Improving Security With User Access Reviews

Human touch can be the most vulnerable element of IT systems. When infiltrating an organization's systems, the hackers are often on the lookout for the lowest hanging fruit, trying to find the weakest link into the system. And the human element of any organization or business can be just that.

You can have controls and security measures worth millions of dollars applied to an organization but even the slightest mistake by a human can help the hackers gain uninterrupted access to your systems.

Users are and always will be susceptible to social engineering attacks, sharing the minutest details of your life on social media platforms are in a literal sense like publicizing all the necessary information a hacker may need to break in. You may receive a phone call one day from what sounds like your manager who got logged out of the accounting database and needs the credentials to process employees' payrolls on time. These types of phishing attacks are meant to put you in a state of urgency to prevent critical thinking. The risks associated with user access to the systems are numerous, however, they can be minimized by simple policies and procedures such as the principle of least privilege and periodic user access reviews.

What Is the Principle of Least Privilege?

The principle of least privilege also known as the principle of minimal privilege, states that minimal privilege is allowed to a user to complete a task and for the shortest interval of time. Adopting this methodology will save the organization from unwanted information disclosure. Rather than treating all employees with the same level of user access, which is not only unnecessary but hazardous, the organization must only grant the bare minimum access rights to whoever is requesting a resource. For example, an employee working in the HR department must not have access to the legacy code, in the same manner, a developer must not have access to the financial records of the business. 

The reason for this limit is to reduce as much of the damage caused by an accident or human error as possible. A careful assignment of access rights will not only limit the attack space but also reduce the collateral damage to the system.

Some of the Benefits it Offers Include:

Limited Attack Surface: - Most modern-day attacks rely on privilege escalation and exploitation, limiting the admin and superuser access rights will make it hard for the attacker to move beyond the least privileged space.

Prevents Malware Spread: - Minimum access rights stop the malware from moving beyond the endpoints, it will be left to struggle to obtain escalated privileges.

Compliance and Audit: - Implementing POLP requires an in-depth analysis of the access levels of each member in the organization. This gives an organization all the relevant information on its total assets, where they exist as well as their access rights. In doing so, it helps streamline the compliance and auditing process. Sometimes, it is imperative to allow the least privilege to privileged accounts based on your regulatory requirements, helping prevent accidental damage to critical assets that may include critical databases, internal manufacturing processes, critical infrastructures, etc.

Why Is a Periodic Revision of Access Rights Required?

Many times, system administrators need to grant pseudo administrative privileges to employees for a certain job. What happens if they forget to revoke them? Consider another scenario where a former employee still has the same level of access. A lot of things can change in a three to six-month period, and the best practice is to have periodic assessments of the user access to absorb the changes that occurred over time.

Best Practices for Effective User Access Reviews

Although periodic assessments of user access rights are critical to improving security as well as compliance, it also requires a deeper understanding of the inherent risks that come with it. Inherent risk can be mathematically represented as:

Inherent risk = Likelihood x Impact

It is a product of the likelihood of occurrence of an attack with its impact on the business. For example, if a new employee is a victim of a phishing attack, the impact on the business will not be significant provided the principle of least privilege is applied. However, if periodic user access reviews are not held and somehow a new employee has the same level of access as the manager then the impact will be drastic.

Assess User Access Risks

Humans are one of the weakest links in an IT environment. They can be manipulated, even blackmailed into sharing their credentials. It implies that risks are inherent when it comes to user access rights, the entity possessing the most rights will likely also pose the greatest risk.

Developers/IT: The most privileged entities in any organization are the developers or the IT professionals, as they must monitor or run the whole IT infrastructure. So, the risks associated with them are naturally more spread out. They require access to more sensitive information which is why they must be reviewed more frequently.

Third Parties: Third-party vendors also present a high risk as they may require temporary or long-term access to sensitive information and systems. They should be reviewed frequently to check if the access was timely terminated.

New Employees: New employees cannot be granted the same privilege as other employees merely based on joining the same department, they don't necessarily need it early on.

Terminations: The termination of access of an employee must be as close to the termination of employment as possible. If delayed, it will be exactly like sharing your internal matters with an outside actor.

Transfers: Special care is required for transfer cases, a thorough assessment of their old access rights need to be the basis for their new access rights to avoid risk.

Creating Appropriate Risk Management Policies & Procedures

Risk identification is the first step towards the remediation process. To develop strong policies and procedures you must first identify the associated risks to your critical assets, analyze their scope and their business impact. Once you know the severity of the involved risks you can easily prioritize them as high, and low-level risks. Our goal is not to completely get rid of the risk rather it is to contain it as much as possible, for that purpose we treat the risk to minimize it. Generally, the risk management policies and procedures revolve around the steps mentioned earlier, but there are two most popular approaches that go about the Deny-all approach, where no one has access unless otherwise stated, and the Allow-all approach, where everyone has all the access unless otherwise stated.

The type of approach you follow depends upon the size and nature of the business. The safest and most useful plan of action is to incorporate the principle of least privilege:

Train Staff: Reviewing access rights of employees is not the responsibility of anyone entity, rather it is a collective effort by the managers and IT personnel to review their departments tactfully. Rather than letting heaps of papers sit on your desk for reviews, each person needs to be made aware of their responsibility and the impact of not doing a proper review.

The employees should also be made aware of the consequences of delayed reporting, unauthorized access, and data breaches. Training must be conducted to enhance team efficiency and responsibility towards the organization.

Alerts from Monitoring Software: Alerts from a monitoring software can help establish the best practices for asset protection, reviewing these alerts daily must be part of the policy to ensure up-to-date procedures.

Review User Access Changes: For smaller organizations, the user access changes report can be reviewed monthly for any discrepancies and untimely access revocations. Whereas, larger organizations may only need to review a sample of the report and request the full version in case of inconsistency.

Manager Reviews of Employee Profiles: Managerial level reviews are necessary to add an extra layer of protection, as the managers have full knowledge of the existing and terminated contracts. They can catch something in case it was missed earlier. These are mostly carried out annually.

Review Termination Procedures: A cross-reference list of former employees against employees who have system access must be maintained and reviewed at least once a year.

Automate Reviews and Compliance: Automated compliance tools must be used when needed especially for larger organizations, they are proficient and eradicate human error.

Communication between Departments: Harmony between the different departments especially between managers. IT professionals and HR must be ensured for efficiency.

How Can We Help?

StandardFusion is a GRC program that will help streamline risk and compliance management, and information sharing across departments and third parties. Using a centralized system, all your data and policies can be found in a single location. Update your policies, track acceptance and schedule access reviews with automatic reminders. Our platform gives users just the right level of access for applicable policies and data. If you are struggling with user access or policy management, reach out to our team and see how StandardFusion's GRC software can help you get on track.