3

Over the years people at my company have shared resources on cloud platforms with 3rd many parties. This can be files on Google Drive, articles on Confluence, repositories on Github, slack channels, really anything on a cloud platform that allows for collaboration. 3rd parties include ex-employees, clients and ex-clients, partners and suppliers. Over time this is becoming a significant security risk with data such as documents containing trade secrets or personal data shared with external entities, who no longer have a legitimate need for this data. Some of these documents are still being updated from time to time by people in the company who are unaware who else has access rights! Is this a common situation? How do companies usually manage cloud resources? Is it all down to how diligent (or not so dilignet) the account admins are?

Take Google Drive as an example. The platform allow you to share files with people outside of an organization. As clients, suppliers and employees come and go we've accumulated a large amount of files on these platforms that are shared with people who don't really need to access them any more. The process of going through all our files, and determining who needs access and who doesn't is very painful, and needs to be done on a regular basis. Is there a better way? How do other companies manage this?

  • While interesting, this question might be a bit too broad. Could you narrow it down a bit? – Tom K. Feb 13 '18 at 12:01
  • Let's focus on Google Drive and Dropbox. These platforms allow you to share files with people outside of an organization. As clients, suppliers and employees come and go we've accumulated a large amount of files on these platforms that are shared with people who don't really need to access them any more. The process of going through all our files, and determining who needs access and who doesn't is very painful, and needs to be done on a regular basis. Is there a better way? How do other companies manage this? – yoav.aviram Feb 13 '18 at 12:53
  • You should edit that into your question. ;) – Tom K. Feb 13 '18 at 12:59
  • Look into governance tools like Sailpoint or Okta or Gigya. Provisioning tools in a way. Also CASB solutions claim they address part of the problem – David Brossard Feb 14 '18 at 22:32
3

When you have a larger organization with a diverse IT infrastructure, then you have to get used to the fact that Identity Management becomes a full-time job. You need someone (or even a whole department) who is responsible for managing user accounts on all the IT resources you have. They (and they alone) are responsible for:

  • Creating accounts for IT systems
  • Assigning permissions
  • Revoking permissions when the functions of people change
  • Checking regularly if accounts are still actively used and lock them when they are not
  • Checking regularly for accounts with critical permissions and evaluate if they are still required
  • Maintaining records of all these activities so you can always tell who had which permissions during which timeframe (critical in case of a data breach)
  • Slapping people who put company data on cloud services not managed by them

When you want to minimize the work overhead for this, then you might want to consider to centralize and consolidate your IT infrastructure. Instead of distributing your IT infrastructure all over the net, you might want to consider to host more of it yourself. For every product mentioned in the question there is a solution you can install on-premise. This gives you far more control over your company data (have you actually read what you allow Google to do with your company secrets you upload to Google Drive?). It also gives you the ability to centralize the account management in your company. Many products support protocols like Kerberos which allow them to use user accounts from a centralized system. When every employee and business partner has just one account for everything in your company it becomes a lot easier to manage (for you and for them too).

"going through all our files, and determining who needs access and who doesn't" is something you shouldn't have to do. Proper enterprise-scale permission systems should be role-based. You don't get access to /project_x/business_plan_V14.67.docx, you get the "projectx participant" role which gives you access to /project_x/*.

  • Thanks for the detailed answer. Any idea how this is handled in smaller companies who can't afford someone to do this full / part time? – yoav.aviram Mar 1 '18 at 22:13
1

I haven't seen any elegant solutions to your problem. I've seen the following:

  1. Identify the responsible Point of Contact for each entity with access and provide them a list of that entity's users every quarter or six months and ask them to validate the users' ongoing requirement to have access.

  2. Automatically revoke access to users who have not accessed any resource in 'value X' amount of time and re-enable upon request.

  3. Request HR or Supplier Management contact you to revoke permissions for contractors or suppliers once their contracts are terminated or allow HR some level of management access to the platform.

Would it be possible for your business to issue a two-factor authentication soft token (e.g. Google Authenticator) which must be used to access any resource and you could centrally reactivate tokens for redundant users?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.