Access Review. Entitlement Review. Access Recertification. User Attestation. – 

Different terms but each provides IT and internal audit teams an ability to see what employee or contractor has access to what resource across the company assets. User Access Review is way for organizations to maintain, uphold IT controls and comply with regulations. Not all companies have an internal audit team, but every company, no matter how small does some risk assessment. Many organizations are bound by regulatory requirements such as SOX, FFIEC, ISO 27001, PCI- DSS, and HIPAA

etc to Undertake Access Reviews.

When auditors review IT Security Access Control Compliance, they typically look for the proof of controls for following items:

Access is created using principle of least privilege.

Evidence for ongoing or Periodic review of user entitlements (credentials and permissions)

Ability to undertake remediation workflow and timely notification to application owners if access needs to be removed

Generate proof of compliance reports for external auditors.

How to do Access Recertification 101?

No matter the compliance standard, the process remains the same. Access reviews are an important part of a company’s security architecture when it comes to user account access to sensitive data. First step is to obtain the employees, vendor and contractor information from the system of record so it can serve as the single source of truth for identities. Second step is to extract different types of user accounts, service accounts and their entitlements across the systems, databases and folders in scope for the review. Privileged accounts need a special type of review treatment as their abuse can lead to significant damage. Thereafter, matched identities of users are sending to their managers to review and attest. Any access remediation needs to post review.

What tools to use for Access Recertification 101?

Manual review is one way to do access reviews. However, enterprise application sprawl has expanded greatly. As per McAfee average enterprise has 464 custom applications deployed today. Oktas's research reveals an average of 129 SSO applications per company. Netskope has founds close to 1000 cloud services used per company. 

ReadMore: https://medium.com/@SecurEnds/access-reviews-101-20ce6754125e