Identity and Access Management
Book
MidPoint
- Compliance
  - ISO 27001
    - 5.1
    - 5.2
    - 5.3
    - 5.4
    - 5.5
    - 5.6
    - 5.7
    - 5.8
    - 5.9
    - 5.10
    - 5.11
    - 5.12
    - 5.13
    - 5.14
    - 5.15
    - 5.16
    - 5.17
    - 5.18
    - 5.19
    - 5.20
    - 5.21
    - 5.22
    - 5.23
    - 5.24
    - 5.25
    - 5.26
    - 5.27
    - 5.28
    - 5.29
    - 5.30
    - 5.31
    - 5.32
    - 5.33
    - 5.34
    - 5.35
    - 5.36
    - 5.37
    - 6.1
    - 6.2
    - 6.3
    - 6.4
    - 6.5
    - 6.6
    - 6.7
    - 6.8
    - 7.1
    - 7.2
    - 7.3
    - 7.4
    - 7.5
    - 7.6
    - 7.7
    - 7.8
    - 7.9
    - 7.10
    - 7.11
    - 7.12
    - 7.13
    - 7.14
    - 8.1
    - 8.2
    - 8.3
    - 8.4
    - 8.5
    - 8.6
    - 8.7
    - 8.8
    - 8.9
    - 8.10
    - 8.11
    - 8.12
    - 8.13
    - 8.14
    - 8.15
    - 8.16
    - 8.17
    - 8.18
    - 8.19
    - 8.20
    - 8.21
    - 8.22
    - 8.23
    - 8.24
    - 8.25
    - 8.26
    - 8.27
    - 8.28
    - 8.29
    - 8.30
    - 8.31
    - 8.32
    - 8.33
    - 8.34
Identity Connectors
Support
Trainings
Evolveum
Community
Library
Case Studies
Talks
Glossary
Frequently Asked Questions
About

ISO/IEC 27001 Control 8.4: Access to source code

Control

Read and write access to source code, development tools and software libraries should be appropriately managed.

Necessity of MidPoint

MidPoint is necessary to implement this control properly.

MidPoint features and capabilities are essential for efficient implementation of this control. While it is theoretically possible to implement this control without a comprehensive IGA platform in place, the implementation is likely to be inefficient, costly, slow and unreliable in the long run. MidPoint can make implementation of this control efficient and reliable.

Implementation Overview

MidPoint can manage access control setting of source code management systems, CI/CD and testing platforms and other software development systems.

Implementation Details

Strong provisioning capabilities of midPoint, together with appropriate ConnId connectors, can be used to manage access control in numerous software development systems and platforms. MidPoint can control access of individual developers to specific source code repositories in source code management systems, pipelines in continuous integration and delivery (CI/CD) platforms, testing environments and all other systems related to software development. Access to the software development tooling can be controlled in an automated way, using policy-driven role-based access control (PD-RBAC). Developers can gain access to individual repositories, pipelines and environments based on their membership in teams or projects, their access level (read/write) determined by their position or role in the project. Fine-grained access control for setting up access levels can be implemented using relation parameter, together with parametric inducements in archetypes corresponding to source code repositories. Access that is automatically granted using PD-RBAC mechanism is automatically adjusted or revoked when the membership, position or role of the developer changes. Access to source code repositories can be seamlessly integrated with project management, automatically creating source code repositories and granting permissions for project members, revoking permissions when members leave the project. Similarly, access to source code can be managed for suppliers, contractors and consultants, granting access as they join a project and revoking it when they leave. Automation provided by PD-RBAC mechanisms makes sure that the access will be reliably revoked, keeping risks manageable. When needed, special-purpose personas can be created for "testing identities", identities of quality assurance engineers that group testing accounts (as opposed to their ordinary user accounts). MidPoint audit trail records all changes in permissions, including source code access right changes.

Implementation Notes

Process known as "pull request", described as "authorization procedure" by the control, is implemented by source code management platforms. MidPoint does not take part in this process directly. However midPoint can control permissions to allow certain team members to review and merge pull requests, "authorizing" source code changes.
MidPoint can be especially helpful for controlling access to testing environments, especially of there are copies of production data. Testing environments are notorious for lax management of assess rights and poor cleanup of access permissions after test. MidPoint can manage access permissions of quality assurance staff and scan the systems for testing accounts that are not accounted for.

Rationale

MidPoint is necessary to manage access control to source code and other software development tools and platforms at scale. While access to a small set of source code repositories can be managed manually, manual management becomes infeasible as the organization grows. Large number of organizational units, team, activities and projects present various needs for source code management and permissions. Excessive access rights for source code repositories may remain unnoticed for years, yet they pose a serious security risk. Management of source code repository access has to be automated - especially revocation of access rights. This problem is especially emphasized in large software development companies or IT consultancies that conduct large number of projects, many of them are relatively short-lived. Frequent change of staff assignments, moving people between projects, engagement of suppliers/contractor/consultants and similar dynamic business behavior requires strong identity governance platform to operate in a secure manner.

Was this page helpful?

YES NO

Thanks for your feedback