Ransomware, hacks – all around. One of the best practices encouraged is enforce the Principle of Least Privilege (PoLP) – NIST PR.AC-6. But how? Identity Audits and Identity Alerts. This is why YouAttest keeps expanding it line of identity audit features – to now include “State-in-Time” Audits. But what is “State-in-Time” and How Is It Used in a Change Review Audit?
One of the most powerful forces for any organization is its IT department, as they have immense responsibilities to mitigate threats that would otherwise cripple an organization’s operations. If it is not carefully maintained, IT systems could come crumbling down in disorganization and disfunction. IT professionals need to keep a watchful eye on the changes in the systems they are tasked with, or the system will fall into disrepair. To help keep track of these changes, the IT department will need to audit these systems looking to root out the problems and put in place proven plans to prevent them from happening in the future.
Whether an organization is looking to achieve SOC2 or ISO/IEC 27001 certifications or to maintain HIPAA compliance, IT systems need to be secured at all times from bad actors who may be trying to gain access to the system to exfiltrate sensitive documents. Data breaches are not acceptable in any organization, so audits need to occur frequently and as often as security certifications require, whether monthly, quarterly, bi-annually or annually. So, to track the changes in a system, a plan needs to be established to control them. The identities need to be reviewed and audited to make sure that it works as intended. This is where “State-in-Time” reports from YouAttest come in.
Image #1: YouAttest allows an enterprise to take a snap-shot of its identies and then constrast roles, users, groups at another “state-in-time”. This is a huge time saving on security and IT personnel for SOX and other audits. ( State-in-Time and How is it Used in a Change Review Audit )
State-in-Time and How is it Used in a Change Review Audit
A “State-in-Time” or simply put State-in-Time and How is it Used in a Change Review Audit report is set up to allow those working in the system to generate a snapshot of a specific moment in an audited environment. They are used to help track changes and activity in a system and provide updates on the system’s security.
What makes this so useful is its application into a Change Review Audit. As discussed earlier, unauthorized changes in a system are detrimental for an organization, so anything that involves a change in a system needs to be controlled. Any plan to implement security for the system needs thorough testing until proven to work because anything else is a significant risk to the organization. And, with “State-in-Time” reports, you can take the manual process of checking every change in your system for their effects and make it automated. With YouAttest, the process is simple.
All you need to do is set up a campaign to check the difference between the past “State-in-Time” report and the current state of the system and then review any change.
“I can see this saving enterprises weeks of time in internal auditing and facilitating evidence collection during an external audit,” says Stacey Cameron, CEO of QoS Consulting Solutions, “Finding the changes and then attesting to the changes of who did what is an expensive and time-consuming process for most enterprises. Why do something manually when you can leverage machine automation.”
Changes should always get reviewed whenever they happen because keeping control over the system lowers the risk of sensitive data being lost or unsecured. The IT department acts as the castle guards, and without them, anyone could get in.
–
YouAttest is a cloud-based IGA product which is licensed per user, per month and can be reached at sales@youattest.com, (877) 452-0496. Free trials available, register here.
Register for the “State-in-Time” YouAttest’s July 8th Webinar: Automate “Change Review” with YouAttest – featuring Stacey Cameron and Shanon Noonan of QoS Consulting Solutions
Please feel free to write back to in regards to State-in-Time and How is it Used in a Change Review Audit so we can add more to the article.
