General IAM Flashcards
Access Provisioning
Review how access is provisioned in the application and decide if you are going to collect access as an app role or entitlement
Rules about Rules
Not all rules are good rules
You shouldn’t have a rule unless you plan to do something about violators
Access Review
Review access at the same level it is commonly provisioned and de-provisioned
Output of Access Recertification
A list of removals is the only output
Mining for roles
Works once access has been cleared up through reviews
What type of system is required when access is collected as a granular entitlement
the system requires a 2-part or pair of attributes… Resource and Action. It is assumed that you will have both of these fields in your source data and they are coupled together like:
Resource - Action
Group A – READ
Customer 123 - ADMIN
If you are collecting granular entitlements, which two fields must be populated in your collector?
The Resource and Action field. The entitlement displayed in a review will show a colon between the two
i.e. Customer BigMart : Update
With granular entitlements, if there is no action, what are two common population tricks
- Populate the action field with a “Y” or “Yes”
2. Collect the resource as an application role
What are additional uses of ACM?
Enforcing policies Licencing Monitoring Fraud investigation evidence App usage and reduction strategies Monitoring requests/Approval routines
Which attributes should we capture?
attributes that would help an access reviewer make solid keep/remove decisions
ones that help with sorting
access needed to restrict forms
How does ACM view active and inactive identities?
ACM doesn’t care if identities are active or terminated at the company, but whether they are being collected or filtered out.
How many distinct processes occur in ACM?
2 (Identity and Target collections) These processes run independently and the logic used in one does not impact the logic used in the other
Can logic or values from the IDC be used to filter, sort, or populate data in a target collector?
No - logic or values from the IDC cannot be used to filter, sort, or populate data in a target collector
What is the only required filed in the Account collectors?
Account ID/Name, all others are optional but desired
With Account collectors what benefit is gained from collecting the name, last login date, and type of account flag?
Name - assist in resolving orphan accounts
Last Login -helps reviewers with their maintain/revoke decision process
Account Flag - Can later filter out reviews or ensure certain types of accounts arent deleted
What are the 5 R’s and an F of Access Management?
Reviews, Requests, Roles, Reports, Rules, and Fulfillment
What is the impact of running an Aveksa review?
It depends on configured fulfillment method for the application where the revoke is selected.
If the app is set to auto-provisioning then a revoke will wipe it out.
How are terminated users handled?
Terminated users should be flagged as terminated. The SQL query can be set to skip older terminated users and not collet them. If an identity was collected yesterday and skipped today, it will be stamped with a last seen on date and becomes inactive. Inactive dont count against licensing
What is supplied in a Soft appliance configuration
RSA Aveksa supplies the RSA Aveksa software, JRE, and the JBOSS application server. The Oracle database may be supplied by RSA Aveksa or the customer based on the customer’s choosing. The customer is responsible for supplying the hardware, operating system, and optionally the VMware
What are the components that make up an ACM installation?
Aveksa software JDK 1.6.0 Oracle Database 11.2.0.3 App Server - JBOSS, Weblogic 11g, Websphere 7.0 Red Hat version 5
What are the 4 dimensions of data collected to represent user entitlement information and complete basic access recertifications
Identity Data
Account Data
Entitlement data
Managed Data
What is necessary to create a complete record for users in order to synch records properly
a common unique field such as user ID or email address
What does Account data represent
The specific accounts in each target system for which you want to collect entitlements and perform certifications.
What does Entitlement Data represent
All of the specific rights or access granted to each account within your target system. You want to capture all entitlements that grant access to a resource and can be added or removed form an account.
