Role mining is an essential process in identity and access management that helps organizations define and manage user access based on their roles within the organization. By automating the identification and assignment of roles, organizations can ensure that users have appropriate access to resources, enhancing security and compliance.
Top-Down Analytical Role Mining
After analyzing organizations’ security models and data sources for years, EmpowerID developed the Top-Down Analytical Role Mining technique. This method ensures that user entitlements are appropriate for their position, facilitating compliant access. Top-down role mining optimizes access based on three key areas:
The existing business roles within the organization.
The knowledge of which users occupy those roles.
The users’ positions within the company, including their departments and locations.
This comprehensive approach allows organizations to align access with what users do within the organization.
Benefits of Top-Down Role Mining
Top-down role mining improves compliance with regulatory requirements and reduces administrative burdens associated with manual access management. By automating the role assignment process, organizations can more readily adapt to changes in structure and personnel.
Top-Down Analytical Role Mining Process
The Top-Down Analytical Role Mining process leverages existing business roles and user assignments. EmpowerID inventories all user entitlements and access assignments across various systems, not just HR, and optimally aligns them with the business role and location structure. The process involves the following steps:
Data Snapshot: EmpowerID takes a snapshot of existing organizational data to determine roles and role-based access policies.
Data Inventory: Gather access assignments and user entitlements from multiple systems.
Role Analysis: Analyze how users' existing access fits within predefined business roles.
Optimal Role Assignment: Use sophisticated analytical techniques to optimally align existing user access assignments with the business role and location structure.
Publishing Assignments: Once optimal matches are identified, these role-based assignments can be published and managed through automation based on HR data.
Ongoing Maintenance: EmpowerID maintains changes on an ongoing basis to ensure access remains aligned with any changes in user roles, locations, or job assignments.
Although top-down role mining covers a large portion of access assignments, bottom-up role mining, which refines more dynamic access needs, can address additional unstructured access patterns.