Page Comparison

In a Risk management in today's business environment , risk management means involves systematically identifying, assessing, and controlling threats that could negatively impact to a company's IT resources. The ultimate goal is to keep your business running ensure businesses operate smoothly and ensure "maintain compliant access ."to their systems.

What is Compliant Access?

Compliant access involves minimizing minimizes potential risks when associated with granting access to company resources, such as computer systems, applications, and software, in line with set guidelines and policies. It means giving ensures that access that is appropriate to an employee's role based on company rules about risk. Regulatory rulesaligned with an employee’s role and adheres to regulatory rules, industry standards, and company procedures help define policies. This approach defines what is considered acceptable, risky, or non-compliant regarding access rights.

Challenges with Traditional Risk Management

Many businesses today struggle with managing enterprise Traditionally, enterprises face significant challenges in managing risks spread across multiple cloud and on-premise systems. Overlapping This complexity is often exacerbated by overlapping system access often creates . To effectively manage these risks. Therefore, companies need a deep understanding of must deeply understand the permissions model for every application they use to prevent users from having too much access and increasing excessive access that increases risk. EmpowerID steps in to solve this problem with a offers a solution with its comprehensive Identity Governance and Administration (IGA) connector library that , which integrates different diverse permissions models, thereby lowering reducing risk and enhancing understanding of control over system access.However, many Identity and Access Management (IAM) solutions primarily focus on technical aspects of access control and lack a model that connects

EmpowerID’s Approach to Bridging Gaps

Despite the technical prowess of many IAM solutions, they often fail to link system entitlements to business processes in a user-friendly waymanner. For example, take the creation of instance, in an SAP system, the entitlement to create a purchase order in SAP. In this system, entitlements are is represented by TCodes, with the TCode for creating a purchase order being ME21N. While this is clear to application specialists, it may be familiar with the TCode's significance, numerous business users likely are not. EmpowerID's risk management approach aims to bridge this gapnot be so to business users. EmpowerID addresses this gap by translating complex entitlements into easily understandable terms, thus enhancing both transparency and control.

EmpowerID Risk Management

Strategy

EmpowerID acknowledges recognizes that each organization has a unique way of defining its processes and policies. Therefore, it offers a risk management solution that caters to this uniqueness, making it easier to understand for non-technical audiences while maintaining necessary technical detail unique process definitions and policy needs. It tailors its risk management solutions to accommodate these characteristics, simplifying complex terminologies into plain language for business users while preserving the necessary technical details for IT professionals.

Integrating

Business

Models

EmpowerID understands that every business consists of processes performed continuously Understanding that businesses operate through continuous processes to deliver products or services. It simplifies complex technical terms into plain language for business users by breaking , EmpowerID breaks down these processes into smaller, manageable "business-defined activities" that a person can perform.

Image Removed

Function Mapping

These "functions" ." These activities are then mapped to specific rights and roles in a process, which is within the system, a practice known as "function mapping." This mapping clarifies roles and responsibilities and enhances visibility into potential risk areas.

Image Added

Function Mapping and Risk Management

EmpowerID distinguishes between global functions (actions users can perform in multiple applications, such as “create groups”) and local functions (actions users can perform within a specific location, such as “create groups in Azure Tenant X). Function mapping links business users to global rights, roles, and specific entities or systemsfunctions—actions performable in multiple applications—and local functions—actions specific to a location or application. These functions are linked to global and local risks, respectively. Global risks might include actions like "Create Purchase Order," which are standardized across the organization. Local risks, however, are specific to actions within certain applications, like creating a purchase order in a specific SAP environment.

Understanding Risks

Organizations establish risk policies to that help define critical or sensitive functions within their IT infrastructure and identify toxic combinations or Segregation of Duties (SOD) violations. Risks can These risks vary from users having access to high-risk functions unrelated to their daily tasks to users having the ability to perform end-to-end functions within an application. Risks consist of risk rules, which are the functions added to the risk. A risk can have multiple functions as needed, but it ; a risk must have at least one function for the risk engine to calculate the risk rules. (evaluate it, while SOD risks require a minimum of two – a functions—a risk function and a risk-segregated function.) Risks can be both global and local.

Global and Local Risks

Global risks represent actions that users can perform in one or more applications considered potentially risky by an organization. As a result, global risks map to global functions that define the specific rights and roles, granting users the ability to perform those actions. For example, a global risk named "Create Purchase Order" could be mapped would map to a global function – known as a risk function – also named "Create Purchase Order." When the risk engine compiles a global risk, it ," which returns all users with that function when compiled by the risk functionsengine. Local

Local risks represent actions that users can perform pertain to actions performed within a specific location or application instance considered potentially risky by an organization. In EmpowerID, local risks application or location and are added to global risks to logically connect the generic actions specified by global risk policies to the actual entities, systems, and locations where users can perform them. An example of a local risk would be "Create Purchase Order in SAP Prod" mapped to a global risk named "Create Purchase Order." When the risk engine compiles a local risk, it returns all users with those risk functions as violations.link broad policies to specific instances where they apply.

Risk Rules

Risk rules are the functions added to a risk. A risk can have multiple functions as required, but it must have at least one for the risk engine to calculate the risk rulesrule. (SOD risks require a minimum of two – a risk function and a risk-segregated function.)

Risk Violations

Preventative Controls

Risk EmpowerID's risk management controls are typically classified as either Preventative or Detectivedivided into Preventative and Detective controls. Preventative controls involve occur in real-time checks that take place when access is requested or assigned to determine if the assignments breach any risk policies. EmpowerID uses preventative controls to enable users requesting access to a resource in the IAM Shop to see any risk policy violations their access request might cause before submitting it. In such cases, users must acknowledge the violations to continue with the access request.

Image Removed

during access requests, helping users identify potential policy breaches before proceeding. Detective controls identify new risk violations by reanalyzing all access and attribute changes on a scheduled basis, ensuring comprehensive risk management coverage.

Image Added

When violations like those mentioned depicted in Image 4 above are identified by the user and submitted for approval, the requests marked as potential risk violations undergo an additional layer of approval by risk owners. These risk owners can either have the option to accept the risk and implement mitigating controls or reject the risk and deny the access assignment. Preventative controls are easier to implement, as the risk engine focuses on a smaller data set derived from newly assigned items and the recipient's current access.

Detective Controls

Detective controls are more data and processing-intensive for the risk management system. Every day, thousands of access and attribute changes can occur across hundreds of an organization's on-premise or cloud systems outside the control of the risk management system. These changes often produce ripple effects, leading to larger changes driven by inherited policies and users' lifecycle events, resulting in the readjustment of their access. Therefore, new risk violations must be "detected" by the engine, which is only possible by continuously reanalyzing all the access, attribute, and entitlement data collected from external systems. EmpowerID adopts a big data approach to this complex challenge, boiling down the net results of all these access assignments to detect violations obtained even through multiple disconnected inheritance hierarchies and dynamic policies. The EmpowerID engine also captures a complete picture of how the user triggers the violation and the roles or entitlements from which they receive the Segregated Business Functions.

Risk Owner Decisions

Whether detected by preventative or detective risk controls, violations of risk policies must be routed to risk owners, who must decide whether to allow the user to obtain or keep the offending access. If EmpowerID discovers users violating the risk rules for a local risk (they have one or more risk functions defined by the local risk), it flags the violations and sends them to risk owners for approval, mitigation, or remediation. Risk violations are logged and tracked, alerting risk owners of pending violations awaiting their decision. Risk owners can analyze all aspects of how the risky access was obtained and decide whether to allow the risk and add optional mitigating controls or opt for the violation to be corrected and the risky access removed.

Image Removed

Risk Owner Decisions

Violations detected, whether through preventative or detective means, are routed to risk owners for decisions on whether the risky access should be allowed or denied. Risk owners analyze how the access was obtained and decide on potential mitigation or correction actions. This proactive approach ensures that all access within the organization adheres to established risk policies and maintains the security integrity of the IT environment.

Image Added

Conclusion

EmpowerID's risk management approach combines detailed technical controls with simple, business-focused explanations. This ensures that enterprises can maintain strict access controls while increasing the understanding and management of these controls across all organizational levels. As businesses evolve and new threats emerge, leveraging EmpowerID's comprehensive risk management strategies will be crucial to protecting sensitive data and systems, ultimately promoting strong compliance and operational integrity.

Risk Management Tasks