HR Pulse

The HR System as a basis for access control

Organisations typically secure access to physical locations using a badge or key, a task managed primarily by the administrator of the security management system. This administrator traditionally adds new users to the system and implements changes for existing users manually, like when they change departments or are hired on, a process very much out of date.

When administrators assign a newly hired employee access rights to physical locations in the security management system, they often simply copy the user account of a colleague in roughly the same function, a process known as “copy user.” As such, the new hire is often given access to the same physical applications as his or her coworkers, which is not always appropriate as new hires may be assigned access rights to locations that they do not need or should not be able to access.

Administrators also often fail to revoke access rights of employees when there is a change in employment status, a change in job title or a change in department, for example. Revoking excess physical rights is often an afterthought, too, and administrators can quickly lose sight of who has access to which physical locations and systems. As such, organisations must have an overview of which employees have physical and logical access to which locations and they may be required to present this overview to third-party auditors upon request.

The problem of standardisation of physical access rights is pressing, with seemingly little obvious solutions for the problem.

User lifecycle
Assigning access to employees is a part of a user’s work lifecycle. These steps begin when an employee (user) enters the organisation to changing job roles and, finally, leaving the organisation. Each step has consequences for the network access rights (logical access rights) for users, but also for their physical access rights. When an employee enters service, the correct access rights must be created. During the employee’s tenure, these rights must remain accurate, and, needless to say, all the issued access rights need to be revoked when the employee leaves the organisation. This prevents former employees from using their access badges to access information and locations that should no longer be available to them.

HR system as user lifecycle source system
The HR system is a perfect source system for managing the user lifecycle. A great deal of information is required to manage this lifecycle and it is readily available in HR. Ideally, this system is continuously kept up-to-date by the human resources department, including the name and address of the employee; the start and end dates of their labour contract; cost centre; job title; manager-employee relations; and department. By linking this information to the network and a security management system, it’s possible to use the HR system for managing logical and physical access rights. Access rights can then be assigned to existing employees or new hires in a fully automated way, using a metric defined as role-based access control (RBAC). One area where role-based access control is used very effectively is healthcare given the number of departments, employee classes and geographic locations of employees. Additionally, so much of the information hospitals generate is protected and secure and the consequence for breach is overwhelming.

How does the process become automated? User accounts and access rights of employees are created in Active Directory, an organisation’s information system, the helpdesk suite, the security management system and the e-learning system. Then the organisation uses an identity and access management (IAM) solution to streamline the process. When the HR department adds or modifies an employee record in the HR system, the IAM software performs all the required network actions; for a new hire, this means creating a user account and linking the access rights to certain physical areas to the user’s account by default. From that point forward, all information is collated through the IAM solution even if the data is entered in disparate and separate locations in the organisation.

Temporary access
So what should be done in the case of employees who require temporary access, such as seasonal staff, contractors or trainees? The HR system often does not define any specific role for such temporary staff members, rendering it nearly difficult to automatically assign these individuals access rights. In these cases, access rights can be easily assigned by the organisation to the employee using a self-service portal. For instance, a manager can log in on the portal to assign rights to the employees for whom he or she is responsible. Upon approval by a third party, these additionally required access rights are automatically assigned to the account of the temporary staff members. If desired, an end date can also be created when the contractor is bright on to insure access does not extend past the expected end date.

Conclusion
Assigning physical and access rights is now a common part of an employee’s user lifecycle and the process of doing so can easily be automated. The HR system can be linked to the security management and other systems to serve as the foundation for the management of access rights to physical locations. All of the information can be collated and collected with one access point, even for temporary or contract employees.

Dean Wiech is the managing director of Tools4ever. Tools4ever supplies a variety of software products and integrated consultancy services involving identity management, such as user provisioning, RBAC, password management, SSO and access management.