An omnipresent topic for companies is the question of IT security. Which employees really need access to certain sectors and (sensitive) data? What does effective protection against sabotage or hacker attacks look like?
The German Federal Office for Information Security (german: BSI) recommends that critical infrastructures (CRITIS) have access controls – physical and logical – among other things. A suggestion that is also relevant for companies without KRITIS classification.
Three best practice steps that your authorisation concept should include. But before you establish this in your company, it is worth taking a look at your current authorisation structure. Check: Are there historically grown authorisation structures?
Large amounts of unstructured data accumulate in the form of documents and files and the file server structure is becoming increasingly unclear. Who has which authorisations? If there is no overview, a security gap is created.
Reasons for an opaque authorisation structure can be:
The secure administration of authorisations succeeds with a software solution that supports the IT administration. This is the only way to establish authorisation allocation in the long term,
To what extent a software solution should support the creation of a new concept is a decision for the administration. When making a choice, it helps to clarify internally: What level of support do we want to use and how much should be implemented automatically in the future? You have the choice between tools for the simple evaluation of the existing situation up to a fully comprehensive automated authorisation management, which are specifically aimed at end users and data managers.
The technical implementation is carried out completely via the system, so that no IT background knowledge is required for use. In this way, authorisations can be granted in a user-friendly and comprehensible way by means of self-service.
The aim of automated authorisation allocation by means of self-service is to shift the responsibility for and processing of authorisation processes away from IT administrators to the data managers. Only if authorisations are no longer granted “bypassing the system”, but via the application and release workflows provided for this purpose, can the defined target state be maintained in the long term.
BAYOOSOFT @DMEA 2022