IAM question - need to define access controls (xbac rules) on a couple of applications, new to the field & do not know head from tail, what would be a good place to start analysis on?
Context: applications with multiple rights/entitlements, already has users at different levels within the company. We are to start by proposing some rules that can be put on identity attributes that'll later be defined with in our chosen system.

like
Posting as :
works at
You are currently posting as works at

Actually a lot of tools like Sailpoint and Saviynt have OOTB rulesets that have SOD violations already defined for common apps like SAP,oracle etc.

like

If you can get the user list with the profile attributes as well as the permissions in the various systems, you can create a matrix to look at common access that exists today. For example, you may see everyone with the Title=“After Market Sales” has access of some sort to the CRM system. You can look at these common privileges and start to define suggestions that anyone with the “After Market Sales” Title gets these baseline permissions. Always go least privilege since it’s better to have someone need to request additional access than let them see/do too much by default. Also, I agree with CD1’s comment. You don’t want someone that can submit payment orders also able to approve payment orders, ABAC should optimally be set up with segregation of duties in mind regardless of how the organization has permissions today.

like

Have you tried reaching out to your engagement manager for guidance? It’s OK not to know if new to the field.

like

Yes I've set up some calls already to brainstorm, & have started proposing some rules myself with information at hand that are logical, but would be great to get insight from people who have previous experience doing it.

like

start with the risks inherent with conflicts, not the tech itself

like

Segregation of Duty conflicts

NIST 800-63

Start by getting an export of job title to entitlement granted

See if there are common entitlements can be grouped at a higher level or department, like ALL USERS, then you can break it down further

Kind of depends on your authentication method. Are we talking SAML or certificate attributes? Or are you authenticating one way and using cloud attributes once authenticated for access authorizations?

Related Posts

Anyone here going to the EY holiday party this Thursday alone? I am 😅 and i think i’d be fun to meet other gals and keep each other company!

like

Can someone help me with the in-hand salary?
I assume Its 1.24 including taxes. 20k is reserved for Performance pay, I believe they will atleast pay 50% i.e 10k per month.

Is this good offer for 4.2EOY?

Post Photo
like

Can someone tell me what will be my in hand monthly salary.Tata Consultancy Infosys

Post Photo
like
like

Heard the firm had a good year, which should be reflected in bonuses. Sweet!

likeuplifting

Anyone has insights into whether we can claim depreciation for our “home office” due to WFH? Not an expert here but looks like it’s for self employed individuals only, but maybe the individual tax experts in this community can help everyone out a bit 🤪

likehelpful

For overseas ACCA accountants who have relocated to the US and have become US CPA's, how do you compare the difficulty level of the ACCA exam versus the CPA exam ?

like

How long after transitioning did you start to feel comfortable in your role? Feeling major imposter syndrome in my first 3 months

like

Folks who left Deloitte for competitors,
how many days after official resignation were you allowed to stay?

like
like

Favorite office chair?

like

Any recs on a good office chair for the back? Looking to spend <$350

like

Has anyone seen firing in Deloitte India? Is there any process or employees are fired directly like few companies?

like

How have you dealt with/recovered from burnout and feelings of numbness while working as a therapist?

likeuplifting

Can someone help in understanding the role and expectation for Associate Principal Engineer in nagarro ?
Also whats the difference b/n Associate Principal Engineer and Associate Principal Consultant ?

Anyone working for Oracle Cerner / Cerner Corporation and can provide a referral?

like

Do you know what’s funny?

I felt very good following Dana’s Town Hall. Having heard other networks are already facing furloughs and layoffs, did you feel as encouraged?

like

McKinsey & Company I received an offer from McKinsey & Company in 2021 and I’ll be starting later this year after graduation. Obviously because of the pandemic, inflation is slowly trending upwards. Has anyone asked for a base salary increase before even starting the job? Any advice on how to approach this?

like

How would you rank CHWTIA?

My ranking:

1. Accenture
2. IBM
3. TCS
4. HCL
5. Wipro
6. Cognizant

What would be your ranking?

like

Additional Posts in Cyber Security Bowl

Advice on moving away from being a practitioner and into policy?

Would you leave cyber consulting potentially Senior Manager to go work as Senior Customer Success Manager at a tech company ? What are your thoughts?

like

Any tripwire pros here? How did you get started?

like

Anyone currently enrolled or will be enrolled in the online masters cyber degree at Georgia Tech?

like

Anyone here made the switch from IT audit to cyber? How did you get your foot in the door, trying to explore this route.

likehelpful

Message me if you need a referral to PwC cybersecurity, financial crimes, or regulations. Please no noobs. Only experienced professionals with at least 1 YOE

likefunny

Does anyone know if Focal Point Data Risk is a good place to work at? Their recruiter reached out for a Principal Consultant role and I am wondering if they are a reputed name in the industry.

like

How long did you guys study for The new cissp exam , and how are the questions like on the exam

like

Any recommendations for resume revamp?

What would you folks say is the best and most achievable route to take for true Program Manager (minimal tech exp) with Sec+, picking up CISSP, and wanting to get more into the technology? Thoughts?

What are your security and privacy concerns on metaverse, apart from data privacy?

like

Privacy fish - Anyone taken the CIPM and can share what the exam is like?

Content outline seems like application of standard consulting approach, so how do they test it on an exam?

What technical interview questions can I expect for a Cloud ISSO position?

like

What do you think is the better option? Both offers are around the same salary (~100k EUR in Denmark).

Solutions Specialist (security) at Microsoft or Manager in digital solutions (security) at MasterCard? Also in respective of the long term career? I have 2.5 YOE

like

I’m transitioning from the military (CBRN and Combat Engineer) into cybersecurity. I completed a cybersecurity boot camp and I’ll be taking the Security+ exam soon. I haven’t had any interviews and I’ve received a fair amount of rejections emails. Could anyone give me some tips and possibly tell me how to improve my resume?

Post Photo
like

Has anyone gone through the deloitte cyber risk interview process recently? How many interviews did you have and how was the process?? Salary?

like

Would you expense a speeding ticket on your way to an IR?

funnylike

What is the process to get CISSP cert with pwc’s help? I heard that the firm pays for the exam fee and provides stipend for the study material. Anybody have any insight into this?

Tired of your job and want to come to KPMG Cyber Services? Drop me a burner here.

likefunny

New to Fishbowl?

Download the Fishbowl app to
unlock all discussions on Fishbowl.
That was just a preview…
Sign Up to see all discussions
  • Discover what it’s like to work at companies from real professionals
  • Get candid advice from people in your field in a safe space
  • Chat and network with other professionals in your field
Sign up in seconds to unlock all discussions on Fishbowl.

Already a user?
Login here

Share

Embed this post

Copy and paste embed code on your site

Preview

Download the
Fishbowl app

See what’s happening in your industry
from the palm of your hand.

A phone with Fishbowl app

Scan your QR code to download
Fishbowl app on your mobile

Download app

Sign up for free to view this conversation on Fishbowl

By continuing you agree to Terms of Use and Privacy Policy

Already have an account? Log in

Sign up for free to continue using Fishbowl

By continuing you agree to Terms of Use(New) and Privacy Policy(New)
Messaging rates may apply

Already have an account? Log in

For account settings, visit Fishbowl on Desktop Browser or

General

Legal