| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 4.56 MB | Adobe PDF |
Authors
Advisor(s)
Abstract(s)
A informação disponibilizada é um ativo importante no quotidiano das empresas, e como tal há que proteger essa informação de forma a dar o acesso somente às pessoas devidamente autorizadas. A informação tem de estar organizada e num formato adequando de forma a poder ser útil a quem vai utilizar. Infelizmente a rigidez da segurança com que os utilizadores se deparam para poderem aceder à informação quando chegam a determinadas empresas faz com que vários dias sejam desperdiçados até terem os acessos necessários atribuídos para poder trabalhar. Os controlos de acessos dos utilizadores da Natixis são complexos e necessitam de uma atenção especial. É utilizada uma ferramenta de “Self-Service” que permite aos utilizadores solicitarem os acessos. Dada a quantidade de utilizadores, este procedimento obriga a uma atenção permanente e um esforço de gestão elevado. A solução apropriada consiste em simular a implementação de uma arquitetura que visa facilitar a gestão dos acessos em várias perspetivas, nomeadamente na ótica dos utilizadores, das equipas de segurança, das equipas de controlos e em potenciais auditorias. Essa arquitetura deverá ser uma alternativa à atual, fazendo uma análise crítica da arquitetura atual de forma a verificar-se quais os pontos que podem ser explorados e melhorados. Os resultados obtidos na implementação da nova arquitetura permitiriam à Natixis reduzir significativamente o número de acessos disponibilizados aos utilizadores, facilitando os processos relacionados com o pedido de acessos e a sua manutenção. Infelizmente devido ao momento que estamos a passar devido ao COVID 19, a implementação foi somente feita no ambiente de testes, não podendo tirar valores conclusivos sobre a possibilidade de implementar esta arquitetura no ambiente de produção, que é o ambiente utilizado pelos utilizadores finais da Natixis. Contudo será possível que as equipas envolvidas no processo e que tenham acesso ao ambiente de testes possam expor as suas conclusões relativamente à solução apresentada.
The information provided is an important asset in the daily lives of companies, and as such, it is necessary to protect that information to give access only to duly authorized persons. The information must be organized and in a suitable format to be useful to those who will use it. Unfortunately, the rigidity of security that users face to be able to access information when they arrive at certain companies means that several days are wasted until they have the necessary accesses assigned to be able to work. Access controls for Natixis users are complex and require special attention. A “Self-Service” tool is used that allows users to request access. Given the number of users, this procedure requires permanent attention and a high management effort. One of the possible solutions is to simulate the implementation of an architecture that aims to facilitate access management from various perspectives, namely from the perspective of users, security teams, control teams and potential audits. This architecture should be an alternative to the current one, making a critical analysis of the current architecture to verify which points can be explored and improved. The results obtained in the implementation of the new architecture would allow Natixis to significantly reduce the number of accesses made available to users, facilitating the processes related to the access request and its maintenance. Unfortunately due to the moment we are going through due to COVID 19, the implementation was only made in the testing environment, and it cannot draw conclusive values about the possibility of implementing this architecture in the production environment, which is the environment used by Natixis end users. However, it will be possible for the teams involved in the process and who have access to the testing environment to be able to present their conclusions regarding the solution presented.
The information provided is an important asset in the daily lives of companies, and as such, it is necessary to protect that information to give access only to duly authorized persons. The information must be organized and in a suitable format to be useful to those who will use it. Unfortunately, the rigidity of security that users face to be able to access information when they arrive at certain companies means that several days are wasted until they have the necessary accesses assigned to be able to work. Access controls for Natixis users are complex and require special attention. A “Self-Service” tool is used that allows users to request access. Given the number of users, this procedure requires permanent attention and a high management effort. One of the possible solutions is to simulate the implementation of an architecture that aims to facilitate access management from various perspectives, namely from the perspective of users, security teams, control teams and potential audits. This architecture should be an alternative to the current one, making a critical analysis of the current architecture to verify which points can be explored and improved. The results obtained in the implementation of the new architecture would allow Natixis to significantly reduce the number of accesses made available to users, facilitating the processes related to the access request and its maintenance. Unfortunately due to the moment we are going through due to COVID 19, the implementation was only made in the testing environment, and it cannot draw conclusive values about the possibility of implementing this architecture in the production environment, which is the environment used by Natixis end users. However, it will be possible for the teams involved in the process and who have access to the testing environment to be able to present their conclusions regarding the solution presented.
Description
Keywords
Informação Segurança Controlo de acessos Self-Service Auditorias Information Security Access Controls Self-Service Audits