Access Reviews in Oracle Access Governance - Certify Access Privileges with Campaigns and Event-Driven Micro Certifications

Access Reviews, also known as Access Certification or Access Attestation, is the process to evaluate and certify the access privileges granted to identities within an enterprise. It checks and certifies if privileges granted are still required and align with the current job at work. Use the Oracle Access Governance Access Reviews feature for reviewing the access privileges. Make swift and accurate review decisions by examining insights and AI-powered recommendations based on prescriptive analytics.

Enterprises have large distributed landscape across on-premises and cloud systems. To avoid excessive accumulation of irrelevant permissions, or unauthorized access to critical information, Access Reviews are run regularly to monitor and certify the accesses. These are vital for secure access management and compliance processes.

Related Topics

Key Benefits of performing Access Reviews with Oracle Access Governance

Access Reviews help enterprises to govern frequent access changes, reduce cost, manage identity access lifecycle, maintain compliance, and strengthen the security posture. Enterprises handle voluminous access changes on daily basis. Regular reviews can proactively detect and remove excessive permissions or irrelevant privileges.

Oracle Access Governance Access Reviews feature offers various types to review access privileges. For example, use Campaigns to launch a set of ad hoc or periodic access reviews, or use micro-certifications, which are based on event change, timeline change, or detection of an orphan account.

Access Reviews in Oracle Access Governance helps to:
  • Reduce cost by providing recommendations to remove non-essential and unwanted license or resources. For example, revoking application access for employees who no longer need it.
  • Strengthen security posture of an enterprise by regularly reviewing accesses, ensuring that right resources have been granted just enough accesses for their role. For example, Oracle Access Governance performs automatic micro-certifications to detect event changes (location change, department change), timeline changes, or detect orphaned accounts that pose a security threat.
  • Meet governance compliance and requirements by maintaining periodic access review audit reports. For example, ensuring compliance with industry regulations and compliance laws, such as GDPR, HIPAA, SOX, through regular access review campaigns.
  • Simplify decision-making by recommending AI/ML-driven access review insights, such as peer group analysis, outlier detection, or recommendation. For example, Oracle Access Governance gives recommendation to revoke a high-risk privilege for an identity based on prescriptive analytics.

Types of Access Reviews Offered by Oracle Access Governance

With Oracle Access Governance, you can run ad hoc or periodic Access reviews Campaigns over a set of identities, groups, accounts, roles, policies, and permissions. You can even run ownership reviews to verify resource ownership. Use near-real-time micro-certifications to run automatic reviews on specific components based on occurrence of an event change, timeline change, or unmatched accounts.

Access Review Campaigns: Ad hoc or Periodic Access Reviews

Use Campaigns to initiate periodic or ad hoc access review process. These are snapshot-based reviews, capturing all the relevant access information at a given point of time, and then assessing and generating access reviews tasks. Any change made to the data after the campaigns are setup won't be reflected in these reviews.

The access review types and selection criteria depend on Orchestrated System.

Identity Access Reviews

Identity access reviews refer to assessing access privileges for identities in your enterprise, where access to a specific resource is verified or validated. You can certify access for Workforce and Consumers identities by running the identity access reviews. Reviewers can accept or revoke the assigned privileges.

Define selection criteria based on:
  • Users (who has access?): Select a set of core and custom identity attributes.
  • Applications (what are they accessing?): Select services, applications, or cloud accounts.
  • Permissions (which permissions?): Select permissions that are assigned directly or permissions provisioned within Oracle Access Governance. You can use this criteria to quickly certify privileges for all Orchestrated systems based on the permissions ingested directly from the Managed System. These are also called "reconciled permissions." For more information on running reviews based on permissions, refer to Identity Access Reviews based on Permissions Assigned Directly in Managed Systems.

    Note:

    For the Oracle Access Governance system, you can run reviews based on permissions assigned directly (DIRECT) or Access Bundles granted through request from the Which Permissions? tile. Permissions or accounts provisioned through policy are not eligible in this review.
  • Roles (which roles?): Select roles provisioned to identities.
You can also define the approval workflow to select the number of review levels, review duration, and reviewer details. For more information on creating identity access reviews, refer to Create Identity Access Review Campaigns.

Example: You may run campaigns to evaluate and certify if junior associates or contractors in your organization have access to critical permissions or restricted information.

Identity Access Reviews based on Permissions Assigned Directly in Managed Systems

You can certify identity accesses by running identity access reviews on the permissions ingested directly from the Managed System. These are also called "reconciled permissions." Reconciled permissions refer to inherent permissions that are provisioned directly in the Managed systems without provisioning these from Oracle Access Governance. Run these reviews by selecting the Oracle Access Governance system from the Campaigns page.

Using insights and recommendations, reviewers can take action to accept or revoke these permissions. However, to manage your accesses at a granular level, use Access Bundles to provision the permissions.

When you select a set of permissions from the Which Permissions? tile, the system generates review tasks for all the eligible identities having access to these permissions either directly or through a request (Access Bundles).

Here's what's included in the review:
  • Identities with permissions granted directly with grant type DIRECT.
  • Identities with permissions granted as part of Access Bundles with grant type Request.
  • Identities with permissions granted through Roles with grant type Request.
  • Accounts of the identities that are provisioned directly or requested.

    Note:

    Permissions or accounts provisioned through policy, or Oracle Identity Governance (OIG) and Oracle Cloud Infrastructure (OCI) identity accounts are not covered in this review.

The components eligible for review vary based on the selected criteria. For more details, refer to the table in Eligible Orchestrated System Types to Launch Access Review Campaigns.

Things to Remember
  • Permissions assigned directly or Access Bundles granted through request are available for review in the Which Permissions? tile. The grant type must be Request or DIRECT for the permissions to be included in the reviews.
  • If directly assigned permissions are associated with an Access Bundle, which is then provisioned to identities through Request, then you will see only the Access Bundle and not individual permissions. For roles provisioned to identities through Request, it shows up as a role under the Which roles? tile.

    Example: If Read and Alter permissions are included in an Access Bundle and provisioned to identities via Request, you won't be able to view and review these particular permissions. You may choose to review the Access Bundle.

  • If an account contains permissions granted through policy, then no review task will be generated for that account.

    Example: If an account contains four permissions, two of which are granted via policy, the review of permissions won't generate the account review task.

Scenario

You want to run access reviews for the identities based on Read and Update database permissions. Let's consider the following scenario:
  • Alice has access to Read and Update permissions assigned directly.
  • Jane has access to these permissions as part of Access Bundle, with additional Write permission.
  • Betty being the database administrator has access to these permissions.
Here's what's included:
  • For Alice, selected permissions will be reviewed.
  • For Jane, Access Bundle will be reviewed with Read and Update and Write permissions only if Access Bundle is granted through Request.
  • For Betty, role will be reviewed only if the role is granted through Request.
  • Alice, Jane, and Betty identity accounts will be considered for review if the account or permissions associated with the account have not been provisioned using policy.

Reviewers can validate these access reviews from the My Access Reviews → Identity page following the process defined in Perform Access Reviews.

Remediation Actions

As part of the closed-loop access remediation process,
  • If a reviewer revokes the permission, it will be revoked from the Managed system.
  • If a permission is part of an Access Bundle granted to the identity, you won't be able to revoke that single permission unless you revoke an entire Access Bundle.
  • Accounts associated with permissions are not revoked if accounts contain permissions granted through policy.
  • Identity accounts are revoked only when all the permissions associated with accounts are revoked.

Policy Reviews

Review of Oracle Access Governance policies and OCI Identity and Access Management (IAM) policies to evaluate its effectiveness and compliance.

In Oracle Access Governance, you can create on-demand policy reviews, where you define the selection criteria to review policies. You can also define the approval workflow to select the number of review levels, review duration, and reviewer details. For more information, refer to Create Policy Review Campaigns and Types of Certification Tasks in Oracle Access Governance.

Example: You may run quarterly reviews on the defined network and storage policy of your tenancy to assess if these meet the principle of least privilege and applicable regulatory requirements.

Identity Collection Reviews

Membership review of a group to verify if only eligible set of members are assigned to a group. This is commonly known as "Group membership reviews."

You can create identity collection reviews for:
  • Identity collections created in Oracle Access Governance
  • OCI groups derived from Oracle Cloud Infrastructure (OCI)
Example: You can review if only eligible members are part of the Database Administrator group, managing and maintaining the database infrastructure for your project. An identity with the Sales Analyst role should not be associated with this group. For more information, refer to Create Identity Collection Review Campaigns and Types of Certification Tasks in Oracle Access Governance.

Resource Ownership Reviews

Review ownership of resources that created within Oracle Access Governance, either periodically or on an ad hoc basis. By performing this review, you can ensure accountability of resources lies only with the designated owners.

Currently, you can run ownership reviews for the following Oracle Access Governance resources:
  • Access Bundle
  • Approval Workflows
  • Identity Collections
  • Orchestrated systems
  • Policies
  • Roles

Based on the approval workflow selected, the primary owner of a resource or any active workforce Oracle Access Governance identity will be considered for review. Reviewers can certify or change ownership of resources while performing reviews. For more information, refer to Create Ownership Reviews, and Resource Ownership Review Task.

Event-Based Micro-Certifications

Use Event-Based Setup to configure automated micro-certifications, triggered only when there are changes in the system of record, occurrence of an important date or time milestone, or detection of an orphan account. These are near real-time reviews and Oracle Access Governance continuously monitors profile changes to launch access reviews.

  • Change event: Triggered by changes made in the identity profile, whenever an identity attribute is updated in the record system. These can be Core or Custom attributes.
  • Timeline event: Triggered on the occurrence of a particular date, such as the work anniversary date of an employee to perform access review.
  • Unmatched event: Triggered when an onboarded account doesn’t match any identity within Oracle Access Governance.

Eligible Orchestrated System Types to Launch Access Review Campaigns

The type of access reviews and what you can review in Oracle Access Governance depends on the system type chosen while running reviews.

Oracle Identity Governance (OIG)

Select this system to certify access rights of an OIG identity by reviewing their application access, granted roles or entitlements. You cannot combine review for a specific permission (entitlement) and role in a single campaign.

Oracle Cloud Infrastructure (OCI)

  • Select this to certify :
    • Identity access rights by reviewing their application access, granted roles or permissions.
    • OCI IAM policies that evaluates construct and functioning of a policy.
    • Group Memberships which evaluates that only eligible members have access to the group.

Oracle Access Governance

Select this system to run access reviews or run resource ownership reviews. In the Oracle Access Governance system, you can run identity access reviews for all the Orchestrated systems other than OIG and OCI, such as Oracle Database, Flat File, Microsoft Active Directory, and so on.
  • Review Access: Select this to run identity access reviews, policy reviews, and identity collection reviews.
    • Identity Access Review: Run identity access reviews for all the orchestrated systems using the Oracle Access Governance system. You can run these reviews based on core or custom identity attributes, applications they have access to, permissions granted from the Managed System, permissions provisioned within Oracle Access Governance as part of the Access Bundle, or roles granted to identities. For more information on running identity access reviews, refer to Identity Access Reviews.
      The components eligible for review vary based on the selected criteria, as follows:

      Table - Identity Access Review Selection Criteria for Oracle Access Governance System

      Selection Criteria Eligible Components in Review
      Who has access? to select identity attributes
      • Permissions
      • Access Bundles
      • Roles
      • Accounts
      What are they accessing? to access applications
      • Permissions
      • Access Bundles
      • Roles
      • Accounts
      Which permissions? to select Access Bundles (REQUEST)
      • Access Bundle
      • Roles
      • Accounts
      Which permissions? to select Permissions (DIRECT)
      • Permissions
      • Access Bundles
      • Roles
      • Accounts

      Note:

      If the account associated with the permissions is also included to give access through an Oracle Access Governance policy, then the account review tasks will not be generated.
      Which roles? to select Roles (REQUEST) Roles
    • Policy Reviews: Run Oracle Access Governance policy reviews to evaluate policy effectiveness.
    • Identity Collection Reviews: Run membership review of a group to verify if only authorized set of members are assigned to a group. This is commonly known as "Group membership reviews." You can run reviews for identity collections created in Oracle Access Governance.
  • Review Ownership: You can verify if only authorized owners are managing resources by running ownership reviews. For example, you may run ownership reviews to verify if only designated and authorized owners are managing the Approval workflows.

Usage Examples: Certifying Access Privileges with Access Review Campaigns and Event-based Reviews

Let's see some of the scenarios where campaigns and automated access reviews are useful.

Example 1: Review Access Permissions for High-Profile Applications with Critical Functions

Scenario: To help your enterprise deter any harm against misuse of access rights for data sensitive applications, you need to schedule quarterly campaigns to certify access to critical functions, such as update and terminate permissions.

To do so, first select the system, then apply filters to select data sensitive applications using the What are they accessing? tile. Select appropriate permissions using Which permissions?. Complete the campaign steps to assign appropriate workflow and campaign details. Post this, the review tasks will be generated that the reviewer can review on the My Access Review page.

Note:

You can either create a campaign to review permissions or review roles but both cannot be selected in a single campaign. In this example, Which roles? will be disabled along with Which policies? As we selected to review identity access, policy and identity collection review selection parameters will also be disabled.

Example 2: Review Policies for all Cloud Resources

Scenario: Your company updated their security protocols for data storage. As a cloud security administrator, you need to carry out on-demand access reviews of all the IAM policies available in your cloud account to ensure that it meets the latest security standards and regulations.

To do so, first select the system, add selection criteria to select cloud provider, cloud account, domain, or compartment. Complete the campaign steps to assign appropriate workflow and campaign details. In this example, the campaign reviewer can review all the applicable review tasks on the My Access Reviews → Access Control tab, with type Policy.

Example 3: Group Membership Reviews for Project Groups

Scenario: As a project manager, carry out quarterly group membership review for your team to ensure only current team members have access to code repositories and access to required third-party applications. This process will help you to remove any unauthorized access as well as monitor and control project cost.

To do so, first select the OCI system, add selection criteria to select OCI groups, add an approval workflow along with campaign details. In this example, the campaign reviewer can review all the applicable review tasks on the My Access Reviews → Access Control tab, with type Identity Collection.

Example 4: Enabling Automated Access Reviews for Employees Triggered by a Change Event

Scenario: As a business owner, you need to set up automated access reviews to perform micro-certifications whenever manager, job code, or location changes for an employee.

For this, enable event-based access reviews for job-code, manager, and location. Whenever the latest data synchronization happens from the orchestrated system with these updates, Oracle Access Governance will automatically raise multiple event-based access reviews associated with this single identity.