that.
- Unused permissions. Users are always proactive in requesting access to applications and in requesting higher levels of privileges that they need for certain tasks or projects. However, users are rarely proactive about requesting to remove access that they no longer need.
Why is risky access a problem?
- Higher vulnerability. Risky access creates more potential entry points for attackers and increases the blast radius of any potential breach. For example if you have access that violates segregation of duties (SoD) principles, you might have users who can both request and approve purchase orders. If one of these users gets compromised or acts maliciously, they can cause significant financial damage very quickly.
- Compliance risk. Having too many users with access to sensitive information such as financial statements or personally identifiable information violates regulations such as GDPR, HIPAA, Sarbanes Oxley, and others.
- Operational inefficiencies. Managing excessive permissions is time-consuming and diverts IT resources from more strategic initiatives
How to clean up and prevent risky access?
- Find and fix risky access. Intelligent access platforms let you visualize and control who can access and change data in every app and database across your whole organization. With these kinds of tools you can find and remove unneeded accounts and unused permissions and empower business managers to make smart decisions about access for their direct reports.
- Automate your access governance. Intelligent access platforms also let you set up alerts to spot risky access as soon as it occurs. When permissions are not being used for 30 to 90 days, or whatever threshold makes sense for your organization, intelligent access platforms can send an alert to your IT team or even shut off the access automatically. You should also monitor all new high-risk access – for example new admin account creation should immediately trigger an alert and get reviewed by the security team.
- Perform regular access reviews. Conduct thorough and regular access reviews and involve managers in making sure that each of their direct reports only has the permissions that are necessary for their current role and responsibilities. If you must use manual methods to control for risky access, you may want to include fictitious or grossly inappropriate access in your review requests to spot rubber stamping and make sure that managers take access reviews seriously. Ensuring that users have the minimum permissions necessary for their roles is referred to as the principle of least privilege.
- Foster a Culture of Security Awareness. Educate employees about the risks associated with excessive or outdated access permissions and encourage proactive self reporting of any permissions and applications that are not necessary.
Check out our short demos to see how Veza can help you review and adjust access privileges and visualize and control who can do what with your data.
About Veza
Veza is the Access Control Platform that enables identity governance. The platform helps companies to monitor privilege, investigate identity threats, automate access reviews, and bring access governance to enterprise resources like SaaS apps, data systems, cloud services, infrastructure services, and custom apps.
