Identity & Access Management (IAM) in the Banking Industry

 Identity  & Access  Management  (IAM)

  

1. Introduction

1.1 Purpose

This Identity  & Access  Management  (IAM)  framework  is  designed  to  establish  standardized  policies, procedures and controls for managing user access to various applications within any organization. The framework  aims  to  ensure  the  confidentiality,  integrity  and  availability  of those  applications while maintaining compliance with regulatory requirements.

1.2 Scope

This  framework  covers  all aspects of  user  access,  including  onboarding, modifying, role-based  access control, periodic reviews and offboarding, across all applications within an organization.

1.3 Objectives

• Ensure data confidentiality and integrity.

• Implementation of Principle of Least Privilege (POLP) and Segregation of Duties (SoD). 

• Mitigate the risk of unauthorized access.

• Facilitate compliance with regulatory requirements.

• Streamline user access processes for efficiency.

2. Roles and Responsibilities

2.1 IT End User Support Team

Provisioning,  Modifying and  Deprovisioning  User  Accounts: This  involves  managing  the  creation, modification and removal of user accounts within an application. The responsibility includes ensuring that new users have the necessary access rights and privileges, access rights and privileges modification should be based on approved business requirements and should comply to the user’s existing job responsibilities and while deactivated or departing users have their accounts promptly and securely deactivated.

Enforcement of Role-Based Access Controls: Role-based access controls define user permissions based on their roles within an organization. The role of the individual dictates the level of access they have to different resources or functionalities. Regularly reviewing permissions ensures that access aligns with the roles individuals perform, enhancing security and minimizing unauthorized access risks.

2.2 Data Owners / Business Stakeholders

Identifying  and  Classifying  Sensitive  Data: This  involves  recognizing  and  categorizing  data  that  is considered sensitive or confidential within an organization. This process helps in understanding the level of protection required for different types of information, such as personal, financial, or proprietary data.

Collaborating in Defining Access Permissions and Roles: Working together with relevant stakeholders to establish access permissions and role definitions. This collaborative effort ensures that individuals within an organization have appropriate access to data and systems based on their roles, responsibilities, and the principle of least privilege, enhancing security and data protection measures.

  

2.3 System Administrators 

Implementing and Maintaining Access Controls: This involves putting in place security measures and policies to regulate and manage access to systems, networks, and data. Access controls ensure that only authorized individuals or systems can interact with specific resources, helping prevent unauthorized access and potential security breaches.

Monitoring  System  Logs  for  Unauthorized  Access: Regularly  reviewing  system  logs  to identify  and investigate any instances of unauthorized access or suspicious activities. Monitoring logs is a crucial part of proactive security, enabling quick detection, response, and mitigation of security incidents to protect the integrity and confidentiality of data and systems.

2.4 Security / Governance Team

Conduct Periodic Access Reviews and Audits: Regularly reviewing and auditing user access permissions and roles to ensure they align with an organization’s security policies and requirements. Periodic access reviews help identify and address any discrepancies, unauthorized access, or changes that could pose security risks.

Respond to Security Incidents Related to User Access: Taking prompt action and implementing security protocols  in  response  to  any  security  incidents  involving  user  access.  This  includes  investigating  and mitigating the impact of incidents, as well as implementing measures to prevent similar incidents in the future. Effective response is crucial for maintaining the security and integrity of an organization's systems and data.

2.5 End Users

Follow Security Awareness Training: Actively participating in security awareness training programs to stay informed about the latest security threats, best practices, and organizational policies. This training helps employees develop a strong understanding of security protocols and enhances their ability to contribute to a secure work environment. 

Report  Any  Suspicious  Activity  Promptly: Promptly  reporting  any  unusual  or  suspicious  activities observed in the workplace or related to information systems. Timely reporting enables security teams to investigate and address potential security threats before they escalate, contributing to the overall security posture of an organization.

3. User Access Lifecycle

3.1 Onboarding Process

Standardized Account Provisioning: Establishing a consistent and uniform process for creating and setting up user accounts across an organization. This includes defining standardized procedures, templates, and protocols to ensure that user accounts are provisioned in a secure and efficient manner.

Access Request and Approval Workflow: Implementing a structured workflow for users to request access permissions  based  on  their  roles  or  job  responsibilities.  This  workflow  typically  involves  a  request initiation, approval process, and subsequent provisioning of the requested access. It helps ensure that access is granted in a controlled and authorized manner.

 

3.2 Active User Management

Regular Access Reviews and Updates: Periodically reviewing and updating user access rights to ensure  that they align with the current job responsibilities and organizational needs. This involves checking and adjusting permissions to maintain the principle of least privilege and reduce the risk of unauthorized access.

Role Changes and Access Modifications: Managing alterations to user roles and access levels as needed. This  includes  modifying  permissions  when  job  roles  change  or  when  employees  take  on  new responsibilities, ensuring that access rights remain relevant and appropriate. Regularly updating roles helps maintain the integrity of access control measures.

3.3 Offboarding Process

Timely Account Deprovisioning: Ensuring that user accounts are promptly deactivated or removed when individuals no longer require access. Timely account deprovisioning is crucial for preventing unauthorized access to systems and data after an employee leaves an organization or changes roles.

Access Revocation Protocols: Establishing protocols and procedures for revoking access privileges. This involves  defining  the  steps  and  approvals  required  to  remove  or  modify  user  access,  particularly  in situations where immediate action is necessary, such as during security incidents or when employees are terminated. Access revocation protocols enhance security by swiftly addressing access-related risks.

4. Access Controls

4.1 Role-Based Access Control (RBAC)

Assign Permissions Based on Job Roles: Assigning access permissions to users based on their specific job roles and responsibilities. This ensures that individuals have the necessary access to perform their duties while minimizing unnecessary privileges, contributing to the principle of least privilege.

Regularly Review and Update Role Assignments: Conducting periodic reviews of role assignments to ensure they align with the current organizational structure and job responsibilities. Regular updates to role assignments help maintain the accuracy and relevance of access permissions, adapting to changes in personnel or job roles over time.

4.2 Principle of Least Privilege (POLP)

Grant Users the Minimum Access Necessary for Their Roles: Providing users with the least amount of access required to perform their job functions. This principle, known as the principle of least privilege, reduces the risk of unauthorized access and potential security breaches by limiting user permissions to the essential tasks for their roles.

4.3 Segregation of Duties (SoD)

Prevent Conflicts of Interest by Segregating Critical Tasks: Ensuring that critical tasks, especially those involving sensitive or confidential information, are segregated among different individuals or roles. This segregation helps prevent conflicts of interest and reduces the risk of malicious activities by requiring collaboration for certain sensitive operations.

 

5. Access Request and Approval Process

5.1 Access Request Form

Standardized Form for Access Requests: Implementing a standardized form that users need to fill out when requesting access to specific resources or systems. This form typically includes details such as the user's identity, the requested access level, and the reason for the access request.

Clear  Approval  Workflow: Establishing  a  transparent  and  well-defined  approval  process  for  access requests. This workflow outlines the steps and individuals responsible for reviewing and approving access requests, ensuring that the granting of access follows a structured and authorized path.

5.2 Escalation Procedures

Clearly Defined Procedures for Unresolved Access Requests: Developing explicit procedures for handling access requests that cannot be immediately resolved or approved. This includes guidelines on escalating unresolved issues, communicating with the requester, and ensuring that there is a systematic approach for addressing exceptional cases in the access approval process.

6. Authentication and Authorization

6.1 Multi-Factor Authentication (MFA)

Implement MFA for Critical Systems: Introducing Multi-Factor Authentication (MFA) for critical systems, requiring users to provide multiple forms of identification before gaining access. This enhances security by adding an extra layer of verification beyond just a password, such as a verification code sent to a mobile device.

Strengthen  User  Authentication: Enhancing  the  overall  user  authentication process  by  implementing stronger and more secure authentication methods. This may involve using complex passwords, biometric authentication, or other advanced techniques to ensure that only authorized users can access systems and sensitive data.

6.2 Strong Password Policies

Enforce Complex Password Requirements: Implementing policies that mandate users to create complex passwords, typically involving a combination of uppercase and lowercase letters, numbers, and special characters. This helps enhance security by making it more challenging for unauthorized individuals to guess or crack passwords.

Regularly Update and Reset Passwords: Establishing a practice of periodically updating and resetting passwords for user accounts. This measure reduces the risk associated with prolonged exposure to the same  password,  minimizing  the  chances  of  unauthorized  access  due  to  compromised  credentials  or security breaches. Regular updates contribute to overall password hygiene and system security.

6.3 Access Token Management

Implement secure token management for sensitive transactions: This involves utilizing secure tokens to protect  confidential  information  during  transactions,  ensuring  an  added  layer  of  security  against unauthorized access or interception.

 

7. Monitoring and Auditing

7.1 Access Logs

Regularly review and analyze access logs: This practice involves routinely examining system access logs to identify any unusual or potentially malicious activities. Regular reviews help maintain the integrity of the system and promptly address any security concerns.

Detect and respond to suspicious activities: This involves implementing mechanisms to identify suspicious behavior or anomalies in the system. Upon detection, a proactive response strategy is crucial for mitigating potential security threats and maintaining the overall security posture of the system.

7.2 Regular Audits

Conduct periodic access audits: This involves regularly reviewing and assessing user access rights and permissions within a system to ensure alignment with organizational policies and security requirements.

Periodic  access  audits  help  identify  and  rectify  any  unauthorized  or  inappropriate  access,  enhancing overall security.

Ensure compliance with regulatory standards: This entails ensuring that an organization's user access management practices adhere to relevant regulatory standards and compliance requirements. By aligning with these standards, businesses can mitigate legal risks, protect sensitive data, and maintain trust with stakeholders.

7.3 Incident Response

Establish  protocols  for  responding  to  unauthorized  access  incidents: It  involves  defining  and implementing structured procedures to address and mitigate incidents of unauthorized access swiftly and effectively. Having well-established protocols ensures a coordinated and efficient response to security breaches.

8. Training and Awareness

8.1 User Training Programs

Conduct regular security awareness training: Regular training sessions are held to educate users about potential security threats, best practices for secure access, and the importance of following established protocols. This helps enhance the overall security posture of an organization.

Educate users on the importance of secure access practices: Users are informed about the significance of adopting secure access practices to safeguard sensitive information and prevent unauthorized access. This education contributes to creating a security-conscious user community.

8.2 Awareness Campaigns

Promote a culture of security awareness: Encouraging a culture where individuals at all levels prioritize and actively engage in security practices fosters a more resilient and secure organizational environment.

8.3 Reporting Security Incidents

Clearly communicate the process for reporting security incidents: Providing clear guidelines on how to report  security  incidents  ensures  that  users  are  aware  of  the  reporting  process.  This  transparency facilitates prompt reporting and resolution of potential security issues.

9. Compliance

9.1 Regulatory Requirements

Stay updated on regulations related to user access: Regularly monitor and keep abreast of changes in regulations  that  impact Identity  and  Access Management.  This  ensures  that an  organization remains compliant with industry-specific requirements.

Ensure compliance with data protection laws: Align user access management practices with relevant data protection laws to safeguard sensitive information and maintain compliance with legal requirements.

9.2 Internal Policies and Standards

Align  the IAM  framework  with  internal  policies  and  standards: Ensure  that  the Identity  and Access Management (IAM) framework is in line with internal policies and standards set by an organization. This alignment promotes consistency and adherence to established guidelines.

9.3 External Audits

Cooperate with external audits to validate the effectiveness of the IAM framework: Collaborate with external auditors to undergo periodic assessments and validations of the IAM framework. This external scrutiny helps confirm its effectiveness and identifies areas for improvement or adherence to industry best practices.      

10. Documentation and Records

10.1  User Access Requests and Approvals

Maintain records of access requests and approvals: Keep a comprehensive and organized record of all access requests received, including details of the requests, approvals, and any associated documentation. This helps in tracking and managing user access effectively.

10.2 Access Reviews and Audits

Document the results of access reviews and audits: Record the outcomes of regular access reviews and audits, documenting any findings, corrective actions taken, and areas that may need improvement. This documentation serves as a reference for compliance purposes and ongoing enhancements to the access management process.

10.3 Incident Reports

Keep  records  of  security  incidents  and  responses: Maintain  detailed  records  of  security  incidents, including the nature of the incident, the response actions taken, and any lessons learned. These records contribute to an organization's incident response capabilities and facilitate continuous improvement in security protocols.

11. Tools and Technologies

11.1 Identity and Access Management (IAM) Systems

Deploy advanced IAM systems for efficient user access management: Implement state-of-the-art Identity and  Access  Management  (IAM)  systems  to  enhance  the  efficiency  and  security  of  user  access management.  These  systems  provide  advanced  features  for  authentication,  authorization, and  user lifecycle management.

11.2 Access Monitoring Tools

Utilize tools for real-time monitoring of user activities: Employ tools that enable real-time monitoring of user activities across systems and applications. This proactive approach helps identify and respond to potential security threats or irregularities promptly.

11.3 Reporting and Analytics Tools

Implement tools for generating access reports and analytics: Utilize reporting and analytics tools within the IAM system to generate detailed insights into user access patterns, permissions, and any deviations from  established  norms.  This  information  is  valuable  for  compliance,  auditing,  and  continuous improvement of access management processes.

12. Continuous Improvement

12.1 Feedback Mechanisms

Establish channels for user feedback on the IAM process: Create avenues for users to provide feedback on their experiences with the Identity & Access Management (IAM) process. This feedback loop helps in identifying areas for improvement, enhancing user satisfaction, and refining IAM policies.

12.2 Key Performance Indicators (KPIs)

Define  and  monitor  KPIs  for  the  effectiveness  of  the IAM framework: Establish  Key  Performance Indicators (KPIs) that measure the effectiveness of the IAM framework. Regularly monitor these KPIs to assess the efficiency, security, and compliance of the access management processes.

12.3 Periodic Review and Update

Regularly  review  and  update  the IAM framework  to  adapt  to  changing  threats  and  technologies: Conduct periodic reviews of the IAM framework to ensure it remains aligned with evolving cybersecurity threats and advancements in technology. Update policies and procedures accordingly to maintain the robustness of the Identity Access Management.

Author : Rinu Jacob (CIST, CIGE)