How to perform effective user access reviews

In this series, you’ll hear directly from Vanta’s own Security, Enterprise Engineering, and Privacy, Risk, & Compliance Teams to learn about the teams’ approaches to keeping the Vanta organization secure. We’ll also share some guidance for teams of all sizes — whether you’re just getting started or looking to uplevel your operations. 

‍

In this post, you’ll hear from Bart Tissue, Senior Systems Engineer on our Enterprise Engineering team, and Jess Chang, Staff Technical Program Manager on our Security team.

‍

Why access reviews matter 

In a nutshell, performing regular user access reviews help ensure that current employees have access to the right tools (and no more privileges than they need), offboarded users no longer have access, and anyone who’s transferred roles internally no longer has access to tools they don’t need. 

‍

User access risk scenarios

When conducting user access reviews, here are a few common scenarios you might encounter:

‍

• User leaves the company, but still retains access to apps and tools.
• User leaves the company and no longer has access, but retains a user license.
• User changes roles or teams internally and retains access to apps and tools that aren’t needed for their new role or team.
• User has elevated access (e.g. admin) that is not required for their existing role.

‍

These are specific risk scenarios that our Enterprise Engineering team looks for when performing our access reviews. We also structure this into our process so that system owners who own applications or infrastructure and are asked to review access on a periodic basis also understand how to identify and address access privileges in each of these cases.

‍

{{cta_withimage9="/cta-modules"}}

‍

Cadence of user access reviews

While the cadence of user access reviews may depend on a company’s risk profile, they’re typically conducted on a monthly or quarterly basis. 

‍

It’s important to maintain a calendar to mark and initiate your reviews — or ensure this cadence is reflected in any automated reminders and tooling you’re working within. At Vanta, we rely on an automated reminder within Vanta’s Access Reviews product as well as on our Enterprise Engineering team’s calendar to kick off our reviews.

‍

How Vanta performs user access reviews

At Vanta, our user access reviews are performed on a quarterly basis by our Enterprise Engineering team in partnership with our Security and Privacy, Risk, and Compliance teams. We maintain a playbook as our source of truth, with step-by-step instructions and a list of systems and applications in scope. 

‍

We start by reviewing the list of systems and applications in scope collectively and making any changes needed. For instance, we’ll add any new, high-risk applications that are in scope from a security or compliance perspective. We’ll also remove any tools that have been moved behind SSO since our last user access review and review our list of system owners to make sure it’s up-to-date. Since this list is maintained and used for future user access reviews, we make these changes directly in our playbook.

‍

Next, we’ll send out a reminder to system owners. This reminder provides them with an overview of their responsibilities for reviewing user access on a periodic basis, as well as steps and guidance for reviewing user access based on risk. We’ll also provide them with a list of offboarded users during the relevant time period to ensure these individuals no longer have access.

‍

For any systems that are owned by our Enterprise Engineering team, we manage these user access reviews ourselves. In addition to what we look for as reviewers, we also look for ways to eliminate manual processes, such as opportunities to move any outstanding tools behind SSO. If any systemic issues are uncovered, we also work with our partner teams to address these and reduce the likelihood of future occurrences. 

‍

Finally, we work with our system owners to ensure they’re able to complete the reviews within the timeline allocated. We help answer any questions they may have along the way and most importantly — thank them for thoroughly reviewing the systems and infrastructure in scope to help keep Vanta secure.

‍

How Vanta helps

In addition to the processes covered above, we use Access Reviews in Vanta to help manage our quarterly user access reviews. Using Access Reviews in Vanta has helped streamline our reviews by eliminating manual effort while integrating directly with relevant applications in scope.

‍

Some of Vanta’s Access Reviews features we particularly find useful include:

‍

• Centralized hub for access reviews alongside security monitoring.
• Sends out notifications to system owners and provides them with instructions.
• Automated and customized reminders for system owners.
• Ability to directly pull user lists for integrated apps, or to upload if needed.
• Keeps track of next access review with automated cadence and reminders.
• Automatically flags any offboarded user accounts that still have access. 

‍

{{cta_withimage6="/cta-modules"}}

‍

Tips for performing user access reviews

While every company may differ, here are some steps we’ve found to be helpful in performing periodic and effective user access reviews:

‍

• Maintain a playbook with step-by-step instructions for conducting the user access review and a definitive list of systems and infrastructure in scope. This ensures consistency and can be updated on an as-needed basis.
• Maintain a calendar or use a tool like Vanta to initiate regular user access reviews based on the cadence you’ve identified for your company or institution.
• Automate what you can by moving tools behind SSO to streamline the user login experience while also eliminating the manual need for removal during the offboarding process. 
• Always buffer in additional time before your reviews to prepare any tooling and internal resources needed. This ensures you’re ready to launch your user access reviews on-time.
• Partnerships are key — be sure to partner closely with your system owners and their teams, and ensure that their responsibilities as system owners are clear and captured. In addition, work with your Security and Compliance teams to ensure that the list of systems in scope is accurate and up-to-date.

‍