Process for removing stale users, accounts and entitlements from a networked computer environment

摘要

A method for collecting, presenting to stake-holders, reviewing and cleansing data about users and their entitlements in a networked computer environment, called access certification, is presented. This method begins with automated prompts sent to stake-holders, such as managers or application owners, asking them to review a list of their subordinates or users. Stake-holders are required to either certify or mark for later deletion each user. Next, stake-holders review the detailed security entitlements of each subordinate or user, again either certifying or flagging for deletion each item. Finally, stake-holders are asked to provide an electronic signature, indicating completion of their review process. To motivate stake-holder completion of the process, and to roll-up results across an organization, stake-holders are prevented from completing the signature step until all subordinate stake-holders have likewise completed. The present invention provides a feasible method for identifying and eliminating user accounts that are either no longer needed by their owners, or belong to owners who are no longer legitimate users of an organization's computer systems. The same method is used to identify and eliminate entitlements assigned to users who no longer need them. Removal of such stale, obsolete or incorrect users, login accounts, user objects, group memberships and security, entitlements is essential in order to reduce the security exposure (attack surface) posed by excessive privileges and unused accounts, and to comply with government and other regulations stipulating effective internal controls, especially over financial data, and computer security best practices.