Identity Provisioning

Though denying access is an effective way of protecting an asset, security cannot be so restrictive that employees and contractors are unable to do their jobs. The process of granting, managing, and deactivating access to systems is known as identity provisioning. For the best balance of security and production, the CISSP, CISO, or CSO will recommend that users have exactly the privileges required to perform their job role, and only those. This concept is called least privilege. Users with higher privileges (also known as superusers) require access to restricted areas to do their jobs. The best security option for either system is to provide the least privilege.

Finally, as enrollment of new staff and contractors occurs, access to systems they require needs to be granted, and when that person leaves the company, their access should be revoked. The next section will discuss how to account for these users and superusers and ensure that the users are provisioned...