Policy control and segregation of duties

Entitlements often need to be assessed against organizational rules, risk levels and responsibility structures. Policy control and segregation of duties help the organization identify sensitive access, risky combinations and exceptions that need to be handled in a controlled way.

Use case

Organizations need to ensure that entitlements are granted and used according to internal policies, security rules and responsibility structures.

Some entitlements are sensitive on their own, while others become risky only when combined with other access. This is often described as segregation of duties or Segregation of Duties (SoD).

Organizations therefore need to manage access decisions based on rules and risk. This can include ensuring that:

• entitlements follow internal rules and policies
• sensitive entitlements receive additional review
• risky entitlement combinations are identified
• exceptions are handled in a controlled and documented way
• decisions can be traced during audits and follow-up

The result is reduced risk, clearer control and better evidence for internal follow-up, audits and compliance.

How Fortified ID supports this

Fortified ID Control can be used to apply rules and controls in access flows. Business Rules can evaluate users, roles, groups, resources and business context to determine whether a request should be approved, rejected, supplemented or sent for additional review.

Approval Flows can ensure that sensitive or deviating access is reviewed by the right responsible people. Forms can collect justification, risk acceptance or additional information when an exception needs to be handled.

Pipes and Valves can collect and process entitlement data from directories, groups and other sources for analysis and control. Schedules can initiate recurring checks of policy deviations or risky entitlement combinations.

Reporting and Auditing can provide evidence for following up rules, decisions, exceptions and completed changes.

Fortified ID Access can complement the process when sensitive resources or risky actions require a higher security level. Strong authentication or step-up authentication can be used for access to sensitive resources or approval of exceptions.

Examples

• Additional review of sensitive entitlements before they are granted
• Identifying users with risky combinations of groups or roles
• Controls to prevent the same person from both performing and approving a critical activity
• Handling exceptions where access requires special justification or risk acceptance
• Recurring follow-up of policy deviations before audits or internal control