1. Planning.

• Assessment - Start by identifying who requires access to Fastly, what resources they need, and why they need them. Review and document existing access rights, and determine if they can be minimized or removed. You might find it helpful to use an entitlement discovery tool for better insight.
• Policy Creation - Develop clear policies for both granting and revoking access. These policies should include guidelines about who can request access, under what circumstances, and for how long. Especially in the case of individuals with privileged roles, it's essential to set parameters that are time-limited.
• Source of truth - Sync your JIT access system with an Identity Provider such as Okta, Google Workspace, Azure AD or OneLogin. This will serve as the authoritative source for identities. Prioritizing individual identities over shared accounts allows for enhanced authorization control and audit accuracy.

2. Execution.

• Self-serve access requests- Make the process more seamless by enabling users to request access through the system rather than through individuals. You can boost adoption rates by integrating with IM platforms like Slack or MS Teams. Access requests should detail who's asking, what service/resource/role they need, how long they need it, and why.

• Approval process - JIT access allows organizations to delegate approvals to those with the most relevant business knowledge, often being resource owners and business unit managers who have a better understanding than IT helpdesks. Use messaging platforms to facilitate speedy responses, providing approvers with all the necessary information to make informed decisions.

• Conditional approval workflows - Embed your preset policies into workflows which dictate access permissions. These policies can influence who is granted access, to what, and under what circumstances. One effective technique is to assign if-then conditions. If identity group “X” requests access to “Y”, approval should be sought from “Z” and “M” should be notified.

• Integrations - Consider integrating JIT access with other IT and security systems for added flexibility. Link with IT ticketing systems for automated access based on the ticket's status, data classification systems for policy adjustments based on data sensitivity and on-call scheduling software for emergency automated approvals. With in-depth understanding of Fastly, you can grant and revoke access in an automated, fine-grained manner within the service.

3. Maintenance.

• Regular Audits - Regularly review access logs to ensure that JIT access is functioning effectively. Look for any unusual patterns or behaviors, either by direct inspection or by feeding the logs into your SIEM.
• User Training - Make sure your users, especially those with privileged access, understand the importance of least privilege, JIT access and how it operates. Ensure users know how to request access when it's required.
• Feedback Loop - Regularly review your JIT access procedures and seek feedback from users and IT personnel to understand where improvements can be made. With this structured approach, you can implement an efficient and robust Just-in-Time Access system for Fastly.