The Access Auditing service is a professional service offering that leverages the leading product in CA Identity Governance (formerly GovernanceMinder) to achieve access rules compliance to SOX and PCI. This tool, engineered as the core component of CA Identity Suite, enables business intelligence (BI) and drilling (data mining) techniques to be used in Identity and Access Management. It can easily detect any inconsistencies, errors, irregularities, corruption and other problems relating to the definition of access policies and privileges.

This auditing service, which requires no hardware or software acquisition by your organization, uses advanced technology to correlate access privileges across all selected systems and applications (all platforms), organizational data (Eg, Active Directory, OID, E-Directory, iPlanet, OpenLDAP, etc.) and your HR data. All suspect data in terms of security are thus identified (Non-standard or atypical access, suspicious high privileges, access collectors, dormant accounts, duplicates, suspicious privileges, inconsistency between function and access, policy violations, poor segregation of tasks, etc.). More than a hundred out of the box queries are used to analyse the security data with Business intelligenve abd pattern based techniques.

With the experience gained since 2007 by our consultants, we offer this audit service to our customers in several forms, including the acquisition as a service (SAAS). We also offer additional contractual formulas with three and five years of recurrence.

Audit services generally include the following :

Analysis of the overall process and lifecycle framework of user identity (Identity and Access Governance)

• Review of IT access management processes across system platforms and business rules
• Review of security management applications and practices in IT operations
• Analysis of Identity Directories and Security Tables and Consolidation of Identity Data
• Identification analysis (identity correlations) for the detection of dormant, duplicate, inactive, incoherent or poorly defined accounts, etc.
• Analysis of access privileges as compared to human resources data (Access vs. Tasks, RBAC)
• Analysis of access privileges according to organizational structures
• Analysis of high-privilege accounts (due diligence)
• Isolation and selection of inconsistencies and errors for correction and cleaning
• Production of reports on the current situation
• Analysis of the implementation and enforcement of security policies and separation of incompatible tasks
• Report on violations in terms of segregation of duties
• Summary report on observed anomalies and recommendations
• Final report

For any inquiries about services, please contact us at the following address: sales/@/xpertics.com