Recertification solution to meet governance and MaRisk requirements

As the central IT service provider of the Sparkassen-Finanzgruppe, Finanz Informatik offers the complete IT service - from application development to infrastructure and data center operation to consulting, training and support. It is supported by its subsidiary Finanz Informatik Technologie Service (FI-TS), the largest IT service provider for Landesbanken. Its 1,000 employees work daily in the IT systems of the financial institutions, Finanz Informatik and its own systems - a highly sensitive area in which it must be clearly regulated who has what rights to administer the software in question. The financial institutions serviced by FI-TS are subject to the relevant regulatory requirements, in particular the Minimum Requirements for Risk Management, abbreviated MaRisk, of the German Federal Financial Supervisory Authority (BaFin), compliance with which is also regularly monitored by the authorities. The financial institutions are obliged to pass on these regulations to their subcontractors, so FI-TS must provide all services, including access to software, in compliance with supervisory law.

For several years, a special Identity Access Governance (IAG) software has been used for internal authorization management. "However, access authorizations are not set in stone", knows Christian Rothlauf: "Rather, they have to be checked regularly in the course of increasingly strict governance requirements". For this reason, a so-called recertification is taking place. It ensures that every user of the IT systems has only those authorizations in these systems at any given time that are necessary for the performance of his or her tasks, whereby the principle of economy (need-to-know) is applied. The managers check for each of the employees assigned to them which authorizations they can retain and which are to be withdrawn. Roles in which several rights are bundled are also recertified. It must therefore be checked whether each role also contains the correct rights at all times.  

With its new recertification software, FI-TS can meet the requirements described above. Among other things, it also enables recertification of exclusive roles, as the IAG system from FI-TS does. Such roles are used to control attributes of employees. Users who have no accounts can also be recertified.

For temporary activation of rights, FI-TS uses the HPU (highly privileged user) procedure. This involves applying for a specific authorization role as normal, but initially no rights are associated with it. These rights can then be activated via a separate workflow and the user is assigned a so-called twin role. The new recertification solution is also able to map this special rights constellation. Architecturally designed as a web application, it works with a universally applicable data model. This model maps the entities of a normal IAG system.

The data from the IAG solution (Garancy IAM from Beta Systems Software AG), which contains all roles and users, responsible persons and organizational structures, can thus be easily transferred to the recertification solution. They are exported at night and can be adapted, aggregated or filtered again at the interface. In this way, the construct with twin roles and HPU rights is elegantly mapped. FI-TS systems that do not communicate with the IAG software also deliver data from all accounts and authorizations to the certification solution. The latter links it to the IAG solution and thus finds the responsible manager. TIMETOACT created the integrative connection between the individual systems for FI-TS.

Even during the first recertification, it became clear how the MaRisk requirement of completeness is being met by FI-TS: In the new system, the manager only ever sees a certain section of the screen, can make a decision for the objects displayed there and then has to click on. This ensures that a decision is actively made for each employee and his or her rights and roles. Thanks to the flexibility of the manufacturer Nexis Controle, the TIMETOACT team was able to implement the customer's current requirements very quickly and make new features ready for standard use within a few weeks. Project manager Christian Höfs: "The software requires virtually no programming, but gets by with pure configuration in the user interface and clicking together settings. This allows granular control of what is to be recertified and displayed".