Revocation (Process - IAM)

Revocation Automation

1.0 Ready for peer review

IAM

• Process Automation (IAM Goal) +++

• Productivity Gains (IAM Goal) +++

• Compliance Assurance (IAM Goal) ++

• Information Security Resilience (IAM Goal) ++

• Establish Trust between Parties (IAM Goal) ++

Streamlined revocation

• Revocation triggers (cf.Revocation (Process - IAM))

• Design, implement, monitor and maintain revocation automation mechanisms

• Automatically invalidate (e.g. by deactivation, cancellation or removal) IAM artifacts (i.e. identity, principal, credential, authorization) in compliance with and within the delays set by policies

• Implement and optimize account lockout policies

• Keep audit logs in compliance with policies

• Manage the risk of automation failure

• Optimize / extend the scope and reliability of revocation automation

• Revoked IAM artifacts (i.e. identities, principals, credentials, authorizations)

• Audit logs

• Revocation automation mechanisms

• Automation failure alerts

• Enforced account lockout policies

• OM-IND-0011: Revocation Automation Level (Indicator - IAM)

• OM-IND-0010: Revocation Automation Ratio (Indicator - IAM)

In order to adopt a risk-based approach, organizations may define in their policies a mandatory scope and a discretionary scope for revocation automation. For instance, the mandatory scope may comprise sensitive systems, internet-facing systems, systems accessed by external partners, etc. Automation would be deployed in the discretionary scope on a best-effort basis.

See Revocation (Process - IAM) for general revocation scope dimensions.

• Augment the security attack surface with insecure automation mechanisms

• Automation failure without an effective “plan b”

• Silent automation errors leading to a false sense of security

See Revocation (Process - IAM) for general revocation risks.

• https://open-measure.atlassian.net/wiki/spaces/QUOT/pages/67568855

• Account Lockout Policy (Dictionary Entry)

• Revocation (Dictionary Entry)