1. Planning.

• Assessment - Begin by determining which users require access, what specific resources they need, and why they need it. Document the current permissions and assess if they can be reduced or eliminated. Consider using an entitlement discovery tool for better visibility.
• Policy creation - Develop defined protocols for both granting and revoking access. Include guidelines on who can request access, why, and for what duration. Particularly for elevated roles, establish time-bound parameters.
• Source of truth - Synchronize your JIT access system with an Identity Provider such as Okta, Google Workspace, Azure AD, or OneLogin. These act as your final authority for identities. By descalating unique identities rather than shared accounts, you’ll be able to better manage authorization controls and audit accuracy.

2. Execution.

• Self-serve access requests
  Make the process more straightforward with users directly requesting access via the system and not through personnel. Boost adoption rates by integrating with IM platforms such as Slack or MS Teams. Ensure requests outline who is requesting, the service/resource/role they require, duration and the reason.

• Approval process
  JIT access is an opportunity for businesses to give approval rights to those with suitable knowledge of the operational requirements. Resource owners and business unit managers often have better knowledge than IT helpdesks, for instance.

• Conditional approval workflows - Incorporate your pre-established policies into workflows that govern access permissions. One effective way is by the assignment of if-then clauses, allowing for clear conditions of access.

• Integrations
  Integrate JIT Access with other IT and security systems for more flexibility. Link it to IT ticketing systems for automated access based on ticket status and with data classification systems to adjust policies due to data sensitivity. Collaborate with-on-call schedule software to create automated approvals during emergencies and training systems to allow access based on training completion.
• Automated provisioning and deprovisioning
  Understand Segment well to efficiently grant and revoke fine-grained access within the service automatically. This is essential for JIT Access as it reduces dependence on people, enabling automated deprovisioning of access. Ideally, manage all permissions collectively, without needing to build or manage an environment for each application.
• Access methods
  For JIT Access to Segment, APIs are optimal due to their accessibility and real-time capabilities. However, a mix may be needed, such as using SAML for authentication, SCIM for user provisioning, and APIs for fine-grained access control decisions.

3. Maintenance.

• Regular audits
  Regularly inspect access logs to ensure JIT access is working as expected. Look for any unusual patterns or behaviors and implement an automatic user access review process to accelerate evidence gathering and delegate reviewers.
• User training
  Train users, especially those with special permissions, on the JIT Access’s importance, its workings, and how to request access as needed.
• Feedback loop
  Continuously review your JIT access procedures and seek user and IT staff feedback to understand where enhancements can be made.

Following this method, you can effectively implement a robust JIT Access system for Segment.