The hiring Manager, Human Resources (HR) team and Information Technology (IT) team are always in constant email communications to ensure on-boarding process is done one time before employee joining date. This on-boarding process includes entry into Human Resources Management Systems (HRMS), HR then pass the information to IT, so that IT team can create access to set of systems which is deemed as default access for all employees such as network login (typically Ms. Active Directory) and email systems or employee portal.
Manually sending email with information HR and then to IT team to create access not practical and here’s why:
Off-boarding of employee access from enterprise applications and infrastructures always pose threat when no proper record maintained for access issued right from day one of employment. Added to complexity is the access creep, which happens gradually and in an unmonitored way when granting permission to individuals or roles over an identity lifecycle.
Why manual removal of access right is not practical:record what was issued from day one, and ad-hoc basis;
Access right review, attestation or access certification (re-certification) are no longer new buzz word in the industry. Most of the organization today, in one way or another need to perform user access review for critical applications to address regulatory or audit requirements.
Manually tabulating access matrix information in spreadsheet, exported from various target systems, correlating them against users and generating entitlement review report is no longer practical.
Here’s why it’s not practical:
Password for privileged and sensitive accounts across many target systems and applications has been kept in the envelopes for many years. When required for maintenance work, these passwords are requested manually and approved via mail, and finally password with envelopes will be given to the requestor. Today instead of manual envelopes, passwords are kept in the spreadsheet and managed the same way.
Managing the privileged accounts manually or using spreadsheet, rotating the passwords and updating the spreadsheets on daily basis is tedious, time-consuming and no audit trails for the actual usage of this privileged accounts.
Here are more reasons why paper-based or manual password check-out not secure and practical:
Unstructured documents (files) and folders in the Microsoft Windows Files Server or Microsoft Sharepoint Servers grows significantly over times. Analyst predicts that these documents grows between 65-75 percent every year across all enterprises.
New files and folders created on daily basis and to make the numbers worst, each of these existing files being copied and shared. There are large number of duplicate files with different time-stamp and version. Controlling access to unstructured data is becoming difficult, complex and un-manageable.
Here are why you may not be able to manually manage the folders and files in your enterprise manually: