Have you always wanted to be able to give a resounding answer to the question: who has access to what information, to when and why? Then read this blog about Identity Governance & Administration (IGA) now and prevent uninvited people from having access to your organization's crown jewels.

In this blog, we'll take you through the usefulness and necessity of controlling your identities and access management. We also explain why Identity Governance & Administration (IGA) for companies has grown into an essential link. Indeed, it is one of the most important pillars in the fight against data leaks and theft of personal data, but also saves time, money and ensures that you are well prepared for audits thanks to its automated processes.

Organizations are often complex. You are dealing with employees, suppliers, Cloud providers, but sometimes also with clients, volunteers and devices (Internet of Things sensors). They all need the right access and security, because privacy-sensitive data must be properly secured. This is exciting and presents challenges. Identity Governance & Administration helps ensure that a situation such as at the GGD in January 2021 came to light no longer occurs.

IGA 'in the news'

The GGD is frequently in the news during the corona pandemic, but not always positive. In January 2021, RTL News reported that millions of address details, telephone and social security numbers from the GGD's corona systems were being traded extensively. Tech journalist Daniël Verlaan came to this conclusion after a thorough investigation into the hidden parts of the internet (dark web). Here, thousands of data from Dutch people were offered for sale and it was even possible to have datasets delivered on request. This includes only people over sixty or people from the Utrecht region. The reason it was possible to access so much data was an incorrect authorization policy. Employees were able to access much more data and data than was necessary for their work.
Another well-known example is the example of policeman Orm. K. The Utrecht police mole passed on secret information to criminals for two years. According to the Public Prosecutor, he extracted information from the police system no less than 132 times in those two years. He managed to view this data at all times, even though he shouldn't have the right authorization for it at all. Unfortunately, these two examples are the rule rather than the exception.

What is Identity Governance & Administration?

The examples above make it seriously clear that improper access to information can lead to a data breach. 97% of IT managers say that risks from within the organization are a major problem (Egress 2020). Indeed, there are many examples where there is no intention involved, but personal data is leaked. In many cases, someone does not have the correct authorization. To prevent this, organizations are focusing on Identity Governance & Administration.

IGA is the business function that ensures that only the right people have access to the right digital assets (e.g. applications and data) at the right time and for the right reasons. This business function includes the following processes:

• Identity lifecycle management (Inflow, Flow and Outflow);
• Handling access requests;
• Role Management (RBAC);
• Access certification (periodic review of rights);
• Auditing.

Executing these processes entirely manually would mean a lot of work. That is why there are IGA systems on the market that support these processes. It enables organizations to have more control over authorizations and access control. It provides an efficient process for granting, monitoring and changing role-based access rights.

The benefits of IGA

IGA processes offer enormous benefits. Actually, as a complex organization, you can't live without it. First of all, IGA helps to secure important data. This includes, for example, patient data. Only the right employees can access the data that is important to their job. The organization also helps to be compliant and identify and address any pain points in the area of access rights. Indeed, IGA also ensures a clear inflow, flow and outflow process. But these are far from all the advantages. We have listed the most important five: Full transparency about risks and being able to take timely action.

• Full transparency about risks and the ability to take timely action;
• Prevent data leaks through proper authorization and access control;
• You stay compliant and comply with the GDPR and look forward to every audit with confidence;
• You control costs and prevent a fine from the AP;
• You are reliable and compliant with comprehensive dashboards and solid processes.

As you can see, an organization really can't live without an IGA policy anymore. Depending on the maturity level of your organization, you should think about this. But whether your organization has 500 or 50,000 employees, personal data must be secured. The damage to your organization's image if you don't have your access control in order is undoubtedly enormous and no one is waiting for a fine from the AP. The question is not whether you will protect your organization through IGA, but when.

IGA Webinar: Identities in Healthcare

After reading this blog, do you have questions about how to implement IGA for your organization? Or do you have another question? Then take contact join us or watch our webinar Identities in Healthcare: Dynamic, Open and Vulnerable, back. In this webinar, we spoke to three experts about the different Identities in healthcare.