become-itil-foundation-certified-abhinav-kaiser(www.ebook-dl.com)

Chapter 7 ■ Service Operations
• Comply with the request fulfillment management process
controls in providing, revoking, and changing accesses
• Ensure users’ access is not exploited or improperly used
7.5.5.2 Scope of Access Management
Access management’s scope covers the length and breadth of IT services provided to the
customer and its related components. For examples, if the service offered to a customer
is related to financial services, this includes all access to applications that fall under
the financial services, access to administration of servers and switches that enable the
service, access to security bays, among others.
Access management is usually a part of the request fulfillment process. It is highly
unlikely that people would be deployed just to provide access. Access management
activities will be grouped with other service request fulfillment activities, and the groups
that fulfill service requests will be given the responsibility for providing access as well.
Providing access manually is becoming rare and could soon become a thing of the
past. Access is grouped with the roles in the organization, and assignment of various roles
by the human resources department will automatically provide access. This is possible
through the identity management tools that integrate with various applications through
plug-ins and are powered to provide and revoke access based on the assigned roles.
Access also comes in different flavors. Generally, you have the following accesses
commonly assigned:
• Read only access
• Modify access
• Create access
• Super user access (includes deletion)
• Administrator access
The scope for providing, altering, and revoking access is derived from the
information security policy and process. As I discussed under the information security
management process, the process strictly adheres to confidentiality, integrity, and
availability parameters. However, the access management process is only responsible for
the confidentiality part of information security.
7.6 Functions
In Chapter 1 I briefly discussed the concept of functions and how they interface with
processes. To reiterate, think of functions as a team or group of people who carry out
process activities. In the IT industry, there are generally several teams: Unix team, Wintel
team, SAP team, JAVA team, and Network team, to name a few. Each of these teams has a
function, and their work is driven through processes. For example, the network team will
work on incidents when a network incident is detected. And they also work on network
changes, say if a switch is getting replaced.
190