1. Planning.

• Assessment
  Start by determining which users require access to Figma, the resources they require and the reasons. Review existing access rights to see if they can be streamlined or entirely removed. Consider using an entitlement discovery tool for better visibility.
• Policy Creation
  Develop clear policies for both granting and revoking access. Include guidelines on who can request access, under what conditions, and for how long. Especially for privileged roles, enforce time-bound parameters.
• Identity Sourcing
  Integrate your Just-in-Time (JIT) access system with an Identity Provider (e.g., Okta, Google Workspace, Azure AD, OneLogin). This will serve as the primary source for identities. Preferring individual identities over shared accounts allows for improved authorization control and audit accuracy.

2. Execution.

• Self-serve Access Requests
  Streamline the process by enabling users to request access through the system rather than through people. Boost adoption rates by integrating with IM platforms like Slack or MS Teams. Ensure requests specify the user requesting, the required service/resource/role, duration, and reason.

• Approval Process
  Providing JIT access allows organizations to delegate approvals to people who understand the business context. Resource owners and business managers often have a better context than IT helpdesks. Use messaging platforms for swift responses and providing approvers with all necessary information for informed decision-making.

• Conditional Approval Workflows
  Incorporate pre-designed policies into automatic workflows that determine access permissions. Integrate them into workflows that control who can access what, and under what conditions. Effective application can be achieved by setting if-then conditions.

• Integrations
  Consider implementing JIT access with other IT and security systems for added flexibility. Link it to IT ticketing systems for automated access based on ticket status. Integrate with data classification systems to modify policies based on data sensitivity.
• Automate provisioning and deprovisioning
  Properly understanding Figma is essential for effectively granting and revoking access automatically. This reduces dependency on waiting for people to have the time, which is of significance for JIT Access and the principle of least privilege access (POLP).
• Access Methods
  ‍For Figma, APIs are preferable due to their flexibility and real-time capabilities; however, a combination might be required. For instance, using SAML for authentication, SCIM for user provisioning, and APIs for accurate access control decisions.

3. Maintenance.

• Regular Audits
  Regularly review access logs to ensure that JIT access is functioning as planned. Look for any anomalies or behaviors either directly or by feeding logs into your SIEM. You can automate user access review process to speed up evidence gathering, delegate reviewers, and ensure compliance with industrial regulations or standards.
• User Training
  Educate users, particularly those with privileged access, about the significance of least privilege, JIT Access, and how it functions. Make sure users know how to request access when necessary.
• Feedback loop
  Regularly review your JIT access procedures. Consult with users and IT personnel to determine where improvements could be made.

By executing this structured approach, you will efficiently implement a solid JIT Access system for Figma.