Everyone with IT system authorization in a company represents a security risk for that company. For example, a employee editing financial data in an SAP system carries a higher risk than a employee who can edit their own personal data. To quantify the risk, you can enter a risk value for every company resource in the One Identity Manager. A risk index is calculated from this value for every employee who is assigned this company resource, directly or indirectly. Company resources include target system entitlements (for example, Active Directory groups or SAP profiles), subscribable reports, applications and resources. In this way, all employees representing a particular risk to the company can be found.
Every time a company resource with a specified risk index is assigned, the employee's risk index might exceed a permitted level. You can check the risk index of company resources if they are requested through the IT Shop. If the risk index is higher than the specified value, the request is denied.
To set up risk assessment for requests
The approval step is granted approval by One Identity Manager if the risk index of the requested company resource is lower than the comparison value. If the risk index is higher or equal to the comparison value, the approval step is not granted approval.
Risk assessment of requests works for both direct company resource request and assignment requests. Only imputed risk indexes are examined for the decision; calculated risk indexes are not taken into account. Therefore, risk assessment of requests only works if the product's original table or one of the member tables of a requested assignment has a RiskIndex column. If the table only has the column RiskIndexCalculated, the request is automatically approved. If both member tables of an assignment request have a RiskIndex column, the highest of the two risk indexes is used as the basis for the approval.
If the company resource request or an assignment has been granted approval, the employee's risk index is recalculated the next time the scheduled calculation task is run.
For more detailed information about risk assessment, see the One Identity Manager Risk Assessment Administration Guide.
Installed Module: | Compliance Rules Module |
You can integrate rule conformity testing for IT Shop requests within an approval workflow. A separate approval procedure is supplied for this. This approval procedure checks whether the request's recipient will violate compliance rule if the requests are granted approval. The result of the test is logged in the request's approval sequence and approval history.
Approval procedure | Description |
---|---|
CR (compliance risk analysis) |
Checks the current request for possible rule violations. It takes into account the requested product and all the company resources already assigned to the request recipient. |
Prerequisites for Request Validation
For more detailed information, see the .One Identity Manager Compliance Rules Administration Guide
To retain an overview of potential rule violations, you can run a simplified compliance check. Use the approval procedure "CR" to test requests for possible rule violations before finally approving them.
The following data of a recipient's request is taken into account by the compliance check:
Auxiliary tables for object assignments are regularly evaluated for the compliance check. Auxiliary tables are calculated on a scheduled basis. Furthermore, the approval procedure only takes into account compliance rules that are created using the simplified definition.
Rule checking does not completely check the requests
|
TIP: A complete check of assignments is achieved with cyclical testing of compliance rule using schedules. This finds all the rule violations that result from the request. |
It is possible that under the following conditions, rule checking identifies a rule violation where there isn't one.
|
TIP: These requests can be approved after checking by exception approver in so far as permitted by the definition of the violation rule. |
The compliance check is not only useful for specifying which rule is violated by a request, it can also find out, which product in the request caused the rule violation. This makes a detailed analysis possible of the rule violation. The request can still be approved by exception approval, the definition of compliance rules permitting. Additional approval steps are added in approval workflows to deal with exception approval.
Conditions for Compliance Checking Requests
Compliance Check Sequence
For more detailed information about compliance checking, see the One Identity Manager Compliance Rules Administration Guide.
Configuration Parameter | Meaning if Set |
---|---|
QER\ComplianceCheck\EnableITSettingsForRule | IT Shop properties for the compliance rule are visible and can be edited. |
If the configuration parameter "QER\ComplianceCheck\EnableITSettingsForRule" is set, properties can be added to compliance rules that are taken into account when rule checking requests.
Specify which violation should be logged for the rule by using the IT Shop property Rule violation identified.
Value | Description |
---|---|
New rule violation due to a request | Only rule violations that are added through approval of the current request are logged. |
Unapproved exception | Rule violations that are added through approval of the current request are logged. Already known rule violations that have not yet been granted an exception are also logged. |
Any compliance violation | All rule violations are logged, independent of whether an exception approval has already been granted or not.
This value is automatically set when the option Explicit exception approval is enabled. |
If the configuration parameter "QER\ComplianceCheck\EnableITSettingsForRule" is disabled, new rule violations are logged through the current request.
For more detailed information, see the .One Identity Manager Compliance Rules Administration Guide
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy