Access and role-based controls [/ˈækˌsɛs ənd ˈrole-based kənˈtroʊlz/] n - An operations center is a set of very powerful tools, and power does not forgive carelessness. One person with the wrong access can mute a critical alert, delete a log index, reassign a credit, or edit an incident record after the fact. To manage user access, permissions, and role-based controls across all these systems is among the quieter duties of my IOC operations work, and the more consequential for its quiet; it is at once a security control and a compliance obligation.

Of Roles, Not Persons

I manage access by role, never by the handing out of permissions one by one. A handful of well-defined roles, read-only analyst, on-call responder, tool administrator, auditor, map to permission sets in each system, and persons are assigned to the roles. Thus does access remain least-privilege by default: a new analyst receives exactly the responder role, not a copy of whatever the last man chanced to accumulate.

The systems this spans are those the rest of this section treats:

• The ITSM ticketing systems: who may edit workflows, change priorities, or reopen closed records.
• The monitoring platforms: who may edit a monitor, delete an index, or change ingestion.
• Infrastructure and facility controls, the access of highest blast radius of all, and so the most tightly reserved.

The Labor That Keeps It Clean

• Provisioning and deprovisioning. [/ˈprɒvɪsɪɒnɪng ˈænd ˈdɛprɒvɪsɪɒnɪng/] n Access is granted by role on the first day and, what matters more, removed when a person changes teams or departs. Orphaned accounts are the classic finding of any audit.
• Access reviews. [/ˈækkɛss ˈrɛvɪɛws/] n On a regular cadence I reconcile who holds what against who should, and the surprises (a contractor with admin, a role grown too broad) are pulled back.
• Privilege creep. [/ˈprɪvɪlɛgɛ ˈkrɪːp/] n Temporary elevations have a way of becoming permanent. I hunt them down and let them expire.
• Separation of duties. [/ˈsɛpærætɪɒn ˈɒf ˈdʌtɪɛs/] n He who can edit an incident record must not also be he who can quietly delete its audit trail. To keep the two apart is what makes the record worthy of trust.

A Compliance Control, Not Mere Hygiene

When an auditor asks who could have changed this number, and whether you can prove who did, the answer rises from this discipline alone: defined roles, a clean assignment list, and a log of changes. Done well, access management is invisible. Done badly, it stands as root cause in another man’s On Running the Root-Cause Inquiry. The gaps I find here, a system without true role support, a manual review that ought to be automated, go onto On Finding the Gaps in One’s Tools.