Using Directory-as-a-Service for Compliance

Written by Rajat Bhargava on March 29, 2016

Share This Article

Most organizations today are subject to some level of compliance – whether they know it or not. This could take the form of governmental statutes (have Massachusetts and California companies heard of their state-level data protection standards?) or could be driven by industry consortiums such as the Payment Card Industry (ostensibly Visa and Mastercard). Other times, vendors providing goods or services to corporations end up being subject to their customer’s security requirements. This often happens when working with large enterprises.

Core of Compliance – Access Control

The theory with compliance is that by enforcing rigorous standards there will be fewer instances of security breaches. While that is up for debate, IT organizations are not off the hook, and often end up scrambling to implement and keep up with security regulations. The core of compliance is controlling who has access to confidential data. Unfortunately, as IT admins are well aware, controlling access to confidential data is a complex process and typically requires a large number of other security programs to ensure that only those people allowed access are the ones doing the accessing!

One Control Center – Directory-as-a-Service

A Directory-as-a-Service application is hugely beneficial for this purpose. DaaS simplifies the process altogether by acting as the core user management control center in organizations, replacing many disparate applications, and as such, becomes a key part of the compliance program.

When it comes to the core of compliance – access control – there are three essential requirements. Let’s review each separately.

  1. Who has access – the first step is in ensuring that only the right people are accessing confidential information and systems. A large portion of this task isn’t even an online issue. Creating standards for who should have access is critical. Whether that is by job title or function, knowing who has access to confidential data, and why, is important to document. Any exceptions to the standards should be heavily documented or better yet, skipped. Once you have determined who should have access, then granting exclusive access to the confidential systems, applications, and data is rather straightforward. This can be done through a Directory-as-a-Service platform that has user management capabilities.
  2. How are they accessing – the next step in the program is in controlling how confidential systems are accessed. The goal here is to ensure that only the people that have been determined to have access are the ones accessing. Effectively, by creating stronger passwords, enforcing SSH key access, or adding multi-factor authentication, the likelihood that somebody other than those with access are entering the systems is reduced. While this does make it more difficult for users to access confidential systems, those extra steps help keep hackers out.
  3. Ensuring that only they are accessing – regulating bodies and auditors don’t just take your word for it that you have tight controls over who can access your confidential data and systems. They make you prove it. You’ll need to monitor all access to confidential systems to prove that only the right people are accessing your systems. Even with the right people, you’ll often need to prove what was done at the time the systems were accessed. This is an important step; a culmination of all of the work that you have done with tight controls.

Further Compliance Support

Directory-as-a-Service applications can be a significant accelerant towards compliance. DaaS platforms help implement the decisions that you make around who should access confidential systems and then help ensure that the access is limited to only those people through password complexity, key-based access, and multi-factor authentication. Further, your DaaS platform can track and log access to systems helping to provide required data to auditors.

If you would like to learn more about how to achieve compliance, drop us a note, or feel free to try JumpCloud’s Directory-as-a-Service for free to see how it can ease the efforts towards being compliant. Your first 10 users are free forever.

Rajat Bhargava

Rajat Bhargava is co-founder and CEO of JumpCloud, the first Directory-as-a-Service (DaaS). JumpCloud securely connects and manages employees, their devices and IT applications. An MIT graduate with two decades of experience in industries including cloud, security, networking and IT, Rajat is an eight-time entrepreneur with five exits including two IPOs, three trade sales and three companies still private.

Continue Learning with our Newsletter