What is recertification?
Recertification is the process of continually auditing permissions to make sure the access provided is only the access that is needed. Recertification streamlines and automates the process of revalidating a target type (account or access) or membership on a regular basis (role or resource group) on a regular basis. Access recertification is an information technology control that includes reviewing user access rights to see if they are proper and comply with the company's internal rules and laws.
For its apps, databases, and other resource access, the organization has a periodic recertification procedure in place. As a result of recertification, a manager or responsible party, or system owner certifies users' access to a system to guarantee that they only have access to what they require.
Recertification is a part of an organization’s governance risk and compliance activity. Recertification or attestation are different terms for the same thing. GRC (governance, risk, and compliance) is a collection of rules and procedures that enable firms to achieve their business goals, deal with uncertainty, and behave with integrity. The goal of the recertification is to present the system data to the auditors and to ensure that there are no nonconformity findings during audits.
For example, In the account validity recertification process, a responsible person (manager, supervisor, responsible party, or other designated person) checks the account of the users and decides whether this account should continue to exist or not.
Why recertification is needed?
The implementation of a recertification procedure can safeguard a corporation from potential security breaches and fines. Recertification is already mandated by law in the IAM context.
To guarantee that only authorized personnel has access to the enterprise's data, owners of key business data must verify that all application and database user entitlements and privileges are recertified on a regular basis. With access recertification, it's assured that no users have access to resources that aren't assigned to them.
...
Therefore, to minimize the risk, for all the risky accesses, we should be able to certify and recertify on a regular basis that the access is still needed. For example, is this user account still needed? if a user has already resigned from the company, the user account should not be active. These kinds of potential risks are checked and minimized with the help of recertification at regular intervals.
What is a recertification audit?
The review of user access rights to see if they are proper and correspond to the organization's internal rules and compliance standards is known as access recertification audit. The recertification is often implemented as an audit.
An audit can be considered as a project with a start date and end date. We might want to audit or certify multiple items using an audit. For example, in a Q1 audit we might want to certify, an external partner , identify identity as well as attest a member of certain high-risk management roles. These items are specified in one or more recertification policies. EmpowerID maintains an audit trail of these access snapshots and the decisions made concerning the access. EmpowerID recertification audits can be scheduled to run periodically, such as on a quarterly or monthly basis, weekly, daily, or at will.
What is the recertification policy?
A recertification policy contains actions to ensure that users submit assurance that they have a genuine, continuous need for a particular resource or membership. As a project might have multiple deliverables, a recertification audit can have multiple recertification policies associated with it. We can create recertification policies of different types in the EmpowerID system, and these policies are reusable. For example, in an audit we might want to certify, an external partner , identify identity as well as certify a member of certain high-risk management roles. These items are specified in one or more recertification policies.
Recertification Policies are snapshots of data that reveal the access to resources granted to people and to roles, the assignments of people to roles, and the security assignments that have been made against protected resources like Exchange mailboxes, applications, and groups. These snapshots are routed for review to authorized personnel such as managers, role owners, or data owners. The review process allows the reviewer to verify the access and certify whether it is valid. Internal processes can use this data to remediate and rectify exceptions or certify the exceptions as permitted.
EmpowerID provides a collection of useful recertification policy types.
Recertification in EmpowerID
EmpowerID provides a powerful attestation and recertification platform that gives any organization the ability to take a more proactive approach to rectify potential security issues before they occur through crafting EmpowerID audits and recertification policies. The combination of Recertification Policies recertification policies with EmpowerID's robust reporting capabilities allows organizations to create a more thorough and effective resource management strategy.
...
Types of recertification policy
EmpowerID recertification policies has following types.
...
Recertification Policy Type
...
Description
...
Account validity recertification is a method of determining whether or not accounts are still required. Certain actions must be made if the accounts are no longer required. In other words, account validity recertification policy is to certify whether an account should exist or not.
For the recertification, a recertification policy is created, a recertification audit is created, the recertification policy is added to the audit, then audit is compiled, which generates business requests that are sent for approval.
...
The possible decisions for the business requests are generally set as certify, disable or delete. However, these decisions are configurable. For more details on how to create an account validity recertification policy visit account validity recertification page.
...
Business Role and Location Membership
...
The business role and location membership recertification process validates whether the membership of a business role and location is still required for a valid business purpose. Certain actions must be made if the membership is no longer required. In other words, business role and location membership recertification policy is to certify whether a membership should exist or not.
For the recertification, a recertification policy is created, a recertification audit is created, the recertification policy is added to the audit, then audit is compiled, which generates business requests that are sent for approval.
The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the business role and location is the bundle for the business requests and its members are items.
The possible decisions for the business requests are generally set as certify or revoke the business role and location membership. However, these decisions are configurable. For more details on how to create a business role and location membership recertification policy visit business role and location membership page.
...
...
The group membership recertification process validates whether the membership of a group is still required for a valid business purpose. Certain actions must be made if the membership is no longer required. In other words, group membership recertification policy is to certify whether a membership should exist or not.
For the recertification, a recertification policy is created, a recertification audit is created, the recertification policy is added to the audit, then audit is compiled, which generates business requests that are sent for approval.
The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the group is the bundle for the business requests and its members are items.
The possible decisions are generally set as certify or revoke the group membership. However, these decisions are configurable. For more details on how to create a group membership recertification policy visit group membership recertification page.
...
...
The group validity recertification policy is to certify whether a group should exist or not in the group. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests as per the responsible party. For any item being recertified where its responsible party is null, it bundles them all into one business request where the subject of the request is the fall-back assignee.
The possible decisions are generally configured as certify, disable or delete. However, these decisions are configurable. For more details on how to create an group validity recertification policy visit this page.
...
Management Role Access Assignment
...
The management role access assignment recertification policy is to certify the access granted to the management role, including any RBAC assignment. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the management role is the bundle for the business request and its members are items.
For more details on how to create a management role access assignment type recertification policy visit this page.
...
...
The management role membership recertification policy is to certify the current members of a management role, including people, group, and business role and location. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the management role is the bundle for the business request and its members are items.
The possible decisions are generally configured as certify or revoke the member. However, these decisions are configurable. For more details on how to create a management role membership recertification policy visit this page.
...
...
The management role validity recertification policy is to certify the current validity of a management role. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests as per the responsible party. For any item being recertified where its responsible party is null, it bundles them all into one business request where the subject of the request is the fall-back assignee.
This recertification determines if the management role should exist, be "disabled,” or deleted. For more details on how to create a management role validity recertification policy visit this page.
...
...
The person validity recertification policy is used to certify the person should exist or not. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests as per the responsible party. For any item being recertified where its responsible party is null, it bundles them all into one business request where the subject of the request is the fall-back assignee.
The possible decisions are generally configured as certify, disable or delete. However, these decisions are configurable. For more details on how to create a person validity recertification policy visit this page.
Each Recertification policy is targeted or scoped to apply only to specific people, roles, or resources using EmpowerID query-based collections. These are comprised of sets, which are SQL queries primarily or code-based queries in some cases. These sets are re-evaluated by the EmpowerID engine on a scheduled basis and can group collections of people. They can be based on questions written against the EmpowerID identity warehouse or external systems in a customer's environment.
...
Auditors can also designate audit as either one-time or ongoing audit. A snapshot of user access and entitlements is obtained when the initial audit begins. This first snapshot creates an irreversible record of your company's security at the moment. Business requests are produced as a result of this, and EmpowerID's process-driven approach keeps both users and the work required moving forward in order to ensure timely completion and correct outcomes of the audit.
The primary building blocks of recertification is depicted in the below overview diagram.
...
For recertification to work in EmpowerID following steps are needed.
Pre-requisite jobs should be started and running - The recertification engine jobs must be running for the recertification to complete successfully.
Create recertification policy - The frequency with which users must validate their requirement for a resource or membership is defined by a recertification policy. The policy also specifies what happens if the receiver refuses or does not reply to the request for recertification. Recertification policies employ a set of alerts to kick off the recertification process's workflow operations.
Add target(s) to recertification policy - The targets of recertification policy defines the scope of the recertification. Recertification policies may target many resources and memberships. For example, whether this recertification audit covers employees of a perticular city or entire organization.
Create recertification audit - An audit is nothing but an end to end implementation of recertification.
Add recertification policy(s) to recertification audit - An audit needs a recertification policy and its targets so that compilation of audit can generate at least one business requests.
Enable and compile the audit - The recertification engine requires the created audit to be enabled so that it can be compiled.
Check business requests are generated - There must be at least one business request generated as a result of compilation of a recertification audit.
Check fulfillment is done - The completion of decision made related to access in EmpowerID systems based on an audit outcome is known as fulfilment.
Verify the result of recertification - Need to verify that the end result of the recertification is correct.
| Page Properties | ||
|---|---|---|
| ||
To maintain the integrity of recertification reviews, users cannot recertify themselves. In other words, a user who can create a |
...
recertification policy cannot certify that policy. The EmpowerID admin user is prohibited from participating in the review process by this feature. |
...
Related
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
Next Steps
Create Recertification Policies