Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Identity and access

Who should have access, how to prove it, and how to handle the identity weaknesses attackers use most.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we run an access review that isn't rubber-stamped?
  2. How often do we review access, and who does the reviewing?
  3. How do we decide which systems belong in the review?
  4. How do we review access to a system a supplier runs for us?
  5. How do we review privileged and administrator access?
  6. How do we prove to an auditor that the review really happened?
  7. How do we roll out phishing-resistant MFA, and in what order?
  8. How do we set up a new starter's access before their first day?
  9. How do we build role-based access profiles without a role-mining project?
  10. How do we control administrator access without a PAM platform?
  11. How do we find and control service accounts nobody owns?

When do we…

Triggers and timing: when something has to happen.

  1. When someone changes role, when do they lose their old access?
  2. When must a leaver's access be removed, and what changes if they leave on bad terms?
  3. When do we use a break-glass account, and what must happen afterwards?

Who decides…

Authority: who may approve, accept or act.

  1. Who approves access that isn't in the role's standard profile?
  2. Who approves temporary administrator rights, and for how long?

If…, then how…

Situations: something has happened, what now.

  1. If a reviewer misses the deadline, then what?
  2. If the review finds leavers who still have access, then what?
  3. If someone calls the help desk asking for an MFA reset, then how do we verify who they are?
  4. If a session token was exposed, is a password reset enough?
  5. If some SaaS accounts sit outside SSO, then how do we find and close the gaps?
  6. If a contractor's engagement ends without HR knowing, then how do we catch it?
  7. If an administrator uses their admin account for email or browsing, then what?

Other categories