Why do organizations continue to struggle with entitlement risk modeling? It boils down to risk being aligned to roles and role-based access. The irony is that roles were never intended to be risk models. They were once low-hanging fruit, a logical way to provide an early means of grouping users to entitlements and later associating risk to such groupings.

The Problem With Role-Based Risk Modeling

Let’s briefly step back and distinguish the difference between groups and roles. Groups are typically bundles of individuals or entitlements that can be managed together within a single system, application or common system framework. Roles extended such groupings can span across both common and dissimilar enterprise systems and applications. The purpose of roles and groups was once to boost efficiency in managing entitlements and improve oversight of common members. Somewhere along the line, they became common tools for risk modeling.

Ultimately, security teams must determine whether each entitlement is in conflict, toxic or nontoxic, to another entitlement. This would be a tall order. The unfortunate problem with using roles for risk modeling is that each time an additional entitlement is added or removed from a role, the enterprise is forced to evaluate whether a new risk has been introduced.

To further complicate things, roles frequently contain multiple entitlements and even subroles with many contents. The role contents must constantly be evaluated for direct or indirect conflicts with business rules, policies and regulations that determine requirements for segregation of duties (SOD). Roles will, of course, be modified and consolidated as a common practice, and role contents will be added and removed.

The maintenance required to constantly evaluate and mitigate potential SOD risks each time a role is modified with a new or removed entitlement is impossible to effectively manage. It’s no wonder that organizations rarely achieve maturity in their risk models when they are based upon roles. The constant nature of role maintenance totally contradicts any risk maturity when specifically aligned to roles.

A Smarter Approach to Risk Modeling

A more effective approach is to separate risk models from roles — in other words, just let roles be roles. By aligning risk to static business activities, the roles can remain dynamic without disrupting risk models and resume their intended purpose of driving efficiencies in provisioning, user management and recertifications/attestations.

Business activities that largely remain unchanged are best defined by the lines of business (LOBs) or auditors, and they are easily modeled from common business process management frameworks. In fact, there is an open standard model of industry-specific business processes and even a generic cross-industry model available from an open community led by the American Productivity and Quality Center (APQC). The APQC community refers to these standard models as process classification frameworks (PCFs). Most business process management solutions leverage the open standard APQC PCFs and LOBs are usually very familiar with industry-specific PCF models. LOBs and auditors commonly use these frameworks in business process management, benchmarking operations and auditing.

At this point in time, only IBM Security Identity and Access Governance can successfully separate risk modeling from past role management, embrace the APQC PCF model and accommodate an organization’s own business activities. The solution was designed from the ground up to leverage this more effective business activity risk modeling approach. This allows security professionals to use roles the way they were originally intended instead of introducing inefficiencies into the risk management and modeling strategies.

Read the white paper: How Identity Governance became a key compliance and risk control

More from Risk Management

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Cybersecurity dominates concerns among the C-suite, small businesses and the nation

4 min read - Once relegated to the fringes of business operations, cybersecurity has evolved into a front-and-center concern for organizations worldwide. What was once considered a technical issue managed by IT departments has become a boardroom topic of utmost importance. With the rise of sophisticated cyberattacks, the growing use of generative AI by threat actors and massive data breach costs, it is no longer a question of whether cybersecurity matters but how deeply it affects every facet of modern operations.The 2024 Allianz Risk…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today