Why do organizations continue to struggle with entitlement risk modeling? It boils down to risk being aligned to roles and role-based access. The irony is that roles were never intended to be risk models. They were once low-hanging fruit, a logical way to provide an early means of grouping users to entitlements and later associating risk to such groupings.

The Problem With Role-Based Risk Modeling

Let’s briefly step back and distinguish the difference between groups and roles. Groups are typically bundles of individuals or entitlements that can be managed together within a single system, application or common system framework. Roles extended such groupings can span across both common and dissimilar enterprise systems and applications. The purpose of roles and groups was once to boost efficiency in managing entitlements and improve oversight of common members. Somewhere along the line, they became common tools for risk modeling.

Ultimately, security teams must determine whether each entitlement is in conflict, toxic or nontoxic, to another entitlement. This would be a tall order. The unfortunate problem with using roles for risk modeling is that each time an additional entitlement is added or removed from a role, the enterprise is forced to evaluate whether a new risk has been introduced.

To further complicate things, roles frequently contain multiple entitlements and even subroles with many contents. The role contents must constantly be evaluated for direct or indirect conflicts with business rules, policies and regulations that determine requirements for segregation of duties (SOD). Roles will, of course, be modified and consolidated as a common practice, and role contents will be added and removed.

The maintenance required to constantly evaluate and mitigate potential SOD risks each time a role is modified with a new or removed entitlement is impossible to effectively manage. It’s no wonder that organizations rarely achieve maturity in their risk models when they are based upon roles. The constant nature of role maintenance totally contradicts any risk maturity when specifically aligned to roles.

A Smarter Approach to Risk Modeling

A more effective approach is to separate risk models from roles — in other words, just let roles be roles. By aligning risk to static business activities, the roles can remain dynamic without disrupting risk models and resume their intended purpose of driving efficiencies in provisioning, user management and recertifications/attestations.

Business activities that largely remain unchanged are best defined by the lines of business (LOBs) or auditors, and they are easily modeled from common business process management frameworks. In fact, there is an open standard model of industry-specific business processes and even a generic cross-industry model available from an open community led by the American Productivity and Quality Center (APQC). The APQC community refers to these standard models as process classification frameworks (PCFs). Most business process management solutions leverage the open standard APQC PCFs and LOBs are usually very familiar with industry-specific PCF models. LOBs and auditors commonly use these frameworks in business process management, benchmarking operations and auditing.

At this point in time, only IBM Security Identity and Access Governance can successfully separate risk modeling from past role management, embrace the APQC PCF model and accommodate an organization’s own business activities. The solution was designed from the ground up to leverage this more effective business activity risk modeling approach. This allows security professionals to use roles the way they were originally intended instead of introducing inefficiencies into the risk management and modeling strategies.

Read the white paper: How Identity Governance became a key compliance and risk control

More from Risk Management

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today