Accelerate audits with the Member Access report

Use the new member access report to easily review users’ privileges and access for fast auditing and risk identification. It consolidates the number of items, groups and collections that a user has access to in one view, allowing for quick adjustments in just a few clicks.

In a company’s early stages, roles are straightforward and managing access and privilege is simple. As a company grows, initial permissions may persist as roles evolve and responsibilities shift. Here are examples of how a user may naturally become over-privileged:

• An employee transitions to a new role, but access from their previous role is not revoked, whether by oversight or intentionally to support their backfill

• A team expands from two to 30 members, making permissions and responsibilities more granular, yet founding members may still retain broad access

• Temporary access granted to an employee or contractor becomes permanent if not properly revoked 

• An offboarded employee retains  access for weeks or months after, turning into a zombie account

Regular internal access audits help prevent privilege sprawl and security gaps, ensuring appropriate access.

The new member access report streamlines viewing and aggregating user access details to  vault items granted through groups and collections. This provides administrators granular, actionable insights into who has access to what, enabling efficient access audits, enforcing the principle of least privilege, and ensuring compliance.

The report provides an at-a-glance view of the groups, collections, and items assigned to each member, making it easy to spot risks. For example, if a user has access to an unusually high number of items, it could indicate excessive permissions. 

A marketing manager, for instance, typically only needs access to a few collections pertaining to  marketing, content, and campaign credentials. However, if they were assigned to a large number of items or to more technical collections, their permissions may exceed what’s necessary. The member from the report can be clicked on to view and quickly adjust permissions as needed.

Additional details can be found in the CSV export of the report, including readouts of the specific collections a user has access to and other security attributes such as whether two-step login (2FA) is activated or they are enrolled in Account Recovery.

As companies evolve, it’s important to enforce the principle of least privilege and compliance through regular access reviews. 

Regular security audits are essential for maintaining compliance and security, which access reviews play a key role in, to meet regulatory and industry standards such as SOC, GDPR, and HIPAA. These access reviews should be conducted on a recurring basis, where companies review permissions granted to users across applications, databases, and systems.

Conducting access reviews across the tech stack is a critical but often overwhelming task, especially as organizations grow and onboard new employees. The member access report simplifies this task and allows organizations to take a proactive approach to access management. Rather than waiting for the next security audit cycle, administrators can continuously monitor access and take action during offboarding or departmental changes.

Try a free 7-day trial of a Bitwarden business plan and explore the benefits of a centrally-managed password manager. Other security features such as integrations with Security Information and Event Management (SIEM) tools, auditable event logs, and vault health reports make up a suite of vulnerability assessments that all work to improve your security posture. Learn more about how Bitwarden brings value to your business and secure your business today!