A framework for managing and controlling access rights for Non-Human Identities (NHIs) within an organization.
Description
Access Governance refers to the policies, processes, and technologies used to ensure that Non-Human Identities (NHIs), such as applications, devices, bots, and automated systems, have appropriate access to organizational resources. As NHIs increasingly operate within digital environments, ensuring they have the right level of access while minimizing security risks becomes paramount. This governance framework involves defining access rights, monitoring access activities, and implementing controls to prevent unauthorized access. It also encompasses compliance with regulatory requirements and internal policies to safeguard sensitive data. Effective Access Governance helps organizations maintain a secure and efficient operational environment, as it allows for the systematic review and adjustment of access permissions based on the evolving needs of the business and the threat landscape. As NHIs can perform actions at scale and speed, maintaining oversight and control over their access privileges is crucial for mitigating risks and ensuring accountability.
Examples
- A cloud application that requires API keys for automated data retrieval and processing.
- An IoT device that collects data and needs to access a secure database for storage.
Additional Information
- Access Governance helps in identifying and mitigating risks associated with NHIs.
- It supports compliance with data protection regulations by ensuring only authorized NHIs access sensitive information.
References
- Human vs. Non-Human Identity in SaaS
- Non-human Account Management (v4)
- Non Human Identity Management | OASIS Security
- Managing Non-Human Identities for Vendor Access and Least Privilege Application Management Managing Non-Human Identities for Vendor Access and Least Privilege Application Management
- Articles
- HUMAN RIGHTS IMPACT ASSESSMENTS FOR AI: ANALYSIS AND RECOMMENDATIONS
- Who owns your identity? - Junis Alico - Medium
- A mixed-methods protocol to develop and validate a stewardship maturity matrix for human genomic data in the cloud
- Governance & Lifecycle - RSA
- Four lessons on guardianship with Self-Sovereign Identity; March 2020 | TNO