Identity at the Center #329 - Discovering Effective User Access Reviews with Stephen Washington
Feb 3, 2025
Stephen Washington, Head of IAM at Discover Financial, brings decades of identity and access management experience. He discusses why user access reviews matter, lifecycle and service account cleanup, and how AI, identity data lakes, and policy shifts can make certifications less painful. Conversation also touches on IGA evolution and practical steps to get auditors and teams aligned.
AI Snips
Chapters
Transcript
Episode notes
Access Reviews Provide Auditable Decision Trails
- User access reviews serve as both detective and corrective controls that provide a named decision trail for auditors and regulators.
- Stephen explains they work well for small/mid companies but at scale can become checkbox exercises when reviewers rubber-stamp due to volume.
Fix Lifecycle To Reduce Recertification Noise
- Poor lifecycle management drives the need for frequent access certifications because standing permissions accumulate without removal.
- Stephen proposes time-limited access plus orchestration (IDP checks and re-provision on-demand) to avoid permanent standing permissions and reduce certification noise.
Triage Certifications With AI To Cut Volume
- Use AI/ML to triage certification items so reviewers see a focused subset of high-risk entitlements first.
- Stephen describes narrowing thousands to a few dozen by analyzing last-use, peer patterns, and privilege indicators before human review.