1. Planning.

• Assessment
  Start by identifying the individual needs of those requiring access, the specific resources they will need, and the justification for this access. Catalogue any currently existing access permissions to see if they can be either minimized or removed entirely. Consider utilizing a tool designed specifically for entitlement discovery to provide better transparency.
• Policy formulation
  Develop precise policies concerning not just providing access, but also removing it. These policies should specify the criteria for who is eligible to request access, the circumstances under which they can do so, and the time limits for this access. Particularly for roles with more authority, set boundaries based on a specific duration.
• Source of truth
  Establish your Airbase JIT series with an Identity Provider, which can be Okta, Google Workspace, Azure AD, or OneLogin. This will serve as the absolute authority on identities. By alternating individual identities over shared accounts, you will have more control over authorization and be able to more accurately audit access.

2. Execution.

• Self-serve access requests
  Make the process more streamlined by allowing users to request access through the platform, rather than through individual people. By integrating with IM platforms like Slack or MS Teams, you can increase adoption rates. Ensure all requests provide details about who is asking, the needed service/resource/role, duration of access, and the reason for it.

• Approval process
  JIT access presents a chance for companies to delegate approval to those with business context. People such as resource owners and business unit managers often have more appropriate context than IT helpdesks. Using messaging platforms can speed up the response time and provide all necessary information for informed decision making.

• Conditional approval workflows
  Build your predefined policies into workflows that dictate access permissions. Incorporate them into workflows that control who can receive what access and under what circumstances. A useful approach to this method is using if-then conditions (e.g., IF group “X” requests access to “Y”, then seek approval from “Z” and inform “M”).

• Integrations
  Reflect on incorporating JITA with other IT and security systems to acquire added flexibility, such as integrating with IT ticketing systems for automatic access provision based on ticket status. Associate with data classification systems to modify policies according to data sensitivity. Ideally, you should label resources and collect them together for easier handling. Collaborate with on-call scheduling platforms for automated approval during urgent situations. Utilize training systems to grant access once a user finishes their training.
• Automated provisioning and depovisioning
  Having a comprehensive understanding of Airbase is crucial in effectively extending and retracting access, granting high-granularity automatically within the service. This is essential for JIT access in minimizing the reliance on the availability of people, and allowing for access depovisioning automation, which lies at the heart of JIT access and the principle of least privilege access (POLP). Ideally, permission management should take place in one single location, avoiding the need to create or manage an environment for each application present in your organization.
• Access methods
  When it comes to Airbase JIT Access, APIs hold the highest preference because of their versatility and instantaneous capabilities. However, it may be necessary to use a range of access methods, such as SAML for authentication, SCIM for user provisioning, and APIs for precise access control decisions.

3. Maintenance.

• Regular audits
  Frequently review access logs to verify the JIT access is operating as originally designed. Watch out for uncharacteristic patterns or behavior either directly or by feeding the logs into your SIEM. Automate the review process for user access to hasten evidence assembly, designate reviewers, and confirm your system aligns with relevant industry regulations or standards.
• User training
  Make sure to educate users especially those with high privileges - about the importance of minimal privilege, JIT Access and its functionalities. Everyone must understand how to request access when needed.
• Feedback loop
  Regularly review your JIT access procedures. Obtain user and IT staff feedback to identify areas that could use improvement.

By following this structured approach, you could effectively set up a robust Just-in-Time Access system for Airbase.