Identity Security Cloud (ISC) certifications

Identity Security Cloud (ISC) certifications are an important way to control who has access to IT systems in today's complicated IT environments. Companies use certification campaigns to ensure that users have the required access, minimize security risks, and meet audit requirements. Two important things that make these campaigns work are completeness and accuracy.

When campaigns aren't finished, there are gaps where bad access goes unchecked. Reviewers make choices based on old or incorrect information when the data is wrong. All of these problems make the whole certification process less dependable, which reduces trust and puts organizations at risk of failing to meet compliance requirements and security risks.

Completeness

Completeness means ensuring that all accounts, roles, access profiles, and entitlements within the defined scope are available for review. A full campaign makes sure that there are no blind spots and that all certifiable access items are collected and shown to the right reviewers. This stops high-risk access from going unexamined just because it wasn't part of the campaign scope.

Accuracy

Accuracy means ensuring that the data shown to reviewers reflects current state. Identity attributes, account correlation, entitlement assignment and relationships within an organization must be accurate (up to date and not out dated). Accurate data provides the reviewer with the necessary information to make an informed decision as to whether the access is appropriate.

Building Completeness: Strategies Before the Campaign

Before starting any campaign, make sure that your identity data includes the connections that your campaign will depend on.

• For campaigns to certify managers, each identity must have a manager set up. Identities that don't have managers are automatically left out of manager campaigns, which could leave gaps.

• Close gaps by updating identity data through source aggregations or by making changes by hand.

• For campaigns with source owners, make sure that each source has been given a source owner.

Design Campaign Scope

Don't run "all users" campaigns that are too much for reviewers. Instead, use ISC's advanced search to find specific groups of people based on their department, location, job title, risk score, or employment status.

Use Strategic Campaign Filters

Use the default filter "Exclude Uncorrelated Accounts" to make sure that only access that is related and can be verified is shown. Make custom filters to leave out service accounts, test accounts, and low-risk entitlements so that reviewers only see things they can really evaluate.

Check and Preview Before Launch

Always look at campaigns before you turn them on. The preview shows the number of reviewers and identities for validation. Start your campaign within 24 hours of making the preview. Campaigns are like snapshots in time, and waiting means old data.

Undecided Item Management

Undecided items at deadline. The recommended “Maintain access to undecided items” option automatically approves items not explicitly acted upon, which is safer because it is difficult to re-establish access to revoked items.

Ensuring Accuracy: Data Quality and Accuracy of Reviews

Data quality from trusted sources is the first step to accuracy. Schedule regular source aggregations and perform data hygiene: remove duplicate accounts, delete orphaned accounts for terminated employees, update identity attributes in a timely manner, and maintain accurate organizational hierarchy data. Map critical identity attributes for accurate campaigns.

Require Full Reviews with Sign-Offs

Reviewers must make a decision on all items before ISC signs off. Certifications are read-only once signed off and have a full audit trail. The system also prevents inappropriate reassignments that would allow for self-certification.

Post-Campaign Verification

Validate Remediation

After finishing a campaign, check that revoked access has been removed. For connected sources with provisioning, automated remediation takes place immediately. Tasks are produced for the owners of the sources, manually. Track progress using the Campaign Remediation Status Report.

Re-Aggregate Sources After Changes

Manual changes by source owner's Aggregate changes into ISC from those sources. This completes the remediation cycle and ensures future campaigns represent the real access state.

Best Practices

Conclusion

To get complete and accurate ISC certifications, you need to pay attention to data quality, design your campaigns carefully, set them up correctly, and follow through on your promises. To begin, make one or two changes to your next campaign. For example, check identity-manager relationships before generation and promise to start campaigns within 24 hours of creating a preview. As time goes on, cleaner data makes campaigns more accurate, helps reviewers make better decisions, and makes security stronger.
The certification process has evolved from an approach intended primarily as confirming compliance to a more comprehensive means for managing Access Risk. The result will be improved Access Governance, fewer audit findings and a more secure environment.