Welcome to another segment in our Breakaway Technologies Thought Leadership Series. This series is dedicated to expertise sharing around the analytics ecosystem as well as the evolution into best practices. This installment will focus on user access monitoring.
One common question emerges when meeting with our customers’ internal and external auditors:
“What process is used to track end-user system access?”
In this month’s article, we will focus on User Access Monitoring. Preemptive measures are taken in advance and throughout your company’s financial analytics project and usage, that will support a smooth internal audit and prepare your company for an external audit if required.
Above all, audit controls and effective security safeguards are part of normal operational management processes to mitigate, control, and minimize risks that can negatively impact business operations and expose sensitive data.
Regular operational, process and security audits help to ensure that proper controls are sufficient and effective at providing information confidentiality, protecting, ensuring system availability, and fostering a higher degree of data integrity.
Monitoring Schedules
The security user access monitoring activities should be performed on a quarterly basis throughout the year. User access monitoring activities occur during the first week of the quarter for the previous reporting period. This is to ensure the reports are generated as close to the end of the reporting period as possible. See the table below for a sample monitoring schedule:
System Query Generation
Identifying the current list of teams, users, and data access profiles within a system serves as the data required to compare against prior periods. Extracting this list, depending on the system type can be cumbersome. Where possible, automation should be put into place to extract user access levels. This can be accomplished, for example, by developing Microsoft Power Scripts to extract the data and scheduling those scripts to run on a regular basis to post the results to a file stored on a server.
Additions, Removals, Changes
Part of the monitoring process should include providing a separate list of users that were added to the system, removed from the system, and changed within the system.
Included in this list of changes, companies will be required to show internal communication and approval processes that management follows to document requested changes. This process may simply be an email chain or perhaps third-party software that supports integration into workflow tools or tracks Change Management activities.
Following controls that were put into place will help with anomaly detection by identifying potential threats or issues.
As our customers continue to evolve, Breakaway’s strategies complement the short and long-term goals of companies worldwide.
Please contact us if your organization needs assistance providing the framework for auditor documentation and controls.
You will appreciate our experience, focus, and commitment to your success.
About the Author
Phil Dzubinski is a Sr. Manager on our Consulting Services team and has over 20 years of professional experience developing enterprise data warehousing, business intelligence, and analytics solutions. His focus areas include thought leadership, project management, developing strategic solutions, and compliance.