An IT administrator creates a new user account, gives it admin rights and then approves the access review for that same account. Every step is legitimate on its own. Together, they mean one person controls the whole chain, and nobody else ever looks at it. That can’t be right?
This is why Separation of Duties (SoD) matters. It’s an important principle when deciding which Identity Governance and Administration (IGA) approach works for your organization. SoD makes sure that no single person has enough access to carry out a high-risk action without someone else checking it. This not only lowers human error, it also minimizes the chance of security breaches.
SoD is an important matter for each modern organization. But the first step is understanding the level you need. And this depends on your security and compliance needs.
Which level of SoD fits your needs?
When it comes to IGA solutions, there is no one-size-fits-all. Making the right choice is important because identity sits right at the heart of your security strategy. While features are an important part of the decision, the level of control your organisation requires is just as critical.
When it comes to Separation of Duties (SoD), most IGA solutions fall into one of two categories.
1. Full-featured IGA: depth for complex environments
Full-featured IGA solutions let you define detailed policies across many roles, applications and systems. They suit organizations with complex workflows, several business units or strict regulatory requirements.
Their value lies in:
- Granular controls that go down to specific permissions, not just roles
- Automated enforcement, so measures are enforced across your entire organisation
- Real-time violation detection, so issues are flagged while they happen rather than in the next audit
- Scalability, so your SoD policies grow with your business
2. Light IGA: the essentials, done simply
Light IGA solutions focus on basic identity lifecycle management: onboarding, offboarding and access requests. They are usually simpler and therefore also cheaper to run.
The trade-off is depth of control. Light IGA often lacks the detailed SoD enforcement organizations with higher regulatory or compliance requirements need. For many environments, though, that’s fine.
If your governance needs are simple and you can manage SoD through manual processes or basic controls, a light solution may be all you really need.
How to decide which layer of SoD your organization needs?
There’s no universal answer. A mid-sized company with a handful of core applications has different needs from a financial institution that falls under DORA or NIS2. Ask yourself:
- How many critical applications and systems handle sensitive data or financial transactions?
- Do you know which combinations of access rights would create a conflict in your environment?
- How are SoD violations detected today: automatically, during periodic reviews, or not at all?
- Do regulations or auditors require you to demonstrate effective SoD controls?
- Do you expect your organization to change significantly in two or three years, through f.e. growth, acquisitions or new applications?
If most of your answers point to complexity, regulation or growth, manual access management will eventually become a bottleneck. If your environment is small and stable, a lighter approach may be sufficient for now. Just make sure you understand the trade-offs before you decide.
Many organizations start with spreadsheets, case-by-case approvals and yearly access reviews. That can work for a while. But as roles change, people move between teams and applications pile up, … manual SoD reaches its limits.
Conflicts go unnoticed and reviews turn into a box-ticking exercise. The controls you thought you had, stop reflecting reality. That’s the point where automation doesn’t just save time. It turns SoD from a periodic check into a control that runs all the time.
Put SoD on your RFP agenda
If you’re evaluating IGA vendors, give SoD the attention it deserves. Ask each vendor how their solution handles it. Not only on paper but in practice:
- How are SoD policies defined, and how granular can they get?
- Are violations detected and prevented automatically, or only reported?
- How does role-based access control support SoD across different systems?
- What compliance reporting is available for auditors?
Their answers will show quickly whether a solution can support your requirements, or whether you’ll outgrow it in a flick of time.
Start from your business needs, not the tool
The best IGA solution isn’t the one with the longest feature list. It’s the one that fits your business requirements, your risk profile and is in line with your future plans.
While ACEN sure has some partnerships, our approach is vendor-agnostic. That means our advice starts with looking and analyzing your organization. Our experts help you work out your requirements, map your risks and assess which IGA approach fits best.
