Streamline Your Access Review Process with TheFence's Automated Solution 

User access review refers to the process of evaluating and verifying the users and their access rights within an organization’s IT environment. This review ensures that employees or other authorized individuals have appropriate access to the resources they need to perform their job functions, while also preventing unauthorized access to sensitive data or systems. 

During a user access review, administrators or data owners (mostly business line managers) examine the access rights assigned to each user account, checking to ensure that each account is only granted the minimum level of access necessary to perform its intended purpose. Any discrepancies or unauthorized access should be identified and corrected, which helps to maintain the security and integrity of the organization’s data and systems. 

User access reviews are typically conducted on a periodic basis, such as annually or semi-annually, as part of an organization’s overall information security management program. 

• Unauthorized Access: When users are granted access to systems or data they should not have access to, this can lead to data breaches, intellectual property theft, or other unauthorized activity. 
• Excessive Access: Users who have access to more data or systems than they need to perform their job functions pose a risk to themselves and to the organization. This can result in data breaches, insider threats, or other security incidents. If their user credentials were stolen (e.g. phishing attack), the excessive access rights can be be very useful for the attacker. 

• Inactive Accounts: When user accounts are left active even after the user has left the organization or no longer requires access, this can pose a risk to the organization. Inactive accounts can be exploited by attackers, who can use them to gain unauthorized access to the organization’s systems and data. In this case they can be hard to detect and identify as the previous owner will be in the activity logs. 
• Shared Accounts: When multiple users share a single account, this can make it difficult to track who is accessing data and systems. This can pose a risk to the organization, as it can be difficult to determine who is responsible for any unauthorized activity that occurs. 
• Weak Passwords: Users who have weak passwords or use the same password for multiple accounts pose a risk to the organization. This can make it easier for attackers to gain access to the organization’s systems and data. 

The frequency of conducting user access reviews can vary depending on the size and complexity of the organization, as well as regulatory requirements. However, we believe that asset owners should conduct regular and periodic user access reviews. Some organizations may need to conduct reviews more frequently, such as every six months or quarterly, to ensure compliance with regulations or to address specific security risks. 

It is important to note that user access reviews should also be conducted whenever there is a significant change in the organization, such as a merger or acquisition, a change in business operations, or a new system implementation. Additionally, if a security incident or breach occurs, a user access review should be conducted immediately to identify any vulnerabilities and address them promptly. 

The user access review process is incomplete: 

• Only the user’s employment status is reviewed, and their rights and roles are never checked. 
• The review process is not documented, making it impossible to track who reviewed what and when. 

• The identified problems are only corrected with significant delays or not at all. 
• The examination of conflicting rights is excluded from the review process. 
• The review process is not consistent and not regulated internally. 

The scope of the examined data is incomplete: 

• Only the users of the employees are reviewed. 
• No one checks the rights of technical users. 
• The external users are also excluded from the review. 
• The collected data are not documented, and the scope differs  system by system. 
• The rights of the users are checked against external, manually simplified lists. 

• The contents of the roles are not collected and reviewed. 

The examination is not performed by the appropriate person: 

• The review is not conducted by the business owner / data owner but by the IT administrators, so no one will notice and follow business changes in the access profile contents. 
• The reviewer passes the task on to someone else (with or without the sufficient knowledge). 

• The expertise of the reviewers ranges widely, and some do not have adequate knowledge for the review. 
• The reviewer is not aware of the business risks and conflicts related to the access rights. 
• The reviewer must also check their own entitlements, which is inherently conflicting. 

They use the wrong tools, or they don’t have tools for user access review: 

• They manually manage, coordinate and monitor the review process. 
• The review is complex, incomplete, and difficult to enforce through the whole organization. 
• The process takes a long time, and it is difficult to get responses from the reviewers. 
• The IAM tool (if any) does not (or cannot) be configured for user access review process.