Attestation in IAM

[Music] Hello everyone and welcome to another episode of the identity navigator. Today we will talk about certifications u or also known as attestations in IM. This according to me is one of the most if not the most important IM process.

This is because this is where the IM systems interact most with the users. The only other things could be login. But when something goes wrong with the login, normally they remind users of a help desk.

But anytime a certification campaign is launched, an email reminder is sent or any other notification to remind them that certification needs to be carried out. Remind the users of identity and access management team. This is where executives outside of your own hierarchy knows of IM systems.

The leaders across companies uh the business leaders the business interacts firsthand with the IM system sees what level of communication is being sent out see what their experience is like and based upon that they create an impression of the IM team. Now this is where this is most important because this is where we have maximum interaction with the users in the way these in this channel of certification. So throughout my career I have been lucky to have implemented various innovative certifications program uh and by virtue of being in an audit firm for some time uh I've also looked into regulatory requirements and what do regulators look at in terms of certifications.

But before that, a bit of a personal update for the last couple of weeks. Uh I was actually traveling for some time. I was overseas uh last week visiting my extended family.

The weather is getting absolutely depressing in New Jersey. Uh especially after the last uh the daylight saving last weekend. But a good thing is that I am speaking at a user conference on 16th about running an effective IM program and looking forward to that.

So let's let's dive into a test stations. So Eli 5 explain like I am five what is a test station? Now imagine you have a big box of toys but not all toys are for everyone.

Some toys are for older kids, some are for younger ones. Now, in your house, there are rules about who can play with which toys. This is kind of like identity and access management in the computer world.

These rules. Now, let's talk about attestation. So, imagine uh your mom or your dad checks every now and then to make sure that everyone is playing with the right toys for their age.

They might ask questions like, "Are you supposed to play with this toy? " Or, "Is this toy safe for you? " This is like a test station.

It's a way of checking and making sure that people in a company only have access to the computer stuff that they should have access to and nothing more. So, attestation in a nutshell, uh, attestation in IM is or are critical processes for verifying user access rights within an organization. Now I am more than any other team in the organization knows the importance of less is more privileged credentials less is more.

Uh so why do organizations need attestation? Obviously the the correct answer would be enhancing security right attestations help ensure that only authorized individuals have access to specific systems data resources. So this is key in preventing unauthorized access uh which can lead to data breaches uh leak of sensitive information or any other security incidents.

Apart from security, obviously uh compliance with regulations is possibly the number one reason why multiple organizations carry out certifications. And unfortunately this is the reason this is possibly the reason that this is carried out badly because what we are only trying to do is make sure that we are in compliance with the regulatory needs and not really thinking about how can we enhance certifications to be a true tool in our defense and depth approach. But uh in terms of compliance with regulations right so uh the next CSF PR A4 uh which I've written down here this states that excess permissions are managed incorporating the principle of least privilege and separation of duties right so your segregation of duties and your least privilege.

So this least privilege part is specifically translates into uh your attestation processes that you carry out and then you know with regards to multiple industries you have other regulatory requirements that we need to comply with. So attestation helps in demonstrating compliance with these regulations by regularly reviewing and validating access rights. What else?

What else are the reason for us to need attestations? Uh we have spoken about security, we spoken about regulatory requirements, insider threats. So somebody's changing jobs.

We do not want them to keep previous access. Somebody was on a temporary assignment uh that needed elevated access. So uh these in things like these increases the risk of insider threats.

So attestations help in minimizing this risk by regularly checking and adjusting access rights. It could also be directly related to data integrity. If right people have right access to the data, we would be more confident in saying that the data integrity is intact or there would be less chances of data corruption or loss because only the right people have access to data.

So bit of a stretch here if I could say. Uh but this is this is the one uh operational efficiency. Now certifications are not usually thought about bringing operational efficiency but by regularly reviewing and updating access rights organizations can remove unnecessary access privileges which can simplify management and improve system performances.

Audit trail and accountability uh this is definitely needed. Uh audit trails also are needed for compliance purposes but attestation provides the records of who had or has access to what which is important for audit trail. So this audit trail is not only used for regulatory purposes but also is crucial for investigating security incidences or breaches and then responding to changes.

Uh so you know all of us are working in a dynamic organization right now. uh employees are changing roles leaving or uh new ones joining. So attestation helps in properly updating access right in response to these changes ensuring that access privileges always align with current role and responsibilities.

So uh these are some of the reasons that attestations are required. The most important of ones would be like security, insider thread, compliance uh and audit rails and accountability. Everything else I think would be bit of a stretch.

Now let's deep dive into type of attestations and uh so every time I've asked this question in an interview, I've always got great answers like you know there is a user certification, there is an application certification, there is a role membership certification and whatn not. But essentially what we need to look at is there is an object involved in the certification. So the certification could be about make of an object.

So it could be about an object like role. So it could be role certification or a user certification which is like an identity cube in saleoint or a user object in Oracle or it could be about data associated with an object. It could be like uh the assignment criteria associated with the role or it could be like access to an object.

So uh how many users have got access to this application or how many users have got access to this entitlement. So think of certification not just putting it into specific buckets but think of it as either it could be about make of an object uh data associated with an object or access to an object. And this you can absolutely define this object.

But uh normally we we look at uh user access reviews which are carried out mostly by users manager. We look at uh role certifications which are of two flavors. Membership that is role membership certification who has got access to the role and the contents of the role.

Which entitlements or other roles constitutes this role? uh is the role content certification is also a type application uh the same thing membership entitlements uh who has access to this applications. It could also go into a little more detail about what is the type of access do they have and also about entitlements as to uh which are the entitlements that are associated with this applications.

One of the most important certification is the privileged access certification. So which are the privileged user accounts in the system or privileged accounts in the system who has got access to it? Uh they could be both human and non-human accounts.

So there could be a privileged account associated with a user and we want the manager to certify it or there could be a generic privileged account with an owner defined and we need to make sure that uh the owner is is correct uh is active user in the company is still the rightful owner and also you know if it is a shared account uh how is that permission being given if that is given by an AD account membership is that AD account membership correct uh up to date and things like this. So, uh, privileged access certifications do have some flavors as well and I think these are the most important certifications from an audit perspective. And then entitlements again uh you can have who has access to these entitlements like for a specific entitlement you can carry that out uh or is this entitlement associated to a particular application.

So, so it could be of any type to be honest uh depending on your specific organizational needs. So when I looked at attestations or certifications at different companies uh it is not a one-sizefitit all solution. So their application varies across different industries.

So just at a high level if you think about uh finance sector where I work right now. So it has got high security and compliance needs. So we deal with highly sensitive financial data uh subject to thankfully stringent regulations like uh socks surbane socks le law uh or act GDPR NYDFS and others.

So attestations in this sector are critical for ensuring that only authorized personnel have access to financial systems and data. uh in financial sector we need regular reviews um and obviously privileged access certifications which I hopped on so much is is because of my current association with finance sector u healthcare now healthcare really focuses on patient data privacy so it is actually governed by strict privacy laws like HIPPA which stands for health insurance portability and accountability act training or CISSP training is paying dividends. Um so oh and I lost my train of thought.

So yeah HIPPA HIPPA is uh required for health care sector for uh making sure that there is a focus on patient data privacy uh and and this ensures that health care professionals have access only to the patient data necessary for their role. Varied access level is another important type of attestation in in healthcare sector. you know there are doctors and nurses and administrative staff and they require different access levels and then emergency access certifications.

So in healthcare more than any other field uh emergency situations can associate quick access to patient data and attestation in this sector must balance security with the need for rapid access and critical solutions. So this is another type of check and balance in terms of how do healthcare sector take care of patients privacy and then government sector um there are obviously nothing more sensitive or classified than than the data in government sector. So uh attestations are crucial for it because we need to make sure that only authorized personnel have access to certain level of information and then there are wide range of information types like public records to confidential uh records to national security information and then attestation needs to be tailored to ensure appropriate access based on security clearance and job functions.

And then public accountability. Uh government agencies need to ensure transparent and compliant attestation process to maintain public trust and adhere to legal standards. Uh however, this should be applicable to all sectors but but not any more than than government sector.

So uh I could keep going on and on about telecom sector which I was uh part of uh in my previous jobs. uh so depending on on the type of industry that you are in there would definitely be some different regulatory requirements or different challenges that would be presenting yourself uh presenting to you when when you carry out these certifications. So in terms of differences among each sectors uh the regulatory framework like FINRA for finance, HIPPA for healthcare uh they basically present different set of challenges or opportunities and then types of data protected u and then frequency and rigor of when the certification and how how often would they be carried out.

Now we spoke about uh the different sectors. We also spoke about different type of certifications. Remember object, the make of an object, the data associated with an object and u access to the object.

Now let's look a little bit into what are the different methodologies in a test station. So the one which is most common to all of us is the periodic review. So scheduled regular reviews of user access right is something that we are all familiar with.

Uh it could also be event driven. So it could be triggered by specific events such as role changes, departures, uh new regulatory requirements. uh so these reviews ensured that the access right remains aligned with the current needs.

Uh the most common use case that I have seen is in terms of movers. So either you uh or somebody moves to a different department or is terminated you know the certifications are triggered so that uh we can we can make sure that data is up to date. uh role-based attestation uh you know reviews access based on predefined roles uh ensuring that individuals only have access right that their role requires all of them uh could fall into the category of automated or manual attestations depending on whether you are ut utilizing software tools uh or are you using the excel files and shareepoints there could also be ad hoc attestation right so unplanned checks that could be initiated in response to security concerns or incidents to verify access right immediately uh could also be another flavor of a testation.

Uh it could be userentric, it could be entitlementcentric. uh one of the entitlement or one of the certification that is very less frequently used is the peer review which involves users peers in the attestation process to help verify whether the access is appropriate based on their understanding of job functions and requirements. So uh when we talk about user access reviews we normally go about you know the manager should be reviewing the access but there are also flavors to like self review in which you review your excess yourself.

Uh there is also the concept of peer review and then obviously the manager review right. So work with your auditors if you can take some work away from the plate of the poor managers who have to identify and rubber stamp or stamp everybody's excess and put it on users plate. Uh that is definitely an advantage.

Uh we already spoke about managorial review in this flavor and then risk based attestation you know u prioritization reviews based on a level of risk associated with certain excess rights uh could also be one of the methodologies of of certifications. Now let's talk about uh the challenges that we face in certifications. Obviously volume of data we have such a large amount of data we have so many users they have varied access rights it's a many to many relationships between system access and users so reviewing all of these could be overwhelming and resource intensive complexity of access rights I don't have to tell you all you all are here because you are interested in identity and access management or trying to fall asleep in either of those cases I do not have to talk more about complexity of access rights.

The environments are pretty dynamic especially with cloud coming in uh and most of the companies have partial presence on premise and in cloud uh and in the SAS ecosystem. This is a pretty complex environment to wrap your head around or hands around. There are obviously manual processes still uh which is definitely a challenge.

lack of clarity. So most of the staff that is associated with attestation process is nonIT staff and they need to have absolute clarity on why this is important because otherwise what happens is the user fatigue sets in right and this leads to rubber stamping or automatic approval without prior reviews and I'll tell you I am I am a uh information security practitioner and I I am guilty of carrying out these rubber stamping sometimes myself because um it it it was just the last day and I had to review excess to 100 people because they were reporting to me and I did not want them to go to my boss and and this is just I'm not very proud of but uh rubber stamping is a real thing user fatigue is a real thing that is that is happening out there integration issues We need to get the data in and then after the certification is carried out we need to either revoke the access we also need to have the audit trail the comp the completeness completeness and accuracy checks. So uh the inadequate tools or just the amount of work that goes in to create this end toend workflow in an automated manner is is pretty intensive.

policies and procedures gap. Uh we will talk more about it in a bit. But uh when organizations lack formal policies or procedures for attestations, this leads to inconsistent applications and inform enforcements.

Uh audit trails. So maintaining comprehensive audit trails for attestations can be challenging. So how do you ensure that the data that you are presenting to your auditors goes through compliance uh or completeness and accuracy checks right so think about that I'll give you a hint in a word blockchain so insufficient training we already spoke about this and then uh balancing security and usability So you have to find the right balance between strict access controls and allowing employees to perform their job effectively can be challenging.

So rubber stamping, complex access rights, insufficient documentation, uh sometimes lack of clear ownership, poor communication, which is root cause of most of these issues. Uh lack of training, one-sizefititall approach, failure to update the testation process, wanting to get it done by next week. uh not understanding the complexity of it.

Uh just trying to have it as a checkbox for your auditors are some of the major challenges that then an IM practitioner faces when implementing a a comprehensive or a holistic certification program. In terms of tools, uh I have not seen and I could absolutely be wrong, but I have not seen too many one-off tools that provide only certification capabilities. Most of the tools that I have seen are actually inbuilt.

Uh so like your sale point identities IQs or your RSA archer your cyber arc privileged access security IBM security identity governance and intelligence one identity I I can keep going on and on but mostly I I I have seen that certification is is a module in the existing tools rather than this being a tool in itself. This is because you have to carry out so many integrations with this certification system if you want to you know implement certification as a service. So I'm not saying that is not possible.

I have seen some crappy implementations of it out there. Uh but nothing that has really caught my eye but if I do something or if I find something I would definitely let you know and if I make a tool out of it I will ask you to buy it as well. Uh on the topics of buying stuff uh I actually got educated myself last week.

So I was told that u so I was approached by this gentleman who wanted me to sell his products. Nothing wrong with that. And I was told that if I do it at the start or at the end of the podcast, this would cost me like this would cost them like X dollars.

And if I like do it in between the podcast, it would be like 2x because that is where the users are consumed with the content and whatnot. So anything that is advertised within the podcast or between or in the middle of the podcast is actually costlier than anything that is done at the start or at the end. So I found that pretty fascinating and it it almost felt like common sense to me after I knew of it.

But when I heard of it for the first time, it definitely was new knowledge. Uh so that's that. Uh this is bit of a useless piece of information that I knew that I had to share with you all as well.

But uh let's talk about future of attestations and identity and access management. It won't be a surprise but obviously increased automation with AI and machine learning technologies we can expect more automated attestation process but there are many of these things that could be done today and how do you think about them is is something that I am a big advocate of. So if you don't take anything out of this podcast, this is the only thing that I want you to take back.

We always think of certifications as okay, we are doing user access reviews, we are doing privileged user access certifications, we are doing application attestations and whatnot, right? So we are thinking in terms of uh what do we as security team wants to do or what do we as the control solutions implement for auditors want to provide to them. Think of it again from the user's perspective, right?

Uh so if you are sending to Bob a user certification, tomorrow you are sending him a privilege certification. Day after tomorrow since because he's a data owner for an application, you are sending him an application certification. That is not a good experience for Bob because carrying out your certifications is not his job, right?

So we are implementing certifications in silos depending on what they are there for. I am asking you to implement the certifications by putting user in the center and you can absolutely do it. Amount of work on the IM team would be more if you do not do it in silo but the amount of work on Bob would be significantly less.

And this is what I want you to think about. Another thing is I want you to work with your auditors. So why do you have to certify birthright rules?

You shouldn't. Why do you have to certify rules which are autoprovisioned to users based upon an assignment criteria? Can't somebody just look at assignment criteria and say okay if user profile or job profile is equal to IT analyst and location is equal to New York City this is a birthright role given to the user right now you can just verify this assignment criteria rather than identifying every user associated with IT analyst New York City.

So push back, sit down and discuss with your auditors what is really needed. Sit down with your lawyers or legal team and based upon all the regulatory requirements ask them of what can you do so that you are meeting those requirements but at the same time not just throwing everything out at the user because right now the problem with the industry is that we are expecting user to do it because they have to and this would lead to rubber stamping and this definitely leads to rubber stamping. So how do you minimize the amount of clicks that the user has to do and how do you make your certifications user centric are the two things that I want you to take them out.

So if you if they have to carry out user access certification they only need to carry out user access reviews for those access that was requested by the user and not provision to them automatically. And also based upon everything that was requested what was the high risk that was assigned. So if they requested for let's say a visual license that is not a security issue is it could be a licensing issue but only thing that they requested which is in high risk which was out of band and is not in alignment with all of their colleagues is something that the manager should should uh attest and nothing else and nothing more.

So realtime attestation is another thing. U we need to start performing real time on near realtime attestations provide continuous assurance of appropriate access. Uh we can definitely integrate with other security measures like behavioral analytics anomaly detection and to provide a holistic security posture.

I already spoke about blockchain for a test station. So to create immutable record of attestation enhancing the audibility and trustworthiness of the the of the attestation process think about blockchain. We have already spoken about risk based and enhanced user experience but this would continue to be focused.

There's I'm sorry to repeat myself but certifications have to be user focused. The regulatory technology I think has a lot of scope and developments in reg tech may provide advanced solutions for attestations that help organizations stay compliant with changing regulations more efficiently. So I'm not I would not be surprised if another certification as a service tool is introduced in the market by a big four auditing firm.

uh it could be packaged as a reg tech deal and this provides all of these features like realtime attestations, continuous monitoring, behavioral analytics and uh depending on what you feed into the system that what the requirements are that company should comply to the regulatory requirements it would carry out that type of certification. user behavioral profiling, context aware, predictive analysis. Uh you know obviously there are obviously tools out in the market like saleoint has something in their identity cloud.

Uh it does give you or the manager a thumbs up or a thumbs down saying that uh you are okay to certify it and you are not okay to certify it. So we have to mature our tools to the capability where the prediction they are making does not needs to be vetted by a human. We should trust their predictions and this is where we truly want to do or be and where their prediction or our trust in their prediction ends only those things needs to be certified by the manager.

uh another thing is if you are creating a business case because I'm pretty sure that most of the companies today uh are doing certification so you do not have a green field implementation of certification in most cases so this is just an advice is if you're going to create a use case or a business case for enhancing certifications don't just keep it focused based on security and you would you would hear me saying this all the time that business cases created only on based only based on security should not be multi-year. So if you have an initiative that that you know will need multi-year financing do not solely focused on the security concerns that is addressing because what would happen is in next year funding exercise you would be fighting against some new initiatives. you would be fighting against some new things uh that needs to be sponsored and you would as you mature in your initiative you will continue to fall down the priority ladder right so if you are creating this certification business case plug it in with your zero trust model plug it in with anything else or the user experience right so tie it back to initiatives like this and that would help you get multi-year financing or funding and do not just focus solely on the security part of it because security as soon as bare minimum is done that is all right and next year or or year after next you would have to continue to fight with other new initiatives that are out there.

So just just going through a basic list of how do you implement a successful attestation process right nothing new nothing that you all folks do not already know about it is more of a refresher define the scope and the objective what do you really want to do why do you want to do it how does it help the business securing executive sponsorship develop clear policies and procedures establish roles and responsibilities training and education programs, implementing technologies, starting with a pilot, effective communication, uh addressing non-compliance, measuring success, u creating an audit trail. Right? So these are all the parts or processes in how you implement an successful implementation.

So let's start looking into how do we create certification process as user centric and let's challenge our editors and our governance and risk teams to clearly define what is it that is needed. I have seen so many IM teams failing because they do not understand what is really needed of them. So technology implementation implementation of certification in any IGA tool is a relatively simple process right but IM teams get so much push back on on this because they were never told what is actually required at a program level at a company level they're always given information in bits and pieces or we also need user access certification there is another thing that is coming in and we need to certify based upon that look at it at like for the entire year what are are the type of certifications that you would need.

Challenge your auditors, challenge your governance and risk teams to give you that data. Once you have that data, then look at it from the user perspective. And that is where your starting point of the compliance or the certification or the attestation program should be.

Right? So I think this is pretty much it for this episode. We are almost uh 36 37 minutes in.

Thank you all for listening. I really appreciate it. uh the the last episode in which we talked about role-based access control did get some very good reviews.

So, thank you all. Um Yank also did um suggest me that I should be doing a follow-up sessions on policy based access controls and attribute based access controls and uh basically should call it back to the future as in BAC and I found that idea to be absolutely fascinating. So, thank you Yank.

I will definitely start working on it. Uh but thank you for listening. I hope all of you have a good rest of your day.

Uh you can always reach out to me via LinkedIn or I can always be uh emailed at the identity navigator@gmail. com. So thank you all.

Uh this is Rohit, your identity navigator. Till next time.