1. Planning.

• Assessment
  Start by identifying users needing access, necessary resources, and the purpose behind it. Take stock of existing access privileges and determine if they could be minimized or eradicated. A discovery tool for entitlement might prove beneficial for improving visibility.
• Policy Definition
  Establish clear policies about granting and withdrawing access. Add guidelines on who is authorized to ask for access, under what circumstances, and for how long. Particularly for roles with higher privileges, set time-bound restrictions.
• Source of Verification
  Synchronize your JIT access system with an Identity Provider (such as Okta, Google Workspace, Azure AD, OneLogin) to serve as your central source of identity. Opting for separate identities over shared accounts will enhance your authorization control and improve the accuracy of audits.

2. Execution.

• Self-Service Access Requests
  Simplify procedures by having users request access via the system itself, instead of people. Encourage user adoption by integrating with IM platforms like Slack or MS Teams. Ensure requests outline who is asking, the required service/resource/role, duration, and reason.

• Approval Routine
  JIT access presents an opportunity for organizations to delegate approvals to individuals with business context knowledge. Resource owners and business unit managers often have superior context than IT helpdesks. Leverage messaging platforms for prompt responses, providing approvers with all necessary information for accurately informed decisions.

• Conditional Approval Workflows
  Integrate predefined policies into workflows that regulate access permissions, dictating who can access which resources under what conditions. One effective way is by assigning if-then clauses. IF identity group X seeks access to Y, require approval from Z and notify M.

• Integrations
  Integrate JITA with other IT and security systems to enhance flexibility; couple it with IT ticketing systems for automated access based on ticket status. Link it with data classification systems to modify policies as per data sensitivity levels. Efficient tags for resources and bundling them can simplify this process. Collaborating with on-call schedule software through automated approvals during emergencies is recommended. Align with training systems to manage access based on training completion.
• Automated Provisioning and Deprovisioning
  Attain a comprehensive understanding of Beyond Identity to efficiently manage access either granted or revoked, which is essential for JIT Access. It reduces dependency on individuals' availability and provides automated deprovisioning of access, aligning with the principle of least privilege access (POLP). Ideally, managing all permissions in one place, rather than creating and managing separate environments for each application in your organization is recommended.
• Access Methods
  For Beyond Identity JIT Access, APIs are recommended for their adaptability and real-time feedback. However, a combination might be necessary - SAML for authentication, SCIM for user provisioning, and APIs for precise access control decisions.

3. Maintenance.

• Routine Audits
  Perform regular checks on access logs to confirm the JIT access is operating as intended. Look out for unusual patterns or behaviours, which can be directly examined or processed through your SIEM. Automating the user access review process can speed up evidence gathering, delegate reviewers, and ensure compliance with industry regulations or standards.
• User Instructions
  Educate users, especially privileged ones, about least privilege, JIT Access, and its functioning. Make sure users know how to request access when necessary.
• Feedback Mechanism
  Regularly review your JIT access practices. Seek input from users and IT staff to understand potential areas of improvement.

Following this structured procedure, you can effectively implement a robust Just-in-Time Access system for Beyond Identity.