CRA Process
What is it?
The Computer Resource Access (CRA) process is a critical component of CSU-Pueblo's data security architecture. All access to various network resources must be carefully tracked in order to meet the requirements of audits, ensure the integrity of data, and meet the confidentiality requirements expected of our systems. Each network resource has an 'owner' that is the primary stakeholder for that resource and retains the authority to grant access to it. The Information Technology department technically does not 'own' any of the resources and therefore cannot grant access apart from the resource owner's permission. This is where the CRA process comes in.
The Original CRA
The CRA process ensures that the appropriate permissions are granted for any new hire or anyone new to a department that needs access to the resources specifically required for them to do their job. The original CRA process was done manually on a paper that was circulated around the campus to ensure all approvals for access were complete. Once the signatures were gathered, the IT department would then grant access to the resources specified on the CRA form. This needed to be done for every hire and every person that needed access to anything on the network. It's pretty obvious how bad this was, right?
CRA 2.0 - Getting rid of all the paper!
No one wants to shuffle paper around the campus or chase it down when it gets stuck on the desk of someone who is on vacation. And although getting rid of the need for CRAs was not feasible, turning it into an electronic system was the obvious next step. It was not enough just to gather approvals, there also needed to be a way of storing the records so access could be audited when necessary to eliminate any mystery as to who-has-access-to-what.
The document management system FileBound was identified as a good candidate for this project due to its custom workflow capabilities and flexible set of features.
Phase 1 (finished)
The first part of this project was to create a workflow that enabled CRAs to be initiated by HR for new hires for basic access that is common for all system users including the ability to login and have access to email. Requests for additional access or changes to access can now be created online at the Information Technology website which creates an email-based workflow for approvals without the use of paper.
It is now easier to identify where a CRA is at in the process and approvers can be contacted directly if a CRA is waiting in their queue.
Phase 2 (ongoing)
The goal of phase two is to further speed up the approval process by automating access based on access roles associated with each department. By being hired into a specific department, the approval for the employee's access to the associated resources is assumed.
Therefore the employee can be assigned a template of access defined be the role they are hired into. Each department will be responsible for keeping their access roles template up-to-date and will receive reports on who is assigned to their roles for verification.
One of the biggest challenges of this project is in researching all the different combinations of access required to create templates for every role in the university so that the automated system can work without error.
When complete, the automated system can be completed and CRAs processed with a fraction of resources currently required.
