EverC achieves higher efficiency moving to secure just‑in‑time access

25% savings by eliminating time spent on access, teams spend more time on productive work.

Challenge: Efficiently provisioning secure access to sensitive customer data

EverC’s customers trust the SaaS provider with their sensitive e-commerce data, so ensuring that their databases in Amazon RDS are secure is a top priority for the company. “Our customers come to us with serious demands for their own security,” says Gal Bayer, EverC’s Director of IT and Security. “Being secure helps us win deals, and keep customers doing business with us.” However, provisioning access to the 20 different sensitive databases with appropriate permission sets for their rapidly growing platform team was immensely inefficient using manual processes. Gal turned to 1Password to help streamline provisioning of rightsized access and reduce risk.

Solution: Ease of implementation and adoption with bundles

When choosing a JIT access provisioning solution, EverC’s Head of Cloud Infrastructure Tomer Cohen says that the deciding factors in choosing 1Password included:

• The ease and speed of integration with his MySQL databases in Amazon RDS

• The granularity of privilege management within his databases

• Support for their identity provider (IdP) JumpCloud

As a cloud-native tool, 1Password was easy to integrate with our AWS. The platform’s ability to utilize AWS’s native tags for automated discovery of our resources made for a speedy and comprehensive setup process that got our team up and running fast.

Tomer Cohen
Head of Cloud Infrastructure at EverC

Gal and Tomer built trust with their users, rolling out Apono in RDS to users who still had local application users. They gave users time to adjust to JIT and make their first requests before revoking local access, gaining buy-in without interrupting productivity. They built on this successful adoption, expanding quickly to implement JIT in their development environments, including their crown jewel resources where their most sensitive data is stored.

“While the Access Flows were dynamic, our BI team came to us with an interesting challenge,” Gal says, explaining that they needed more expansive access to run scripts across a significant number of databases.

“The solution that we found here was the ability to create a bundle that grants access to multiple resources in a single request,” says Gal, referring to the consolidated grouping of access flows that combine policies from multiple resources, simplifying admin management of access flows. “This saves them the time from having to request each resource individually, ensuring that they get everything they need in one go.”

However for more sensitive privileges such as read/write access they created an Access Flow policy where approval from the direct manager is required.

“We have implemented a manual Access Flow for if you request admin privileges, then it requires two approvals from your direct manager and the production manager,” says Bayer, explaining that if a user has admin access to the database, then that person can accidentally (or intentionally) stop other jobs that are not related to his or her own activities. “The potential damage here is huge,” says Gal, “But by making sure that not only your own manager approves but also the production manager is in the loop, we have avoided plenty of disasters from occurring.”

Outcomes: Secure, frictionless access saves time for all

According to Tomer, moving to Apono has saved his team at least 10 hours a week on managing Joiner-Mover-Leaver Lifecycle access for their databases. EverC’s end users have also benefited, utilizing Apono Access Flows with automated approvals for many of their resources, making accessing them securely available 24/7. “Apono enabled us to centralize and optimize our processes while increasing security, all without adding additional friction for our users,” says Gal. An added benefit for Gal’s team in centralizing all access management through Apono is that every access request and usage is meticulously audited. This simplifies his reporting to his compliance team and streamlines audits for ISO 27001, SOC II, and other regulations, as well as customers.

The user experience from my Dev team’s perspective is much better, and for me, it’s so much easier to enforce compliance.

Tomer Cohen
Head of Cloud Infrastructure at EverC

Next steps

Having successfully secured access to his crown jewel resources, Gal says that, “My next step is to expand the same level of discipline to our Kubernetes clusters, ensuring that all of our access there is within scope and under control.”