eAUDIT: Designing a generic tool to review entitlements

In a perfect world, identity and access management would be handled in a fully automated way. On their first day of work, new employees would receive all the required access to the systems they need in order to perform their job function. Over time, as their roles within the company evolved, these entitlements would be automatically adjusted. Unfortunately, we do not live in a perfect world. Access to systems is often cumulative, with employees keeping access they no longer require. This in turn poses a risk to the enterprise: unneeded access can lead to abuses and increases the possibility of data leakage if an employee is social engineered. This paper proposes a system to help address this problem: eAUDIT is a custom-built, generic entitlement review system that can simplify the task of reviewing user entitlements. eAUDIT is well suited to cases where no such tool exists in an enterprise, but can also complement an identity management system that does not fully cover all systems and applications. This paper covers the design of eAUDIT as well as an overview of its implementation, including sample code.