Common in many companies, various teams with differing philosophies installed the customer’s 25 enterprise applications over the last ten years. This disjointed approach has resulted in an application landscape with 5-10 unique user identifiers that may not be consistent with each other. Additionally, active directory manages some of the applications and other applications utilize local accounts.
The company’s HR system only includes full-time employees and less than 25% of active contractors. The existing HR configuration means part-time employees and 75% of the contractors are not assigned a universal identifier, making user access reviews complicated.
Compiling the information and running the correlations for the user access report takes the company weeks to complete. After the report is complete, the IT team must wait for all the managers to respond before remediating any findings. The responses often take weeks or months to collect.
Since the company is responsible for over 750 websites, they face regulatory requirements to perform user access reviews on a semi-annual basis. The purpose of these reviews is to ensure that employees do not have inappropriate access.
Compiling the information necessary to run the user access reviews is time-consuming and inefficient. The amount of contractors complicates the reviews as they are not listed in the company’s HR system.
Clarity Security's Solution
The customer's goal is to speed up the time it takes to complete a user access review without compromising accuracy.
Once ratified during the onboarding process, these policies will automatically provision accounts based on a user's position in the company. Access is not granted on a user-by-user basis but through a role-based system. This approach removes the dependency on managers' in-depth understanding of the enterprise application landscape and knowing all their employee's access points. With Clarity Security, managers only need to verify that their employees are still employed and have the correct title.
Our manager portal caters to the non-IT professionals by presenting the users and information for manager review in a simple-to-understand format. Once the managers review the items, their change submissions trigger the remediation activities automatically.
Before Clarity Security, the company’s user access review cycle was a 6-week process twice a year. The effort includes running reports, generating spreadsheets, and performing hundreds of correlation searches – all taking anywhere from 40 to 80 hours to complete.
With Clarity Security, the 40 to 80 hours compresses into a 5-minute effort consisting of logging into the portal and clicking “Initiate User Access Review.” Managers are then immediately notified, and their responses and changes are tracked and maintained within our system.
Review & Remediation
Without Clarity Security, the IT team would need to contact all of the managers after the user access report is generated and compile their responses into a master spreadsheet. Once all responses were received, tickets were created with the respective teams to disable or correct access with an SLA of 14 days. Ticket-based remediation means that ticket submission occurs after the full user review is complete. Each application requires a remediation ticket.
After implementing Clarity Security, managers can log into their portal to see the items they need to review. As the managers log their responses, corrective actions (adding and removing access) occur in real-time. This approach eliminates the time to remediate and allows the IT teams to focus on other initiatives.