IAM Data Model Reconciling Access Rights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity access management (IAM) systems face challenges in efficiently managing access rights for employees within large enterprises, as they often require technical expertise and can lead to errors and inconsistencies due to manual processes, making it difficult for business personnel to request changes and conduct access reviews without understanding the underlying technical infrastructure.
Innovation Solution
Implementing an IAM data model that separates logical and physical aspects of access management, allowing business personnel to submit requests and reviews in business terms while technology personnel manage the technical aspects, with automated processes to reconcile and provision access rights, ensuring accurate and secure access to computing resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual processes are used to provision access rights, then flexibility in managing access is maintained, but errors and inconsistencies occur leading to unauthorized access
Solution Approach 1:
The system enables self-service provisioning where users can request access rights through a portal without manual intervention. The automated entitlement management system processes these requests, compares current access rights with desired access rights, and provisions changes automatically, eliminating manual errors while maintaining flexibility.
Solution Approach 2:
The system implements continuous feedback loops where access rights are automatically reviewed and reconciled. The entitlement management system monitors access rights provisioning, detects discrepancies between current and desired states, and triggers automated corrections to maintain accuracy without manual intervention.
2Ease of operation
If technical terms are used for access requests and reviews, then precision in defining access rights is achieved, but business personnel cannot understand or perform these tasks
Solution Approach 1:
The system introduces an intermediary layer that translates between business-friendly terms and technical implementation details. Business personnel interact with high-level concepts like 'access rights' and 'entitlements' without needing to understand underlying technical infrastructure, while the system maintains precise technical mappings to ensure accurate provisioning.
Solution Approach 2:
The system segments the access rights management process into distinct layers: a user-facing layer with business terminology for ease of use, and a system layer with technical terminology for precision. This segmentation allows business personnel to operate comfortably while the system maintains technical accuracy through automated translation and mapping between layers.
3Reliability
If comprehensive access reviews are conducted to ensure proper authorization, then security is improved, but time and resources are consumed
Solution Approach 1:
The system implements periodic automated access reviews that occur at scheduled intervals or triggered by specific events. These reviews automatically compare current access rights with desired access rights and reconcile discrepancies, maintaining security without requiring continuous manual intervention and reducing overall review time.
Solution Approach 2:
The entitlement management system operates continuously in the background, constantly monitoring and reconciling access rights. This continuous automated operation ensures security is maintained at all times without requiring periodic manual reviews, eliminating downtime and maintaining security posture continuously.
Data Source
AI summary
Systems and methods for reconciling access rights provisioned for physical computing resources of a computer system are provided. A reconciler may identify current physical computing resources accessible to a user account of the computer system and a physical entitlement specification associated with the user account. The reconciler may determine whether adjustment of access rights is needed based on a comparison of the current physical computing resources to the physical entitlement specification. Access rights to at least one physical computing resource may be adjusted in response to a determination that adjustment of access rights is needed.