Data Access and Identity Management
Data Access and Identity Management tests whether you can design access so that people and machines get exactly what their role requires, for exactly as long as required, with evidence. Scenarios usually involve a role change, a shared account, or a service credential that nobody owns.
Principles and models
Least privilege and need-to-know are the base principles; segregation of duties prevents one identity from both initiating and approving a high-risk action. Choose the authorization model deliberately. Role-based access control is simple and auditable but suffers role explosion as exceptions accumulate. Attribute-based control evaluates attributes such as department, clearance, location and time, and scales better for large populations. Relationship-based models grant access through recorded relationships, which suits collaboration platforms.
Privileged access management covers administrative accounts: credential vaulting, session brokering, keystroke and screen recording, and just-in-time elevation with automatic expiry instead of standing admin rights. Multi-factor authentication should resist phishing - passkeys or hardware tokens, not SMS. Federation with SAML or OIDC gives single sign-on and central deprovisioning. Zero trust means no implicit network trust: verify explicitly, grant least privilege, assume breach.
Lifecycle and review
The joiner-mover-leaver process is the control that matters most. Access must be provisioned from an approved request at join, recomputed rather than accumulated at move, and revoked from a single authoritative trigger at leave. Access certifications should be risk-based: quarterly for privileged and regulated data, at minimum annually for the rest, with reviewers who actually understand the data. Non-human identities - API keys, service principals, integration accounts, tokens - need owners and expiry dates just like people.
Worked example
An HR analyst transfers to marketing. Reasoning: the mover event is where excess privilege accumulates. If the HR entitlements stay, the employee retains access to salary data with no business need and creates a segregation-of-duties conflict. Actions: trigger from the HR system change event, revoke all HR roles before granting marketing roles, require manager re-approval, record the revocation evidence in the next certification cycle.
Traps that cost marks
Treating authentication as authorization - a valid login says nothing about entitlement. Shared or generic accounts that destroy attribution. Rubber-stamped access reviews where managers approve everything in minutes. Orphaned accounts belonging to leavers. Service accounts with permanent admin rights and no named owner.