Pitfalls and Best Practices in Role Engineering

Transcription

1 Bay31 Role Designer in Practice Series Pitfalls and Best Practices in Role Engineering Abstract: Role Based Access Control (RBAC) and role management are a proven and efficient way to manage user permissions. Too often, however, companies don t achieve the benefits they hope for from role management, and some projects even fail. This whitepaper describes the pitfalls to avoid when implementing role management, and best practices that will make your project a success.

2 Introduction Role management is an excellent way to reduce the cost of managing entitlements and promote transparency. Implementation, however, is challenging. More than a few role management projects have fallen short of the benefits they sought, or even failed. But this is not an inherent flaw in the concept of role management; rather, it usually comes from underestimating the importance and the complexity of designing the actual business roles. Our goal with this whitepaper is to allow companies to take on role management with open eyes to understand the challenges and recognize the planning requirements. About this Whitepaper Bay31 is a vendor of role engineering software, so you may naturally expect that this whitepaper is really an advertisement for our own product, Role Designer. Of course, we can t deny our interest, but this paper should be valuable and relevant regardless of what software you use for your role management project. Everything specific to Bay31 and Role Designer is in sidebars, like this one, which you can read separately. A brief overview of role management Roles are sets of access permissions that correspond to a job function, and can be managed efficiently with enterprise role management tools. Role management allows you to implement a well-defined role life cycle. By doing so, you improve security and transparency and reduce costs in all kinds of business processes. The first step in the role life cycle is role engineering, in which you discover and design the roles. A well-conceived set of roles is an absolute prerequisite to a successful role management program Many role management pitfalls are in the role engineering phase, so it is important to recognize and avoid these pitfalls. The Role Life Cycle Role Engineering Audit and Review Handover to Role Owner Risk and Compliance Access Request and Approval Pitfalls and Best Practices in Role Engineering 2

3 Pitfall #1: Roles that are not intuitive Role mining is a powerful way to discover roles by data-mining existing access permissions. A danger, however, is that role mining may generate roles that are not intuitive for humans. This is because role mining algorithms use fairly dumb criteria for generating roles; for example, covering the maximum number of users with the smallest number of roles. This can lead to roles that are optimal in a mathematical way, but appear to humans like arbitrary collections of permissions, without any business meaning. The problem with roles that are not intuitive is that people cannot apply their good business sense when working with them. This is inherently insecure. For example, when assigning or auditing roles, a person needs to have an intuitive sense of a role s meaning in order to judge the appropriateness of a role assignment. You can avoid this pitfall by orienting role mining to the high-level structure of your organization. For example, if you think that branch office managers should have similar access profiles, then run role mining over that subset of people. This will avoid the algorithm churning away to find commonality among users with fundamentally different job profiles. Instead, the role mining algorithm will naturally discover roles that are inherently relevant to branch office managers job function, and these roles will be more intuitive for humans. Role mining is often called the bottom-up approach to role engineering, because it starts with existing low-level access permissions. The top-down approach, on the other hand, starts with an analysis of the organization structure and business processes, then maps these to permissions. In practice, a combination of these two approaches generally produces the best results. Role Designer unifies top-down and bottom-up role analysis RBAC specialists often suggest combining top-down and bottom-up role analysis in a hybrid approach. Unfortunately, they rarely say how to do this! Role Designer implements a methodology that combines the top-down and bottom-up approaches in three steps: Pick business attributes Pre-mining Role Mining Identify business attributes that reflect job function, (job title, team id, work location, etc.). Role Designer finds the best data subsets for role mining according to the business attributes. Role-mine in selected data subsets and promote the best role to production. This step-by-step process contrasts with traditional approach to role mining, in which an analyst explores the permission data in a trial-and-error process to find the best datasets for role mining. The choice of datasets for role mining makes a big difference in the quality of the generated roles. Role Designer s methodology takes the guesswork out of role-mining, reduces the cost, and improves the quality of the results. Pitfalls and Best Practices in Role Engineering 3

4 Pitfall #2: Not considering existing permissions You may be tempted to avoid role mining and take a pure top-down approach to role design, crafting roles from scratch to suit your organization. The problem with this approach is that it does not take into account the permissions your employees currently have. You may design a very elegant role framework, but if it does not match peoples real current permissions, you will likely have to revoke and reorganize many existing permissions to implement it. This is risky. The thousands or millions of access permissions in your company have evolved over years and make every business process function sometimes for historical or political reasons that are not clear from a top-down perspective. Your goal may be to clean up and restructure, but doing so without a clear view of the current state of access permissions risks breaking processes and making enemies. This is what role mining does well. A role mining and analysis tool allows you to visualize and structure large sets of permission data. For medium or large organizations, such a tool is essential. Role mining allows you to: Speed up role discovery Visualize existing permissions and plan an orderly transition to roles Validate your top-down analysis Identify exceptional permissions that fall outside the roles you have defined, and apply controls so these permissions may be safely used outside your role framework Once again, the best approach combines both top-down analysis and bottom up role mining. In this way you can align the high-level structure of your authorization model with your employees existing permissions. Role Designer automatically discovers natural business roles. Graphical matrix visualization reveals complex relationships at a glance. Automatically identify outlying and missing entitlements. RoleDesigner masters complexity Pitfalls and Best Practices in Role Engineering 4

5 Pitfall #3: Not planning for manageability When designing roles, it s easy to forget that the goal lies beyond the role engineering phase. The real goal of role engineering is to design roles that are easily managed by the people who will assign, review and audit access permissions. If you do not consider manageability when you design roles, you defeat the very purpose of role management: lower cost, transparency and accountability. The best way to avoid this pitfall is to be sure that the role analyst is familiar with the organization and the business processes into which roles will be deployed. Manageability depends a lot on the context and the people who will work with the roles. When designing roles, keep in mind the following principles: Identify base roles, which can be assigned automatically to all users in a certain organizational or functional unit. Each user should have at least one base role. Make roles distinct, so it is clear which role to apply in a particular situation. If the authorization structure is strongly hierarchical, define roles hierarchically to reflect this. Keep the number of roles that a particular person must manage as small as possible. Applying these principles depends on the context. This is why the analyst s business insight is important. Role Designer optimizes role manageability Role Designer allows you to adapt the role mining algorithm to your organization, generating roles that are most manageable in practice. Step-by-step Analytic Hierarchy Process (AHP) makes objective-setting easy and intuitive. Pitfalls and Best Practices in Role Engineering 5

6 Pitfall #4: Not planning for role maintenance Here s the bad news: When you finish your role engineering project, you need to start all over. New applications, new employees, and reorganizations mean that access permissions change constantly. Over time, roles will get out of synch with your organization and your role management solution will become less robust. Then compliance risks may creep back in. To maintain the benefits of role management, you need to periodically review and update your roles. The way to avoid this pitfall is to establish a continuous process for role maintenance. Essentially, this means reviewing the role engineering phase, including: Review existing roles to see if they still correspond to your business processes and policies. Check for new permissions and incorporate these into your role framework, or catalog them as exceptional permissions. Identify new permissions that diverge from your role framework so-called outliers. Check if permissions conflict with your access policies or pose a compliance risk. The good news is that role maintenance takes much less time than initial role engineering, and improves compliance. By continuously updating your role framework, you maintain the benefits of your investment in role management. RoleDesigner facilitates role maintenance Role Designer automatically highlights new and exceptional entitlements. Role Designer visually distinguishes between new roles and production roles, and highlights changes to production roles. Role Designer has features to merge and split roles, and optimize role hierarchies. Pitfalls and Best Practices in Role Engineering 6

7 Pitfall #5: Biting off more than you can chew Role engineering your entire organization all at once is a risky strategy. As the scope expands, the cost and complexity increase and may threaten your project. This pitfall is partly technical. Role engineering definitely has a learning curve, so you need to start simple, and plan to learn from experience and refine your processes as you do. The learning curve also applies to the rest your organization. As you roll out roles, some people with uncontrolled access have to submit to new policies and this may generate resistance. Avoid this pitfall by taking an incremental approach to role engineering: Divide and conquer Break large organizations into manageable pieces and design roles for each piece that are independent of the others. This may lead to more roles overall, but it will reduce complexity and be more flexible and manageable overall. Iterate Start by role engineering one department or business process and put the roles into production to gain experience with the whole process. Plan to learn from experience, and refine your method as you do. No Big Bang Deploy roles to production in phases. Take the time to explain to business process owners the benefits that they can gain from role management, and plan your rollout to minimize the impact on their operation. In general, prioritize and be pragmatic; it s not necessary to develop roles for every person and every entitlement. Roll out role management according to the cost/benefit. RoleDesigner drives scalable role mining campaigns Divide and conquer approach simplifies analysis and maintenance Collaboration and workflow for large role mining projects Dashboard tracks role campaign progress Pitfalls and Best Practices in Role Engineering 7

8 About Bay31 Bay31 is a software company specialized in access governance. Our products allows customers to oversee and optimize business processes, and manage the risk associated with user access. Bay31 is unique in applying new techniques for data-mining, pattern recognition and risk management to access governance. By combining advanced data-processing techniques with human business insight we develop solutions that are particularly intuitive and productive. A key element of our innovation is original scientific research in collaboration with academia in the field of access control. Many of our research results are published in leading scientific journals and represent the cutting edge of research in the field. With headquarters in Geneva, Switzerland and software development based in Rome, Italy, Bay31 serves customers internationally, directly as well as through partners. To contact Bay31, visit bay31.com/contact. Pitfalls and Best Practices in Role Engineering 8