{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/access-management","url":{"en":"https://atlas.maintz.dev/en/terms/security/access-management/","da":"https://atlas.maintz.dev/da/terms/security/access-management/"},"term":{"en":"Access management","da":"Adgangsstyring"},"aka":{"en":["identity and access management","IAM"],"da":["IAM","adgangsstyring og identitetsstyring"]},"domain":["security"],"cluster":"controls","layer":"identity","status":"current","summary":{"en":"The rules and routines that decide who may use which data and systems, and that keep those rights correct over time.","da":"De regler og rutiner, der afgør, hvem der må bruge hvilke data og systemer, og som holder rettighederne korrekte over tid."},"body":{"formal":{"en":"The ongoing process of granting, reviewing and removing each user account's rights to data and systems, based on the holder's role and approved need, so that access control always enforces a decision that still holds.","da":"Den løbende proces, hvor hver brugerkontos rettigheder til data og systemer tildeles, gennemgås og fjernes ud fra personens rolle og godkendte behov, så adgangskontrollen altid håndhæver en beslutning, der stadig gælder."},"plain":{"en":"Like the office manager who decides who gets a key to which rooms, and collects the keys back when someone changes job or leaves.","da":"Som kontorchefen, der bestemmer, hvem der får nøgle til hvilke rum, og som samler nøglerne ind igen, når nogen skifter job eller stopper."},"inPractice":{"en":"When a case officer in a municipality moves from social services to the payroll office, IT removes her access to citizens' case files the same week and grants payroll access, approved by her new manager.","da":"Når en sagsbehandler i en kommune skifter fra socialforvaltningen til lønkontoret, fjerner IT hendes adgang til borgernes sager samme uge og giver hende adgang til lønsystemet, godkendt af hendes nye chef."},"whyItMatters":{"en":"Rights pile up quietly as people change roles; if nobody reviews them, one stolen account can open far more than its owner ever needed.","da":"Rettigheder hober sig stille op, når folk skifter roller; uden opfølgning kan én stjålet konto åbne langt mere, end ejeren nogensinde havde brug for."}},"deepDive":{"en":"Access management is usually modelled as an identity lifecycle: joiner, mover, leaver (JML). An authoritative source, typically the HR system, emits events that an identity governance and administration (IGA) platform turns into provisioning actions in directories and applications, today often over SCIM 2.0 (RFC 7643 for the schema, RFC 7644 for the protocol) or through connectors to Active Directory and Entra ID. The mover case is where most programmes fail: new rights are added promptly because someone needs them to work, but old rights are rarely removed, so accumulated privilege (\"privilege creep\") grows with tenure. Leaver processing has its own traps - disabling the directory account does not revoke local application accounts, API keys, OAuth refresh tokens or already-issued session cookies.\n\nThe authorisation model sits underneath. Role-based access control (RBAC, standardised as ANSI/INCITS 359) bundles permissions into roles derived from job functions; attribute-based access control (ABAC, NIST SP 800-162) evaluates policies over attributes of subject, object, action and environment at request time. Real estates are hybrids: coarse RBAC for birthright access, ABAC or fine-grained entitlements for sensitive data, and just-in-time elevation through privileged access management (PAM) for administrator rights. Segregation of duties (SoD) rules - for instance that nobody may both create a supplier and approve payments to it - are expressed as toxic role combinations that the IGA tool blocks or flags.\n\nAssurance comes from periodic access reviews (recertification), in which data or system owners confirm or revoke each entitlement. Reviews degrade into rubber-stamping when owners are shown thousands of cryptic group names; effective programmes review by business role, highlight deviations from peer groups and track revocation rates. Orphaned accounts (no living owner), shared accounts and service accounts with non-expiring secrets are standard audit findings.\n\nIn control frameworks the topic is split across several controls: ISO/IEC 27002:2022 5.15 (access control), 5.16 (identity management), 5.17 (authentication information), 5.18 (access rights) and 8.2 (privileged access rights); CIS Controls v8 Control 5 (Account Management) and Control 6 (Access Control Management), where Safeguards 6.1 and 6.2 require documented processes for granting and revoking access. NIS2 Art. 21(2)(i) names access control policies explicitly. Access management should be distinguished from authentication (proving who someone is) and from access control as an enforcement mechanism: it is the governance process that decides what the enforcement point should enforce.","da":"Adgangsstyring beskrives typisk som en identitetslivscyklus: joiner, mover, leaver (JML). En autoritativ kilde, oftest HR-systemet, sender hændelser, som en IGA-platform (identity governance and administration) omsætter til provisionering i kataloger og applikationer, i dag ofte via SCIM 2.0 (RFC 7643 for skemaet, RFC 7644 for protokollen) eller via konnektorer til Active Directory og Entra ID. Det er i mover-tilfældet, de fleste programmer fejler: nye rettigheder tildeles hurtigt, fordi medarbejderen skal kunne arbejde, men gamle fjernes sjældent, så privilegieophobning (\"privilege creep\") vokser med ancienniteten. Fratrædelser har deres egne faldgruber - at deaktivere kontoen i kataloget tilbagekalder ikke lokale applikationskonti, API-nøgler, OAuth refresh tokens eller allerede udstedte sessionscookies.\n\nUnder processen ligger autorisationsmodellen. Rollebaseret adgangskontrol (RBAC, standardiseret som ANSI/INCITS 359) samler rettigheder i roller afledt af jobfunktioner; attributbaseret adgangskontrol (ABAC, NIST SP 800-162) evaluerer politikker over attributter for subjekt, objekt, handling og kontekst på forespørgselstidspunktet. I praksis er miljøer hybride: grov RBAC til basisadgang, ABAC eller finkornede rettigheder til følsomme data og just-in-time-eleverede administratorrettigheder via privileged access management (PAM). Funktionsadskillelse (segregation of duties) - fx at ingen både kan oprette en leverandør og godkende betalinger til den - udtrykkes som forbudte rollekombinationer, som IGA-værktøjet blokerer eller markerer.\n\nSikkerheden for, at rettighederne stadig er korrekte, kommer fra periodiske rettighedsgennemgange (recertificering), hvor data- eller systemejere bekræfter eller fjerner hver rettighed. Gennemgangene bliver til ren afkrydsning, når ejerne præsenteres for tusindvis af kryptiske gruppenavne; velfungerende programmer gennemgår pr. forretningsrolle, fremhæver afvigelser fra kolleger med samme rolle og følger andelen af fjernede rettigheder. Forældreløse konti uden ejer, delte konti og servicekonti med hemmeligheder, der aldrig udløber, er klassiske revisionsfund.\n\nI kontrolrammerne er emnet fordelt på flere kontroller: ISO/IEC 27002:2022 5.15 (adgangsstyring), 5.16 (identitetsstyring), 5.17 (autentificeringsinformation), 5.18 (adgangsrettigheder) og 8.2 (privilegerede adgangsrettigheder); CIS Controls v8 Control 5 (Account Management) og Control 6 (Access Control Management), hvor Safeguard 6.1 og 6.2 kræver dokumenterede processer for tildeling og fjernelse af adgang. NIS2 art. 21, stk. 2, litra i, nævner politikker for adgangskontrol direkte. Adgangsstyring skal holdes adskilt fra autentificering (at bevise, hvem man er) og fra adgangskontrol som håndhævelsesmekanisme: det er den styringsproces, der afgør, hvad håndhævelsespunktet skal håndhæve."},"howTo":{"steps":{"en":["Name an owner for access management, and appoint a data or system owner for each important system who decides who may use it.","List every user, admin, service and guest account per system, and link each account to a named person or owner.","Define roles from job functions with the rights each role needs, and write down forbidden combinations, such as creating suppliers and approving payments to them.","Connect the HR system to the directory so joiners, movers and leavers trigger account creation, change and removal, using SCIM or connectors where possible.","Require the manager's approval for any right beyond the role's standard access, and log who approved what and when.","On a job change, remove the old role's rights in the same step as granting the new ones; on departure, disable the account on the last day and revoke tokens, keys and local accounts.","Run access reviews at least yearly, and quarterly for admin roles and sensitive systems, where owners confirm or remove each right and the result is recorded.","Report orphaned accounts, removed rights and overdue reviews to management, and fix the process where the numbers show gaps."],"da":["Udpeg en ansvarlig for adgangsstyring, og giv hvert vigtigt system en data- eller systemejer, der afgør, hvem der må bruge det.","Lav en oversigt over alle bruger-, administrator-, service- og gæstekonti pr. system, og knyt hver konto til en navngiven person eller ejer.","Definér roller ud fra jobfunktioner med de rettigheder, hver rolle kræver, og skriv forbudte kombinationer ned, fx at oprette leverandører og godkende betalinger til dem.","Forbind HR-systemet med kataloget, så nyansættelser, jobskift og fratrædelser automatisk opretter, ændrer og nedlægger konti, via SCIM eller konnektorer hvor det er muligt.","Kræv lederens godkendelse af enhver rettighed ud over rollens standardadgang, og log, hvem der godkendte hvad og hvornår.","Fjern den gamle rolles rettigheder i samme ombæring, som de nye tildeles, ved jobskift; ved fratrædelse deaktiveres kontoen på sidste arbejdsdag, og tokens, nøgler og lokale konti tilbagekaldes.","Gennemfør rettighedsgennemgange mindst en gang om året og hvert kvartal for administratorroller og følsomme systemer, hvor ejerne bekræfter eller fjerner hver rettighed, og resultatet dokumenteres.","Rapportér forældreløse konti, fjernede rettigheder og forsinkede gennemgange til ledelsen, og ret processen der, hvor tallene viser huller."]},"pitfalls":{"en":["Adding rights when people change jobs without removing the old ones, so privileges pile up over the years.","Rubber-stamp reviews where owners approve long lists of cryptic group names they do not understand.","Disabling only the directory account when someone leaves and forgetting local application accounts, API keys and active sessions."],"da":["At tildele nye rettigheder ved jobskift uden at fjerne de gamle, så rettighederne hober sig op gennem årene.","Rettighedsgennemgange, der bliver ren afkrydsning, fordi ejerne godkender lange lister af kryptiske gruppenavne, de ikke forstår.","Kun at deaktivere katalogkontoen ved fratrædelse og glemme lokale applikationskonti, API-nøgler og aktive sessioner."]},"guides":[{"title":"Identity and access management - 10 Steps to Cyber Security","url":"https://www.ncsc.gov.uk/collection/10-steps/identity-and-access-management","publisher":"NCSC UK","tier":"official-doc"},{"title":"CIS Critical Security Control 6 - Access Control Management","url":"https://www.cisecurity.org/controls/access-control-management","publisher":"Center for Internet Security","tier":"standard"},{"title":"What are access reviews? - Microsoft Entra ID Governance","url":"https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview","publisher":"Microsoft","tier":"official-doc"},{"title":"Cyberforsvar der virker","url":"https://samsik.dk/publikation/cyberforsvar-der-virker/","publisher":"Center for Cybersikkerhed (Styrelsen for Samfundssikkerhed)","tier":"official-doc","lang":"da"},{"title":"Referencearkitektur for brugerstyring","url":"https://arkitektur.digst.dk/rammearkitektur/referencearkitekturer/referencearkitektur-brugerstyring","publisher":"Digitaliseringsstyrelsen","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"cs/authentication","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/authorization","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"implements","to":"cs/access-control","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/least-privilege","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/role-based-access-control","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/mfa","confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"CIS Critical Security Controls v8 - Controls 5 and 6","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}