The Power to Prevent: How Access Risk Management Detects Threats Before They Develop

Authored by: Jody Paterson

Now available within IdentityNow, SailPoint’s Access Risk Management enables organizations to get granular visibility into potential access risks within complex ERP systems such as SAP — even before access is approved and provisioned.

One of the biggest challenges facing any enterprise is risk management, particularly managing risks associated with access to technology. Historically, organizations have struggled to forecast potential risks in advance (such as during provisioning) due to line-of-sight limitations. This, in turn, has often resulted in users accidentally being given inappropriate access to sensitive data or obtaining accounts that violate SoD policies.

Those scenarios have the potential to create even more complex problems. For example, risks that go unmitigated at the role, transaction, and authorization level can lead to “cross-pollination” issues with other key business applications. It’s a situation that can spiral out of control quickly and greatly increase the potential for fraud.

Solving this problem is not easy, because current approaches only provide visibility at the entitlement level. What enterprises need, however, is full visibility into their ERP systems, which have multiple levels of security. To fully evaluate a risk profile, it’s essential to have a complete and granular understanding of what users are doing (and when) for every identity’s access into a system like SAP and other applications. Without that, getting comprehensive visibility into risks and accurately assessing potential problems is more challenging.

Risks like these – invisible and unknown – are the most dangerous to a business. But the good news is, it’s now possible to achieve that depth of analysis as well as identify and mitigate this type of risk before access is granted. SailPoint’s Access Request Service, when combined with new Access Risk Management (ARM) capabilities, gives companies using IdentityNow complete visibility into potential risks — no matter the complexity of a system’s security structure.

In-Depth, Always-On Analysis

Managers, role owners, and risk owners tasked with approving access struggle to do so consistently and accurately. Why? Because they don’t have the right tools to get the insights they need. But give them continuous, real-time analysis of access-related SoD risks and watch things change. Approvers will now have the ability to make fully informed decisions, and the organizations they work for will reap a rapid time to value.

The benefits of this solution are many. For the first time, all approvers in an organization will have complete line-of-sight visibility into any potential violations. Unmitigated access risks in production can be reviewed (and denied) instantly. Evidence for internal or external auditors can be collected rapidly. The capability to monitor transactional utilization data can help zero in on the most significant risk factors. And automated access reviews can be created to achieve full transparency in even the most intricate security environment.

The best news is that because this solution is 100% SaaS, it can be stood up in just hours (sometimes within minutes) and without costly implementation or ongoing maintenance.

Risk-Free Approvals Made Easy

Avoiding risky access becomes easier than ever. Once users request new access within the Request Center, ARM immediately evaluates the request by comparing the user’s existing access against extensive rule sets to flag any potential risks that would occur if the access were granted. Only once this analysis is complete do approvers see the request along with any identified risks.

Foundational rule sets come OOTB with this solution so customers can get up and running on day one. But these rules can also be updated, modified, and extended to address unique use cases and reflect new policies, so approvers always have the information they need to make the most informed decision.

Over time, organizations can build out custom dashboards and create tailored reports to give managers, application owners, and compliance teams even greater visibility. These reports provide the assurances auditors need in demonstrating that all risks have been captured and mitigated. Plus, insights from these reports can help the organization mold more accurate role structures for the future. By continually improving those structures, companies reduce the root cause of risk while reaping cost savings and streamlining their overall operations.

Customer PeroxyChem, for example, reports that after implementing ARM, the company was able to fix 97% of their SoD conflicts within SAP. This is a great example of how getting true 360º visibility leads to an enhanced ability to align worker responsibilities with corporate risk. It’s exactly what SailPoint’s EVP Product & Engineering Grady Summers says: “With ARM, SailPoint customers can fully embrace employee empowerment because the associated risk is completely managed.”

Take the Next Step in Risk Reduction

Like the saying goes, prevention is the best medicine. By preventing risks before they occur – continuously, across the enterprise – companies can have complete confidence in their ability to empower employees with fast access to exactly the right resources across their entire technology landscape. That is a powerful competitive advantage.

For more details on SailPoint ARM or to schedule a demo, contact your CSM today.