1. Planning

• Assessment
  Begin by identifying team members who require access to Wrike, the resources needed, and reasons behind them. Document current access rights and see if it's possible to reduce or eliminate them. Consider using an entitlement discovery tool for a more clear view.
• Policy creation
  Establish explicit guidelines for granting and revoking access. These should include who can request access, under what circumstances, and for what period of time. Especially for high-level roles, set time-bound parameters.
• ‍Source of truth
  Coordinate your JIT access system with an Identity Provider like Okta, Google Workspace, Azure AD or OneLogin. This will serve as the definitive source for identities. De/escalating individual identities as opposed to shared accounts will provide better control over authorization and audit accuracy.

‍

2. Execution

• Self-serve access requests
  Make things easy by allowing users to request access through the system, instead of people. Improve adoption rates by integrating with IM platforms like Slack or MS Teams. Ensure requests contain who's asking, the necessary service/resource/role, duration, and reason.

• Approval process
  JIT access offers an opportunity for businesses to delegate approvals to those with business context. Resource owners and business unit managers often have a better understanding than IT helpdesks. Utilize messaging platforms for fast responses, providing all necessary information for the approver to make an informed decision.

• Conditional approval workflows
  Incorporate already-defined policies into workflows that manage access permissions. Assign them to workflows that govern who can access what, and under which conditions. This could involve assigning if-then conditions.

• Integrations
  Look into integrating Wrike JIT with other IT and security systems to add more flexibility. Sync with IT ticketing systems for automated access depending on ticket status. Link with data classification systems to modify policies based on data sensitivity.
• Automated provisioning and depovisioning
  Understand Wrike in depth to effectively grant and revoke access automatically within the platform. This is crucial for JIT Access as it reduces the reliance on individuals being available --automated deprovisioning is, in fact, at the heart of JIT access and the Principle of Least Privilege Access (POLP).
• Access methods
  For Wrike JIT Access, APIs are often the best choice because of their flexibility and real-time features. However, a mix might be needed. For instance, using SAML for authentication, SCIM for user provisioning, and APIs for exact access control decisions.

‍

3. Maintenance

• Regular audits
  Regularly review access logs to ensure that JIT access is properly functioning. Look for any unusual patterns or behaviors and feed the logs into your SIEM.
• User training
  Educate users, especially those with high-level access, regarding the importance of minimum privilege, JIT Access, and how it works. Ensure users understand how to request access when necessary.
• Feedback loop
  Consistently review your JIT access procedures. Get feedback from users and IT staff to see where improvements can be made.

Through this structured approach, you'll be able to efficiently implement a robust Just-in-Time Access system for Wrike.