Do we need HelloID if we manage our own AD environment?
Yes. While many now use their own AD environment for the original IAM functionalities – Authentication & Authorisation – what is often missing is a comprehensive management solution for promptly providing the correct rights automatically to hundreds of users and dozens of applications in a large organisation. HelloID addresses this need. AD provides the technical implementation of Authentication and Authorisation, while HelloID manages further integration and management. Moreover, our flexible Access Management module, which includes extensive Single Sign-On functionality and Multi-Factor Authentication, often provides necessary solutions during migration and merger projects. It is also not always necessary for all user groups to utilise extensive – and therefore more expensive – MS licenses. For them, the HelloID SSO and MFA Access Management functionality, coupled with a relatively inexpensive E1 license, often suffices.
Does HelloID support my security and privacy awareness initiatives?
Certainly, employee awareness is a vital part of information security. With automated processes for onboarding, transitioning and offboarding, along with our robust RBAC framework, we primarily focus on ensuring alignment with the ‘least privilege’ principle. This way, we prevent employees from accessing data they don’t need to perform their tasks. Nevertheless, if desired by clients, we can also add such ‘awareness measures’. For example, we can incorporate business rules in HelloID that require people to explicitly accept the organisation’s privacy guidelines before their access rights are activated. Pending acceptance, they may, for instance, only have access to email and standard applications. Additionally, for supplementary requests, the online approval process can explicitly check whether the requester meets specific (training) requirements.
How does the RBAC framework support the 'least privilege' requirement?
Within the Role-Based Access Control (RBAC) framework, the access rights for each role are clearly defined, ensuring that individuals only have ‘need to know’ access. Should someone’s role change in the HR system, HelloID automatically checks which rights are no longer applicable, and these are revoked accordingly. Similarly, it checks for new access rights needed for the new role and grants them automatically. This method prevents the unwanted accumulation of access rights, which can occur with manual rights management.
How do you organise access security during a reorganisation?
For this purpose, the RBAC framework is ideal. With RBAC, we manage all roles and their associated access rights in one central location. During a reorganisation, numerous changes can be implemented which, from an RBAC perspective, essentially boils down to adding roles and altering the access rights linked to roles. By first creating new roles and rights in HelloID and then associating employees with new roles in the HR system, we migrate to the new structure in a controlled manner, while ensuring everyone maintains access to their applications and data.
Can an organisation-wide RBAC framework be applied?
No, generally, that is not practical. In many organisations, we can create a complete RBAC profile for certain key roles, encompassing all the necessary access rights. These often pertain to well-defined roles. However, individuals may have multiple roles, and there are also less concretely defined functions within, for example, supporting departments. For such employees, we grant basic access rights through the RBAC model. Additional access rights need to be requested through the service process. With HelloID, we can also automate such request processes. To prevent the granting of unnecessary rights, we can set up specific permission flows where relevant managers must review/approve the request online. This ensures role separation is maintained, and we can also configure such rights to be granted on a temporary basis only, thus avoiding the unwanted accumulation of rights.
