{"id":8532,"date":"2023-10-11T10:36:49","date_gmt":"2023-10-11T08:36:49","guid":{"rendered":"https:\/\/www.idstory.com\/?p=8532"},"modified":"2023-10-11T11:45:15","modified_gmt":"2023-10-11T09:45:15","slug":"sprava-identit-cim-se-inspirovat-u-vetsich-spolecnosti","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/sprava-identit-cim-se-inspirovat-u-vetsich-spolecnosti\/","title":{"rendered":"Spr\u00e1va Identit: \u010c\u00edm se inspirovat u v\u011bt\u0161\u00edch spole\u010dnost\u00ed?"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Ka\u017ed\u00e1 spole\u010dnost m\u00e1 vlastn\u00ed pravidla a procesy a spr\u00e1va identit nen\u00ed v\u00fdjimkou. Ve v\u011bt\u0161\u00edch firm\u00e1ch b\u00fdvaj\u00ed ji\u017e pravidla a procesy nastaven\u00e9. V men\u0161\u00edch firm\u00e1ch b\u00fdv\u00e1 v\u00edce volnosti. Na za\u010d\u00e1tku vyberu 3 situace, kter\u00e9 ve velk\u00fdch firm\u00e1ch b\u00fdvaj\u00ed komplexn\u011bji \u0159e\u0161eny. Jedn\u00e1 se o zastupitelnost, procesy spr\u00e1vy \u00fa\u010dt\u016f a IT bezpe\u010dnost. N\u00e1sledn\u011b si uk\u00e1\u017eeme aktivity, kter\u00e9 jsou vhodn\u00e9 zlep\u0161it v jak\u00e9koli firm\u011b a jsou sou\u010d\u00e1st\u00ed identity managementu. Zkontrolujeme n\u00e1stupy a odchody zam\u011bstnanc\u016f, automatizaci t\u011bchto proces\u016f a zefektivn\u00edme spr\u00e1vu licenc\u00ed.<\/p>

\u00a0<\/div>

Jak se li\u0161\u00ed spr\u00e1va identit u men\u0161\u00ed a velk\u00e9 spole\u010dnosti?<\/h2>

Po\u010det IT specialist\u016f a zam\u011bstnanc\u016f (zastupitelnost)<\/h3>

Velikost firmy budeme zjednodu\u0161en\u011b rozd\u011blovat podle obratu a po\u010dtu zam\u011bstnanc\u016f. V \u010dl\u00e1nku budeme porovn\u00e1vat men\u0161\u00ed firmu se 100 zam\u011bstnanci a v\u011bt\u0161\u00ed firmu s 900 zam\u011bstnanci. Celkov\u011b m\u016f\u017eeme \u0159\u00edci, \u017ee v\u011bt\u0161\u00ed spole\u010dnost m\u00e1 v\u00edce IT odborn\u00edk\u016f a z\u00e1rove\u0148 pracuje s v\u011bt\u0161\u00edm objemem administrativn\u00edch \u00fakon\u016f. Zastupitelnost specialist\u016f m\u016f\u017ee fungovat dob\u0159e, ale jsou dny, kdy se sejde p\u0159\u00edli\u0161 mnoho v\u011bc\u00ed z\u00e1rove\u0148. Jeden z p\u0159\u00edklad\u016f je prvn\u00ed den v m\u011bs\u00edci, kdy se \u0159e\u0161\u00ed n\u00e1stupy a odchody. Co se pak stane, kdy\u017e ten sam\u00fd den je tak\u00e9 nedostupn\u00fd sd\u00edlen\u00fd disk \u010di nefunguje s\u00ed\u0165 v kancel\u00e1\u0159i. Stresov\u00e1 situace vyvol\u00e1v\u00e1 i p\u0159i dob\u0159e \u0159\u00edzen\u00e9m syst\u00e9mu spr\u00e1vy \u00fa\u010dt\u016f mo\u017enost chyby \u010di opomenut\u00ed. Proti tomu v druh\u00e9m extr\u00e9mu, v mal\u00e9 firm\u011b m\u016f\u017eete m\u00edt jednoho IT specialistu, kter\u00fd \u0159e\u0161\u00ed p\u00e1r zm\u011bn a n\u00e1stup\u016f za rok. Zn\u00e1 v\u0161ech 20 zam\u011bstnanc\u016f jm\u00e9nem a jejich pot\u0159eby. V t\u00e9to situaci se z\u0159ejm\u011b nevyplat\u00ed m\u00edt dva IT specialisty, proto\u017ee pro n\u011b nen\u00ed dostatek pr\u00e1ce. Zastupitelnost z pohledu spr\u00e1vy IT prost\u0159edk\u016f a \u00fa\u010dt\u016f je tedy t\u00e9m\u011b\u0159 nulov\u00e1 a \u0159e\u0161\u00ed se a\u017e p\u0159i nastal\u00e9 krizov\u00e9 situaci.<\/p>

Po\u010det syst\u00e9m\u016f (procesy a dokumentace,\u00a0automatizace)<\/h3>

S r\u016fstem firmy roste po\u010det syst\u00e9m\u016f a server\u016f. A\u0165 u\u017e se jedn\u00e1 o roz\u0161\u00ed\u0159en\u00ed MS produkt\u016f o Sharepoint, p\u0159id\u00e1n\u00ed SAP modul\u016f nebo specializovan\u00e9 aplikace pro nemocnice jako t\u0159eba syst\u00e9my \u0159ady FONS. Stejn\u011b jako po\u010det syst\u00e9m\u016f typicky roste tak\u00e9 po\u010det u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f nejenom kv\u016fli zvy\u0161uj\u00edc\u00edmu se po\u010dtu zam\u011bstnanc\u016f, ale i dal\u0161\u00edm subjekt\u016fm, jako jsou extern\u00ed pracovn\u00edci nebo t\u0159eba dodavatelsk\u00e9 \u00fa\u010dty. Vid\u00edme i \u010dast\u011bj\u0161\u00ed zm\u011bny v infrastruktu\u0159e jako je nap\u0159\u00edklad migrace \u00fa\u010dt\u016f AD do cloudov\u00e9ho \u0159e\u0161en\u00ed a pou\u017eit\u00ed slu\u017eeb jako O365. Nastaven\u00e9 procesy zm\u011bn, dokumentace a manu\u00e1ly pro tyto syst\u00e9my jsou ned\u00edlnou sou\u010d\u00e1st\u00ed velk\u00e9 firmy a je povinnost\u00ed je udr\u017eovat aktu\u00e1ln\u00ed. Spr\u00e1va identit m\u016f\u017ee b\u00fdt pln\u011b nebo \u010d\u00e1ste\u010dn\u011b automatizovan\u00e1. Nap\u0159\u00edklad n\u00e1stup nov\u00e9ho zam\u011bstnance m\u016f\u017ee vypadat n\u00e1sleduj\u00edc\u00edm zp\u016fsobem: HR pracovn\u00edk zad\u00e1 \u00fadaje do person\u00e1ln\u00edho syst\u00e9mu. Zam\u011bstnanci se d\u00edky zaveden\u00e9mu identity manager SW n\u00e1sledn\u011b vytvo\u0159\u00ed z\u00e1kladn\u00ed \u00fa\u010dty do e-learningov\u00e9ho syst\u00e9mu a Active Directory se z\u00e1kladn\u00edm opr\u00e1vn\u011bn\u00edm. Emailem je zasl\u00e1na informace na IT odd\u011blen\u00ed pro p\u0159\u00edpravu laptopu, dal\u0161\u00ed email je odesl\u00e1n na nad\u0159\u00edzen\u00e9ho a kolegy, kte\u0159\u00ed ho budou zasv\u011bcovat a informovat o tom, jak firma a jednotliv\u00e1 odd\u011blen\u00ed funguj\u00ed.<\/p>

V men\u0161\u00ed firm\u011b s n\u011bkolika IT specialisty m\u016f\u017ee b\u00fdt sd\u00edlen\u00e1 datab\u00e1ze informac\u00ed a evidence IT majetku. Dokumenty a datab\u00e1ze nemus\u00ed b\u00fdt \u010dasto aktualizov\u00e1ny, proto\u017ee si kolegov\u00e9 p\u0159ed\u00e1vaj\u00ed informace \u00fastn\u011b nebo emailem. Pou\u017e\u00edvaj\u00ed n\u011bkolik jednoduch\u00fdch skript\u016f pro zjednodu\u0161en\u00ed procesu n\u00e1stupu, nap\u0159\u00edklad zalo\u017een\u00ed Active Directory \u00fa\u010dtu p\u0159es Powershell skript. Zbytek \u00fakon\u016f d\u011blaj\u00ed ru\u010dn\u011b v syst\u00e9mech a klik\u00e1n\u00edm. Nastaven\u00ed a p\u0159ed\u00e1n\u00ed prvotn\u00edch hesel prob\u00edh\u00e1 typicky osobn\u00ed n\u00e1v\u0161t\u011bvou nov\u00e9ho zam\u011bstnance na IT odd\u011blen\u00ed nebo p\u0159es prost\u0159edn\u00edka, nap\u0159\u00edklad vedouc\u00edho. V\u00fdjimkou nejsou bohu\u017eel ani p\u0159\u00edpady, kdy je po\u010d\u00e1te\u010dn\u00ed heslo v\u0161em u\u017eivatel\u016fm nastaveno stejn\u00e9 a u\u017eivatel\u00e9 by si jej m\u011bli po n\u00e1stupu zm\u011bnit.<\/p>

Audit (bezpe\u010dnost a prevence)<\/h3>

Ve velk\u00fdch firm\u00e1ch prob\u00edh\u00e1 intern\u00ed audit IT bezpe\u010dnosti nebo konkr\u00e9tn\u00edch p\u0159\u00edstup\u016f \u010dasto jednou rok, v bank\u00e1ch m\u016f\u017ee prob\u00edhat i n\u011bkolikr\u00e1t ro\u010dn\u011b. Kontroluj\u00ed se schv\u00e1len\u00ed p\u0159\u00edstup\u016f do aplikac\u00ed, kdo a kdy zalo\u017eil \u00fa\u010det, na z\u00e1klad\u011b \u010deho a podobn\u011b. Auditem je kontrolov\u00e1no, zda se nastaven\u00e9 procesy dodr\u017euj\u00ed a zvy\u0161uje se t\u00edm intern\u011b bezpe\u010dnost.<\/p>

V mal\u00fdch a st\u0159edn\u00edch firm\u00e1ch mohou b\u00fdt tak\u00e9 nastaven\u00e1 pravidla, av\u0161ak st\u00e1le je mnoho pr\u00e1ce prov\u00e1d\u011bno manu\u00e1ln\u011b a je zde prostor pro kreativitu nebo chybu jednotlivce. Intern\u00ed audit se \u010dasto ned\u011bl\u00e1 a rozd\u00edly v opr\u00e1vn\u011bn\u00edch a atributech u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f mohou v\u00e9st v budoucnu k chyb\u00e1m, nekonzistenci dat a t\u0159eba i nebezpe\u010dn\u00e9 kumulaci opr\u00e1vn\u011bn\u00ed. N\u00e1prava chyb pak b\u00fdv\u00e1 spojena zejm\u00e9na s akutn\u00ed pot\u0159ebou vyvolanou nap\u0159\u00edklad zm\u011bnou v infrastruktu\u0159e \u2013 nov\u00fd IT syst\u00e9m apod.<\/p>

Nebojte se auditu, pova\u017eujte audit jako kamar\u00e1da, kter\u00fd v\u00e1m uk\u00e1\u017ee slab\u00e1 a probl\u00e9mov\u00e1 m\u00edsta a navede v\u00e1s, co lze ve va\u0161\u00ed organizaci zlep\u0161it.<\/p>

Co maj\u00ed IT odd\u011blen\u00ed spole\u010dn\u00e9 a co m\u016f\u017eeme v men\u0161\u00edch firm\u00e1ch zlep\u0161it?<\/h2>

N\u00e1stupy a odchody zam\u011bstnanc\u016f<\/h3>

IT specialist\u00e9 mus\u00ed dost\u00e1vat informace od HR odd\u011blen\u00ed v\u010das, aby stihli p\u0159ipravit laptop a \u00fa\u010dty pro nov\u00e9 kolegy a kolegyn\u011b. N\u00e1stup nov\u00e9ho zam\u011bstnance je proces, kter\u00fd n\u011bkdo mus\u00ed vykonat. P\u0159edat nov\u00e9mu zam\u011bstnanci informace jako heslo do po\u010d\u00edta\u010de, vstupn\u00ed karti\u010dku a k\u00f3d do kancel\u00e1\u0159e. Pokud zodpov\u011bdn\u00e1 osoba chyb\u00ed, mus\u00ed m\u00edt za sebe z\u00e1stup (kolega, outsourcing p\u0159es firmu, automatizace).<\/p>

Ov\u011b\u0159te si, zda komunikace mezi\u00a0IT a HR odd\u011blen\u00edm je v po\u0159\u00e1dku<\/strong>\u00a0a informace se p\u0159ed\u00e1vaj\u00ed. Jak \u0159e\u0161\u00edte p\u0159eklepy a opravy ve jm\u00e9n\u011b, mate\u0159skou dovolenou? Dost\u00e1v\u00e1 IT odd\u011blen\u00ed informace v\u010das \u010di dostate\u010dn\u011b dop\u0159edu? Jak\u00e9 z\u00e1kladn\u00ed p\u0159\u00edstupy m\u00e1 nov\u00fd zam\u011bstnanec m\u00edt nastaven\u00e9? V\u00edte jak dlouho trv\u00e1 zalo\u017een\u00ed \u00fa\u010dt\u016f pro nov\u00e9ho zam\u011bstnance? Kdo m\u00e1 p\u0159edat navazuj\u00edc\u00ed informace nov\u00e9mu kolegovi? Je p\u0159ed\u00e1v\u00e1n\u00ed hesel bezpe\u010dn\u00e9, je va\u0161\u00ed bezpe\u010dnostn\u00ed politikou vynucov\u00e1na zm\u011bna v\u00fdchoz\u00edho hesla? Kdo dal\u0161\u00ed m\u016f\u017ee zalo\u017eit \u00fa\u010dty, pokud je hlavn\u00ed osoba nedostupn\u00e1? Pokud zn\u00e1te odpov\u011bdi za IT a HR odd\u011blen\u00ed, tak v\u00e1m komunikace funguje.<\/p>

N\u00e1stupy jsou d\u016fle\u017eit\u00e9, proto\u017ee bez \u00fa\u010dt\u016f nem\u016f\u017eou zam\u011bstnanci pracovat, ale z hlediska bezpe\u010dnosti bychom rozhodn\u011b nem\u011bli zapom\u00ednat na odchody u\u017eivatel\u016f a n\u00e1slednou deaktivaci jejich \u00fa\u010dt\u016f.\u00a0Jak na to nezapomenout?<\/p>

Automatizace<\/h3>

Spr\u00e1va identit lze automatizovat. Automatizac\u00ed zde ch\u00e1pejte \u201c\u0161et\u0159it \u010das a omezovat chybovost\u201d. Automatizace m\u016f\u017ee za\u010d\u00edt jednoduch\u00fdm Powershell skriptem pro vytvo\u0159en\u00ed \u00fa\u010dtu v AD a MS Exchange. Toto je z\u00e1kladn\u00ed p\u0159\u00edklad pro velkou i malou firmu na kter\u00e9m se v budoucnosti d\u00e1 stav\u011bt. D\u00e1le m\u016f\u017eeme automaticky ka\u017ed\u00e9mu zam\u011bstnanci p\u0159i\u0159adit z\u00e1kladn\u00ed AD skupiny, nap\u0159\u00edklad ho za\u0159adit do mailinglist\u016f nebo mu d\u00e1t z\u00e1kladn\u00ed pr\u00e1va na sd\u00edlen\u00e9 disky nebo automaticky vygenerovat p\u0159ed\u00e1vac\u00ed protokol IT majetku p\u0159i odchodu zam\u011bstnance.<\/p>

Vytvo\u0159en\u00ed \u00fa\u010dtu v cloudov\u00e9 slu\u017eb\u011b nebo na m\u00edru napsan\u00e9m IT syst\u00e9mu u\u017e z pohledu automatizace nemus\u00ed b\u00fdt tak trivi\u00e1ln\u00ed jako naps\u00e1n\u00ed skriptu do AD. Pokud se ale dostanete do datab\u00e1ze dan\u00e9ho syst\u00e9mu \u010di m\u00e1 syst\u00e9m dostupn\u00e9 API pro spr\u00e1vu \u00fa\u010dt\u016f, pak spr\u00e1va identit je \u0159e\u0161iteln\u00fd \u00fakol. Poohl\u00e9dn\u011bte se po Identity manager SW (IdM, IAM), kter\u00e9 nastavuj\u00ed pravidla pro jednoduch\u00e9 i komplexn\u00ed procesy. P\u0159\u00edkladem m\u016f\u017ee b\u00fdt t\u0159eba komplexn\u00ed n\u00e1stroj IdStory<\/strong>.<\/p>

Finance<\/h3>

V IT se sna\u017e\u00edme u\u0161et\u0159it za licence O365 a licence VPN p\u0159\u00edstup\u016f, kter\u00e9 souvis\u00ed p\u0159\u00edmo se spr\u00e1vou \u00fa\u010dt\u016f. Spr\u00e1vn\u00fdm nastaven\u00edm O365 licenc\u00ed pouze pot\u0159ebn\u00fdm u\u017eivatel\u016fm a jejich automatick\u00fdm odeb\u00edr\u00e1n\u00edm m\u016f\u017eete u\u0161et\u0159it desetitis\u00edce korun ka\u017ed\u00fd m\u011bs\u00edc. Jak\u00fdm zp\u016fsobem spravujete licence u v\u00e1s? M\u00e1te nejvy\u0161\u0161\u00ed licenci E5 nebo by v\u00e1m sta\u010dila O365 E3\/E1? M\u00e1te n\u011bjak\u00fd n\u00e1stroj nebo licence p\u0159id\u011blujete ru\u010dn\u011b? Kolik m\u00e1te licenc\u00ed nav\u00edc a nevyu\u017e\u00edv\u00e1te je? Zkuste si licence a u\u017eivatele proj\u00edt a zjist\u00edte, zda m\u00e1te n\u011bjak\u00e9 nav\u00edc.<\/p>

Spr\u00e1vu licenc\u00ed je mo\u017en\u00e9 \u0159e\u0161it automaticky pomoc\u00ed r\u016fzn\u00fdch management n\u00e1stroj\u016f, ale v\u011bt\u0161inou \u0159e\u0161\u00ed pouze licence a instalace. N\u011bkter\u00e9\u00a0open source Identity managery jako t\u0159eba IdStory\u00a0um\u00ed \u0159e\u0161it spr\u00e1vu licenc\u00ed a k tomu maj\u00ed dal\u0161\u00edch funkce na spr\u00e1vu u\u017eivatel\u016f, kter\u00e9 jsem popsal v tomto \u010dl\u00e1nku.<\/p>

Z\u00e1v\u011br \u2013 spr\u00e1va identit lze zlep\u0161it v\u017edy<\/h2>

Mal\u00fdch i velk\u00fdch rozd\u00edl\u016f ve spr\u00e1v\u011b IT p\u0159\u00edstup\u016f mezi spole\u010dnostmi je hodn\u011b a v tomto \u010dl\u00e1nku jsem se zam\u011b\u0159il zejm\u00e9na na rozd\u00edly v kl\u00ed\u010dov\u00e9 oblasti, kterou je spr\u00e1va identit. Zlep\u0161ov\u00e1n\u00ed nen\u00ed nikdy dost a pokud bych si musel vybrat jednu v\u011bc ke zlep\u0161en\u00ed, tak bych zvolil automatizaci. Automatizace se samoz\u0159ejm\u011b vyplat\u00ed v\u00edce, kdy\u017e m\u00e1te stovky a v\u00edce u\u017eivatel\u016f. Pozor, \u00fa\u010dty ale nemus\u00ed b\u00fdt jen zam\u011bstnaneck\u00e9 \u2013 \u00fa\u010dty m\u00edvaj\u00ed externist\u00e9, z\u00e1kazn\u00edci, dodavatel\u00e9, st\u00e1\u017eist\u00e9 a brig\u00e1dn\u00edci a dal\u0161\u00ed osoby.<\/p>

Pokud va\u0161e firma nem\u00e1 velk\u00fd po\u010det \u00fa\u010dt\u016f, ale je v pl\u00e1nu r\u016fst, zkuste si alespo\u0148 z\u00e1kladn\u00ed business a IT procesy nastavit (pravidla pro p\u0159\u00edchoz\u00ed u\u017eivatele, odchody, bezpe\u010dn\u00e9 p\u0159ed\u00e1v\u00e1n\u00ed hesla, recertifikace p\u0159\u00edstup\u016f a audity). V budoucnu se v\u00e1m to vyplat\u00ed a m\u016f\u017eete na tom stav\u011bt a funk\u010dnost roz\u0161i\u0159ovat.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Ka\u017ed\u00e1 spole\u010dnost m\u00e1 vlastn\u00ed pravidla a procesy a spr\u00e1va identit nen\u00ed v\u00fdjimkou. Ve v\u011bt\u0161\u00edch firm\u00e1ch b\u00fdvaj\u00ed ji\u017e pravidla a procesy nastaven\u00e9. V men\u0161\u00edch firm\u00e1ch b\u00fdv\u00e1 v\u00edce volnosti. Na za\u010d\u00e1tku vybereme 3 situace, kter\u00e9 ve velk\u00fdch firm\u00e1ch b\u00fdvaj\u00ed komplexn\u011bji \u0159e\u0161eny. Jedn\u00e1 se o zastupitelnost, procesy spr\u00e1vy \u00fa\u010dt\u016f a IT bezpe\u010dnost. N\u00e1sledn\u011b si uk\u00e1\u017eeme aktivity, kter\u00e9 jsou vhodn\u00e9 zlep\u0161it v jak\u00e9koli firm\u011b a jsou sou\u010d\u00e1st\u00ed identity managementu. Zkontrolujeme n\u00e1stupy a odchody zam\u011bstnanc\u016f, automatizaci t\u011bchto proces\u016f a zefektivn\u00edme spr\u00e1vu licenc\u00ed.<\/p>\n","protected":false},"author":6,"featured_media":8551,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_theme","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[32],"tags":[],"class_list":["post-8532","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-manager"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/comments?post=8532"}],"version-history":[{"count":0,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8532\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media\/8551"}],"wp:attachment":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media?parent=8532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/categories?post=8532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/tags?post=8532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}