In this lesson,
we will learn about access provision.
Access provision is the process
of granting or revoking access rights to resources
based on user roles and their associated permissions.
Access provision concepts include provisioning,
deprovisioning, self-provisioning,
and credential issuance.
Provisioning is assigning access rights and credentials
to users based on their roles.
Provisioning assignment may be automated
through self-provisioning systems
where users request access
and receive it upon administrator approval or automatically.
Deprovisioning involves removing access rights
when they are no longer needed,
such as when an employee leaves the organization.
Credential issuance is the process
of creating and distributing authentication credentials,
such as passwords or security tokens,
which can be used in user authentication.
Let's learn more about credential issuance,
provisioning, self-provisioning, and deprovisioning.
First, we have credential issuance.
Access provision involves several important steps
to manage who can access an organization's resources.
The first step is credential issuance.
Credential issuance includes both identity proofing
and generating authentication credentials.
Identity proofing ensures the user's identity is verified
before issuing credentials.
For example, when a new employee joins a company,
they might need to provide identification documents
or undergo background checks.
Once their identity is confirmed,
credentials can be generated,
including a username, password,
or multi-factor authentication token.
These credentials allow the user to authenticate
and access the company's systems securely.
Credentials can be issued in several straightforward ways.
After identity proofing,
the user may receive an email with a temporary password,
which they will need to change during their first login.
Or a new user might be sent a one-time link
that allows them to create their own password.
Multi-factor authentication may also be set up
at this stage.
For example, the user might need to configure
a mobile authentication app
or link a physical security token to their account.
In some cases,
biometric options such as fingerprint scans
are also added as part of the credential issuance process.
Second, we have provisioning.
Provisioning is the assignment of access rights
based on a user's role.
For example, a user in the marketing department
might be granted access to marketing tools and databases,
while a software engineer would receive access
to development environments.
Provisioning ensures that the right people
have access to the right resources
so they can perform their jobs.
Role-based access control systems
often handle this automatically,
assigning permissions based on predefined roles.
Third, we have self-provisioning.
Self-provisioning allows users
to request and gain initial access to systems
without direct involvement from IT administrators.
For example, when a new employee joins a company,
they may be provided with a self-service portal
where they can log in
and request access to the systems they need
based on their role.
They might request access
to the company's main human resources system
or communication tools.
Once their request is submitted,
it is reviewed and approved by an administrator
and a user is automatically granted access to those systems.
In some cases,
access requests can be automatically approved
based on predefined policies,
such as role-based access control rules.
This self-provisioning process speeds up onboarding
by allowing users to initiate access requests
while ensuring that the necessary approvals
and security checks are in place before granting access.
Fourth and last, we have deprovisioning.
Deprovisioning occurs when access is no longer needed.
For instance, when an employee leaves the company
or changes roles,
their access must be removed
to ensure they cannot access or continue to access
sensitive information or systems.
Deprovisioning is essential for security,
preventing unauthorized access after someone's role changes
or their employment ends.
This process can be automated
to quickly revoke access to all systems
and resources tied to the user's account
if the employee leaves the organization, changes roles,
or their contract expires.
So, remember, access provision is the process
of managing user access to resources
based on roles and permissions.
It includes credential issuance,
provisioning, self-provisioning, and deprovisioning.
Credential issuance involves verifying a user's identity
and creating authentication credentials for secure access.
Provisioning assigns access rights based on roles.
Self-provisioning allows users to request initial access
through automated systems.
And deprovisioning removes access
when it is no longer needed.