Access Controls Over Third-Party Applications

With an increasing focus on and potential exposure to confidential data, every organization must take the appropriate precautions to secure customer data, especially when the data are managed by third-party vendor software. Because vendors want to make their product offerings easy to use, they may not focus on industry best practices for user identification and authentication. It is in an organization’s best interest to control and maintain all user access to the software instead of relying on the vendor to perform the administration functions. This is especially significant if the vendor software is processing the organization’s confidential data.

Vendor Access

Several vendors focus on ease of use for the enterprise rather than on internal control and following best practices for issuing and maintaining user IDs. A very common best practice requires the system administrator to be part of the organization purchasing the software and not have the system administrator functions performed by the vendor. The vendor’s access should be clearly understood prior to the use or implementation of the software. If the vendor is only providing software and is not performing work for the enterprise, there should be very stringent procedures in place to monitor any vendor access. The enterprise should have a clear understanding of the vendor’s ability to create, change or delete user IDs or data within the vendor application. In many cases, the vendor will need to establish the organization’s system administrator upon initial implementation. However, after the enterprise’s system administrator is established, the vendor should have no other access, unless there is some type of emergency or an exception.¹ If the enterprise’s system administrator experiences issues and is not able to perform his or her responsibilities, the vendor may need to intervene. In this situation, all activity performed by the vendor should be logged and reviewed by the organization. An exception process should be in place for vendor intervention, similar to a break-glass mentality.

Vendor Procedures

There are vendor services where the vendor performs work and provides software for the organization. In these situations, the vendor has valid user IDs. If the service purchased by the enterprise requires the vendor to use the software on the organization’s behalf, the organization should have a documented procedure to authorize access based on a specific business need and not grant vendor users access to all functions within the vendor application. The organization should also ensure that a complete user audit trail is available. The related control should include a procedure to monitor the vendor’s actions to ensure that the use of the software is consistent with the agreed-upon service. It is imperative that the vendor and the organization’s system administrator do not have the ability to delete or change any part of an audit trail. The audit trail should have detailed information, such as when the software was accessed, changes made and details about the user’s device. For example, only work-related computers should access the organization’s data, unless there is a business need for the software to be used on other devices such as smartphones. If other nonwork-related devices are needed to access the vendor software, the enterprise should implement additional procedures for user identification and authentication.

System Administration and SoD

The enterprise’s information security organization should manage all aspects of user administration. The enterprise users should not have access to system administrator functions. Also, the system administrator must not have the ability to modify customer data. This may sound basic, however, based on recent reviews of some vendors that manage confidential customer data, the vendors offer functionality for multiple system administrators to reside within the organization, having both system administrator access and enterprise user access. This violates a key control of segregation of duties (SoD). If an enterprise user has the ability to execute system administrator functions, this user also has the potential to manipulate audit trails and make potentially undetected changes.

Assuming SoD is in place, meaning the system administrator does not have access to the enterprise data, the following steps are required for an identity management program to be truly successful:

1. A formalized process for user access requests must be in place. The requests should be logged and saved as an audit trail. (This includes access requests for vendors and entity users.)
2. The user’s manager must approve the need for the requested data. An agreed-upon approval process should be defined prior to authorizing the vendor users.
3. The application owner must also approve the need for the user’s access to the application and its corresponding data.
4. When the user ID is created by the system administrator, the user ID must be consistent with the organization’s standards. A consistent naming convention will also help to eliminate or identify users with multiple user IDs.²
5. Group IDs (IDs shared by multiple users) should not be used. This presents a lack of accountability, and errors or omissions cannot be associated with a specific person.
6. The application must require a force-change password so a password cannot be reused.
7. The organization must have a process in place to automatically revoke user access once an employee has been terminated.

The enterprise must also implement a periodic recertification process. The frequency should be dependent on the sensitivity of the data. The recertification process requires the users’ manager and application owner to confirm the need for the users’ access.

Single Sign-On

Additionally, if the entity does not have something similar to single sign-on implemented, it is possible for a user to log in from a home computer (not authorized by the entity). At a minimum, IP restrictions should be enforced on all vendor applications. By enforcing IP restrictions or other stronger controls, an enterprise user may not use their own personal device (e.g., laptop, mobile phone) to access the enterprise’s customer data. If an organization user is allowed to access the enterprise’s data from a third-party vendor on a home computer, the audit trail will be more difficult to manage. It may not be readily apparent when and how the user is accessing these data, leaving the organization with possible exposure of sensitive customer data.

Audit Trail

The value of a strong audit trail cannot be overstated. There are audit trails that are easy to read but do not have sufficient information. There are also audit trails with very detailed information, but that are so difficult to access and summarize that the data are not usable. When the entity purchases the vendor software, the entity is responsible for the controls over this software. Even though the vendor has responsibility over the integrity of its software, any accidental or intentional exposure to data by this software is the responsibility of the enterprise and will be viewed as such by the general public.

By implementing proper vendor-related controls, SoD and IP restriction controls, the organization will have a strengthened environment and reduced accidental exposure to sensitive customer information.

Editor’s Note

The information represented in this article does not reflect the opinions of the author’s employers.

Endnotes

¹ Chadwick, D.; “Federated Identity Management,” University of Kent, Canterbury, England, 2009, https://www.cs.kent.ac.uk/pubs/2009/3030/content.pdf
² Campi, A.; “How Strong Is Strong User Authentication?” ISACA Journal, vol. 5, 2012, https://www.isaca.org/resources/isaca-journal/issues