Ensuring the Accuracy of Access Rights: Identity and Access Management (IAM)

The regular review and adjustment of access rights is a central component of the company's IT security strategy. An automated Identity and Access Management (IAM) system ensures that access to IT systems and sensitive data corresponds to users' current roles and responsibilities and prevents unauthorized access.

Further information can be found here: IT-Security

Objective

The main goal of this process is to ensure that access rights are correctly assigned and regularly reviewed to guarantee maximum security and efficiency in handling sensitive data. Continuous reviews and adjustments ensure that only authorized individuals have access to the necessary IT resources.

Scope of the Process

All employees, systems, applications, and databases requiring access rights fall under this process. The IAM system enables the monitoring, management, and regular review of access rights, with quarterly checks and continuous adjustments to ensure up-to-date access controls.

Implementation and Workflow

Setup and Configuration of the IAM System

• Implementation: The IT security team works closely with the IT department to install and configure the IAM system so that all user identities are centrally managed. Access policies, roles, and responsibilities are clearly defined, allowing access rights to be managed according to these specifications.

Regular Review of Access Rights

• Automated Controls: The IAM system conducts quarterly reviews, comparing all existing access rights against defined role profiles. This ensures that no unnecessary or unauthorized rights are present.

Adjustment and Revocation of Access Rights

• Corrective Actions: Based on the review results, access rights are adjusted. Unnecessary or outdated rights are revoked, and new rights are granted when employees’ responsibilities change. Timely and precise adjustments are crucial in this process.

Formalized Approval Process

• Review by Department Heads: Particularly for sensitive data access, changes to access rights must be formally approved. Department heads review and approve the proposed changes to ensure that access rights are assigned correctly.

Continuous Monitoring and Auditing

• Monitoring of Access Activities: The IAM system continuously monitors network activities. If suspicious or unauthorized activities occur, an immediate alert is triggered. Audits help identify vulnerabilities and address risks promptly.

Documentation and Reporting

• Transparent Communication: All changes and review results are documented and regularly reported to management. These reports provide insights into the current access rights situation, identified risks, and measures taken for improvement.

Training and Awareness Initiatives

• Raising Employee Awareness: Regular training ensures that employees understand the importance of their access rights and know how to request or change them correctly. Additionally, they are informed about the risks and potential consequences of unauthorized access.

Roles and Responsibilities

• IT Security Officer: Oversees the use of the IAM system, initiates regular reviews, and prepares reports for management.
• IT Team: Handles the technical implementation and maintenance of the IAM system and supports access rights adjustments.
• Department Heads: Review and approve access rights for employees in their respective departments.
• Management: Oversees the process and ensures that all necessary resources are available.

Reports and Regular Review

Reports on the review and adjustment of access rights are created regularly and presented to management. These reports include an overview of all changes made, potential risks, and suggestions for improving access management.

Optimization and Adaptation to New Requirements

The process for managing access rights is continuously evaluated and adapted to current requirements and new threats. Regular optimizations ensure that the IAM system remains secure and effective in managing access rights.

Conclusion

A strong Identity and Access Management (IAM) system forms the backbone of a secure and controlled access environment. By continuously reviewing and adjusting access rights, the company ensures that only authorized individuals have access to the necessary IT resources, while minimizing security risks from unnecessary or unauthorized rights. The combination of regular audits, formal approval processes, and targeted training creates a clear, secure, and adaptable structure. This not only keeps the IAM system up to date, but also prepares it to meet future security requirements, ensuring accuracy in access management and compliance.

Regular penetration tests and security checks to meet NIS2 requirements