1. Planning.

• Assessment
  Start with identifying the personnel requiring access, the necessary resources, and the reason behind it. Account for existing access privileges and evaluate whether they can be reduced or eliminated. Think about using an entitlement discovery tool for better sight.
• Policy Creation
  Establish distinct procedures for both granting and denying access. Lay down formal rules on who can request access, in what situations, and for how long. For roles with higher privileges, set time-limited restrictions.
• Source of Truth
  Synchronize your JIT access system with an Identity Provider such as Okta, Google Workspace, Azure AD, or OneLogin. This serves as the ultimate source for identities. Emphasizing individual identities over shared accounts can result in better access control and audit accuracy.

2. Execution.

• Self-service Access Requests
  Make things easier by allowing users to request access through the system, not through humans. Boost uptake rates by integrating with instant messaging platforms like Slack or MS Teams. Ensure requests provide details of the requester, the needed service/resource/role, the duration, and reason.

• Approval Process
  Implementing JIT access allows companies to delegate permissions to individuals who understand the business context better. Resource owners and business unit managers often have more context than IT helpdesks. Use instant messaging platforms for quick responses, providing approvers with all the necessary information for an informed decision.

• Conditional Approval Workflows
  Incorporate predetermined policies into workflows that control access permissions. Embed these into workflows that determine who can access what, and under certain conditions. One method is assigning if-then conditions. IF identity group “X” requests access to “Y”, get approval from “Z” and notify “M”.

• Integrations
  Consider linking JIT access with other IT and security systems for added flexibility. Integrate with IT ticketing systems for automatic access conditioned on ticket status. Link with data classification systems to modify policies based on data sensitivity. Ideally, resource tagging and bundling can streamline this process. Collaborate with on-call schedule software for approving during critical situations. Utilize training systems to grant access following training completion.
• Automated Provisioning and Deprovisioning
  Acquiring a good grasp of Funnel is crucial in effectively granting and retracting granular access automatically within the service. This is crucial for JIT Access as it minimizes waiting for humans to free up time. It enables automatic access retraction. Ideally, managing all permissions collectively, without needing to construct or operate an environment for every application in your organization.
• Access Methods
  For Funnel JIT Access, APIs are best due to their flexibility and timely capabilities. However, a mix may be necessary such as using SAML for authentication, SCIM for user provisioning, and APIs for detailed access control decisions.

3. Maintenance.

• Regular Audits
  Frequently review access logs to verify JIT access is functioning as planned. Search for any abnormal patterns or behaviors either directly or by routing the logs into your SIEM. You can also automate the user access review process to accelerate evidence collection, delegate reviewers, and guarantee system compliance with relevant industry regulations or standards.
• User Training
  Instruct users, particularly those with greater privileges, about the significance of least privilege, JIT Access and how it operates. Make sure users understand how to request access when necessary.
• Feedback Loop
  Maintain a regular review of your JIT access procedures. Get feedback from users and IT staff to comprehend where enhancements can be made.

By following this structured approach, you'll be able to effectively implement a robust Just-in-Time Access system for Funnel.