The Challenge

Ipiranga faced a scenario of weak governance over generic accounts, resulting from an outdated inventory and the decentralized grant flow of non-nominal access.

The absence of standardization and control hampered traceability, increased exposure to safety risks, and compromised compliance with the controls required by the Sarbanes-Oxley Act (SOx).

Objective of the Project

‍

The project focused on updating the inventory of non-nominal users (generic and service accounts), with the purpose of:

• Diagnose risks associated with these accounts through SoD (Segregation of Duties) analysis and critical permissions;
• Strengthen traceability and access security in sensitive environments;
Reduce risks of misuse or unnecessary access;
• Support compliance with SoX requirements through structured governance;
• Complement the identity management process front conducted previously by Vennx.
‍

Approach and deliveries

‍

• Update of the complete inventory of non-nominal users, focusing on systems classified as critical or within the SoX scope;
• Identification of previously uncatalogued accesses;
• Inclusion of “log on to” information in service accounts in Active Directory (AD), ensuring that generic users are limited to specific authorized servers;
• Mapping and validation of profiles with technical managers;
• Execution of obsolete or improper access revocations, based on risk analysis.
‍

Achieved results

‍

• Updated Inventory of Non-Nominal Users, with the regularization of missing data and standardization of information;
• Reduction of risks related to shared accounts or accounts without clear identification of use;
• Greater control over critical permissions in legacy systems;
• Strengthening access governance, in alignment with the pillars of information security and regulatory compliance.
‍

The initiative consolidated an essential layer of Ipiranga's access governance, allowing visibility, control, and security over generic accounts in critical environments. Preventive action reinforces commitment to good IT practices, protection of sensitive assets, and compliance with external audits.

‍