Category:Access Management

From IT frameworks

One of the key processes in Service Operation, Access management is often referred to as "Rights management" or "Identity management" and is responsible for handling access requests posed to the IT organisation by its users.

Contents 1 Goals & Objectives 2 Terminology 3 Roles 4 Scope 5 Activities 6 Interfaces 6.1 Inputs 6.2 Outputs 7 Value to the Business 8 Implementation 9 Challenges to implementation 10 Flow Chart Model 11 Tips for exam 12 References and resources

Goals & Objectives

To grant rights or take them away as necessary for users of an IT service.

Terminology

• Access - Service available to a user of IT
• Rights - Priviliges of IT user to access services and/or information
• Service Groups - Effective way of granting rights to users who belong to groups
• Directory Services - Refers to a tool used by access management

Roles

• Access Manager: Accountable for executing the access management according to Security policy created by Information Security Management
• Technical Management and Application Management implement Access management as necessary.

Scope

The Access Management process basically executes the security policy defined in the Service Design key process Information Security management.

The key to a well implemented Access Management is CIA:

• Confidentiality - Only users with granted access has access to information
• Integrity - Information available to users is accurate and up to date
• Availablility - Information is available to those users who should have access when they need it

Note: Every access change is also an "ITIL change" and should be transitioned through Change Management at least once to enable a pre-authorized standard change.

Activities

The first main activities of Access management must be to ensure that the person/group requesting access are who they say they are and then that they should have access.

Interfaces

Inputs

• User request for access to an IT service
• RfC
• Service request
• New employee, HR sends request via Service Desk to allow access to IT services

Outputs

• Access granted or revoked

Value to the Business

• Control over who has access to certain information (sensitive information)
• Ability to easily revoke access should employees leave their posts
• For auditing purposes, a well implemented access management should be able to easier find security breaches.

Implementation

Challenges to implementation

Flow Chart Model

See image on the right.

Tips for exam

Access Management execute security policy defined and designed in Information Security management

References and resources

1. Key Element Guide Service Operation - OGC
2. ITIL Service Operation - OGC