GLOSSARY

Resources (Directories/Applications)

Directories

Directories are objects you create and manage in RSA Identity Governance & Lifecycle that represent the data sources in your organization from which Identities (Users) and, in some cases, Accounts and Entitlements are collected. As the data sources in your organization contain the data you collect, the Directories you create serve as containers for the Collectors and the collected source data. Directories also serve as the managed entity for the data contained in them, which means Directory owners can be designated as participants in the review process and in approval and fulfillment phases for Change Request Workflows.

Applications

An Application is an object you create and manage in RSA Identity Governance & Lifecycle that represents an Application in your organization that Users access to do their jobs. For any Application in your organization, there are any number of ways Users can access its resources. Users can be directly granted granular Entitlements, Accounts, and Application Roles that provide access. They can also be granted access by virtue of belonging to Groups and Roles that have been granted Entitlements to an Application.

The Applications you create and manage in RSA Identity Governance & Lifecycle serve as the nexus between the following elements:

• The different modes of access to the Application (Users, Groups, Roles, and Accounts).
• The Entitlement and Account Collectors that collect the Application’s Entitlements data and Accounts data, respectively.
• The Entitlements and Application Roles available from the Application.
• The Change Request approval and fulfillment Workflows associated with the Application.
• The Violations of business Rules that have occurred for this Application (if the RSA Identity Governance & Lifecycle Rules module is enabled).

Business Unit

A Business Unit is an object that you create that represents a discrete segment within your organization in which Users are organized. Purchasing, accounting, and sales are but a few familiar examples of the Business Units likely found in your organization. Your organization’s Business Units have access to resources (Application Entitlements, Application Roles, and so on) that enable its Users to perform their business functions.

Data Collection

• Who are the Users and what are the Roles, and Groups of Accounts in your organization?
• What are the Applications and Data Resources in your organization?
• What are the Entitlements, Accounts, and Permissions to Data Resources in your organization?
• Who owns Data Resources?
• What changes to Application Metadata have occurred?

Identity / User

Unification

Account

Entitlement

Group

Role and Role Set

Group versus Role

A User gets access to a Group through their Accounts who are Members of a Group, whereas a Role gets Users added to it as Members. Adding Entitlements to a Group results in Users automatically getting the Entitlements indirectly. Entitlements added to a Role means the User is entitled to the Entitlement but it is not automatically given to the User. Role Entitlements are given to Role Members via Workflow configuration settings and/or Role Membership Rules.

Attribute

Review

Change Request

• Entitlements revoked in Reviews
• Members added or removed from Roles
• Actions applied by Rules

Workflow

• Request Worfklow - is the main Workflow and serves as a framework for the Change Request.
• Approval Workflow - a sub-workflow called from the Request Workflow and is intended to create an activity for business-level approvals of the changes being requested.
• Fulfillment Workflow - a sub-workflow called from the Request Workflow that exists to process the requested change and ensure that it is implemented in the target external system. A Fulfillment Workflow should include a closed-loop process to ensure that it is not completed until we have proven that the change has been provisioned, either by waiting for collection to process the change or by communicating directly with the endpoint via AFX.

Access Fulfillment Express (AFX) Connector

Rule

Note: This is applicable only if the Rules module is implemented for your installation. If you have system administrator privileges, you can enable the Rule module in Admin > System Settings.

RSA Identity Governance & Lifecycle enables users in an organization such as business managers or IT security officers, for example, to create and process business Rules that detect and notify specified users about various conditions reflected in collected data that should be monitored. Additionally Rules can potentially rectify those conditions in order to maintain compliance with an organization’s security and regulatory policies. For example, a Rule can be configured to detect whether users in a particular location, business unit, or department are able to access a particular application resource to which they should have access and vice versa.

Rules can also serve to provide decision support in user access request and role modeling processes. For example, RSA Identity Governance & Lifecycle could use a Rule to evaluate an Entitlement access request for a User to determine whether granting the request would violate a business Rule if it were allowed.

A Rule Violation occurs when a User Entitlement matching a Rule’s condition is detected.

Conditions you can detect with Rules include but are not limited to:

• Users that have Entitlements they should not have.
• Users that do not have Entitlements they should have.
• Users that have Entitlements that violate Segregation of Duties policies.
• User Attributes that have changed, which indicates that users have joined, moved within, or left your organization.
• User Entitlement changes.
• User terminations.
• Users that have Entitlements that have not been approved through a Change Request.
• Role Membership and Role Metrics changes.

Entitlements in the context of a business Rule include:

• Directly granted Entitlements and Entitlements granted through Accounts.
• Directly granted Application Roles.
• Indirectly granted Entitlements through Groups and Roles.

Reports can be generated on Rules, Rule Violations, and Rule violation exceptions.