Value to business. Access Management is effectively the execution of both Availability and Information Security Management

Scope

Access Management is effectively the execution of both Availability and Information Security Management, in that it enables the organization to manage the confidentiality, availability and integrity of the organization’s data and intellectual property.

Access Management ensures that users are given the right to use a service, but it does not ensure that this access is available at all agreed times – this is provided by Availability Management.

Access Management is a process that is executed by all Technical and Application Management function s and is usually not a separate function. However, there is likely to be a single control point of coordination, usually in IT Operations Management or on the Service Desk.

Access Management can be initiated by a Service Request through the Service Desk.

Access Management provides the following value:

• Controlled access to services ensures that the organization is able to maintain more effectively the confidentiality of its information
• Employees have the right level of access to execute their jobs effectively
• There is less likelihood of error s being made in data entry or in the use of a critical service by an unskilled user (e.g. production control system s)
• The ability to audit use of services and to trace the abuse of services
• The ability more easily to revoke access rights when needed – an important security consideration
• May be needed for regulatory compliance (e.g. SOX, HIPAA, COBIT).

4.5.4 Policies/principles/basic concepts

Access Management is the process that enables user s to use the services that are documented in the Service Catalogue. It comprises the following basic concepts:

• Access refers to the level and extent of a service’s functionality or data that a user is entitled to use.
• Identity refers to the information about them that distinguishes them as an individual and which verifies their status within the organization. By definition, the Identity of a user is unique to that user. (This is covered in more detail in paragraph 4.5.7.1.)
• Rights (also called privileges) refer to the actual settings whereby a user is provided access to a service or group of services. Typical rights, or levels of access, include read, write, execute, change, delete.
• Services or service groups. Most users do not use only one service, and users performing a similar set of activities will use a similar set of services. Instead of providing access to each service for each user separately, it is more efficient to be able to grant each user – or group of users – access to the whole set of services that they are entitled to use at the same time. (This is discussed in more detail in paragraph 4.5.7.2.)
• Directory Services refers to a specific type of tool that is used to manage access and rights. These are discussed in section 5.8.

Дата добавления: 2014-12-23