tenfold Case Study:
Children’s Cancer Research Institute

Internal lateral movements, like changing from one research group to another, are particularly challenging in terms of access governance. Information must pass through various departments – from the research group manager to HR and from there to IT – before it can be input in the system. Not only does the information need to travel quickly to ensure users have access to the resources they need in time, but IT workers also have to set transition periods for privileges to allow scientists to go back and forth between departments in between projects.

Doing all this by hand is tricky, time-consuming and likely to result in mistakes, as every connected system must be scanned manually for the affected person’s privileges and resources.

Furthermore, researchers often provide their own work tools and systems, which, like the employees themselves, must be integrated with the internal IT infrastructure, often at short notice and for a limited period of time. Password changes and other similar tasks are also part of the daily workload. In short: there’s a lot to be done.

On top of the heavy workload caused by the lack of process automation, manual access management leads to other problems: Mistakes happen, naming conventions are inconsistent or disregarded, users receive permissions they are not entitled to, and so on. It is also not uncommon for users to retain privileges they do not need anymore for a prolonged time or even permanently, for example after they change departments and the IT forgets to revoke their old privileges – this phenomenon is known as privilege creep. Generally, you can say that keeping track of users and permissions is a huge challenge if done manually.

Another problem CCRI faced was in the distribution of licenses for different programs and systems, which is a common issue many companies struggle with: assume you are an administrator and an employee leaves the institution. Because you’re doing everything manually via Excel lists and ticket systems, you forget to withdraw the M365 license of that person’s associated user account. In theory, the license should be available for the next user who joins the team, but because there’s so much fluctuation and you’re struggling to stay on top of your lists, the license does not show up as available in the license pool and you therefore buy a new one for the user. It’s an unnecessary waste of money that could easily be saved if you had a better overview of the access landscape.

Another challenge in this context is the use of reference users for creating new accounts. Reference users are existing user accounts that serve as a template for new user accounts. The existing account’s permissions are simply duplicated onto the new user account, for example if the new employee holds a similar position to that of the reference user or works in the same department. It’s tempting because it appears a viable and easy shortcut, but the problem is that the new employee might receive access to networks and information they should not have access to at all. It’s also a violation of the principle of least privilege, which is a key security best practice. You should avoid reference users at all costs to prevent users from becoming overprivileged insider threats.

An Identity Access Management Solution is the right remedy to prevent overprivileged users and overspending on licenses because it makes sure licenses are revoked automatically when a user account is deactivated.

While Ingomar Schmickl, Head of IT at CCRI, had IAM on the radar, he, like many of his peers, had it saved under “complex, expensive, time-consuming”. Not an option for an institution like the Cancer Research Institute, which relies 100% on donations. Plus, Schmickl’s IT department was busy enough tackling the various tasks they faced on the daily. How should they pile the integration of a highly complex IAM-system on top of their enormous workload? It was impossible.

Or was it?

As luck would have it, tenfold’s integration partner Artaker Computer Systems also worked closely with CCRI. As the topic IAM came up in conversation, Schmickl realized that identity access management is not just about improving cybersecurity, but that it also helps to alleviate the workload in an IT environment.

As soon as he realized that there are solutions available on the market that are better suited to the needs of small and medium-sized businesses and who offer more favorable conditions for institutions such as CCRI, who depend entirely on donations, the IAM-ball got rolling.

In the course of evaluating potential IAM solutions, Schmickl compared tenfold to a data governance solution as well as a larger enterprise solution. However, he quickly came to the conclusion that neither of the latter options offered what was needed – the data governance solution was primarily geared towards logging changes in Active Directory, while the enterprise solution proved to be – as expected – too complex and costly in comparison to the benefits it might reap.

Due to the high turnover of around 5-8 employees per month, the management of user accounts posed a particularly time-consuming task for the research institute’s IT department. When an employee left, all of their accounts, mailboxes, permissions and licenses in Active Directory and other systems like Microsoft 365 had to be identified, individually disabled and revoked. And every single change had to be logged into an Excel list.

tenfold’s self-service platform allows end users to reset their own passwords or request new permissions without the need for tickets or emails.

To further alleviate pressure on the IT, the plan is to integrate more systems with tenfold, such as, for example, Sage’s HR software.

Currently, CCRI’s HR staff have to enter new users into Sage’s HR software and then feed all relevant information to the IT department via email, who then go on to set up the necessary user accounts and privileges for the new employee across multiple systems, based on the information they received from HR. Not only is such an intricate process that involves many people across departments prone to errors (HR forget to pass on info, typos when inputting data, etc.), it also takes really long.

There are also plans to integrate tenfold’s Reporting feature, which reveals at a click not only which resources a user has access to, but also since when, for how long and who is responsible for assigning access. Not only does this help companies to keep a better overview of their access landscape, it also helps them to excel at both internal and external audits.

Another item on the list is the implementation of tenfold’s access review feature, which regularly prompts data owners (research group leaders, for example, in the case of CCRI) to review the existing additional permissions of researchers on their team and to remove privileges that are no longer needed. The access review feature only applies to extra privileges. Default privileges that users receive via profiles, for example, do not need to be reviewed. Access reviews help to reduce the risk of privilege creep and to keep insider threats contained, while also ensuring that the principle of least privilege is adhered to.