The Bancorp Automates User Access Reviews with SCC Identity Governance Suite

Background

The Bancorp Bank (Member FDIC, Equal Housing Lender), has been repeatedly recognized in the payments industry as the Top Issuer of Prepaid Cards (US), a top merchant sponsor bank and a top ACH originator. Specialized lending distinctions include National Preferred SBA Lender, a leading provider of securities-backed lines of credit, and one of the few bank-owned commercial leasing groups in the nation.

Like many companies, the Bancorp performs periodic reviews of user access rights. Tony Meholic, Bancorp’s Chief Security Officer, sought to streamline what had previously been a very tedious and time-consuming effort. After a very rapid deployment of SCC’s Access Auditor, Tony’s security team not only saved countless hours of staff time, but also improved the security posture of the bank. The governance improvements earned very positive attention from the FDIC examiners and auditors as a major enhancement to the information security program.

The Challenge

As an FDIC regulated corporation, The Bancorp is required to perform user access reviews to ensure that staff have the appropriate access rights to key applications. The security team previously conducted the reviews semi-annually through the use of very large and cumbersome Excel spreadsheets. This spreadsheet rodeo would take approximately 6 weeks to complete and was very labor intensive.

A few of the key challenges included:

• Multiple data sources: While many privileges were managed by Active Directory, each department had unique applications managed outside of the corporate directory, requiring user access data to be manually entered into the master spreadsheet.
• Large volume of employees and access privileges: Bancorp has a population of 700 employees, some of which have over 300 disparate access privileges. The collation, management, and analysis was extremely unwieldy for manual processing.
• Collation and management of data: As the review progressed, managers would return their portion of the access spreadsheet and their responses were imported by hand into the master file.
• Long completion time: The team needed over 6 weeks to complete a review.                   
• Labor intensive: Because of the large volume of employees in multiple departments, every staff member needed to be involved in managing the review process, making them unavailable for other crucial tasks.

The Solution

Faced with a daunting process for the required user entitlement reviews, The Bancorp searched for a better answer. Tony Meholic’s requirements were simple. “The goal was to establish some form of automation for the process so that it could be accomplished in a more efficient and timely manner.” While several large vendors proposed Identity Management tools, these proved to be too expensive, time-consuming, and complicated to use.

Tony’s quest for a simple and fast solution led him to Security Compliance Corp’s Access Auditor. Access Auditor was the ideal answer to streamline and simplify the entire user entitlement review process quickly and affordably.

Several features of Access Auditor convinced the Bancorp to move forward, including:

• Automated collation of access data and responses
• Centralized repository for access data (no more version management of a large spreadsheet)
• Easy web-based access for the reviewing managers
• Easy report generation
• Significant time savings

According to Meholic, “If Access Auditor could accomplish each of these features, it would be the perfect solution to our problem.”

The Results

Access Auditor was a tremendous success for The Bancorp. As Tony notes, “The deployment for AA went very smoothly. It was up and running very quickly and the support was very responsive and helpful. The short term results were realized in the first user review. There was overwhelming approval from the managers on the ease of use and availability. As a result, we had a much more rapid response than when using the spreadsheets and the managers completed their reviews in a much shorter time.”

Another important result was the ease of linking user accounts from different systems without a consistent login ID. Since several applications used different login ID formats, the Identity Mapper and Fuzzy ID provided the ability to link disparate accounts from users across all systems in a matter of minutes.

CSO Tony Meholic summarizes, “We continue to expand our usage of Access Auditor. My team is able to obtain more granular data than ever before and can conduct a user review with minimal staff. We are also able to track the trending of various access privileges and efficiently eliminate unnecessary and orphaned access in a very efficient manner. FDIC examiners and auditors recognized this improvement as a major enhancement for the security program.”