An on-call schedule is a schedule that specifies which employee or team member is responsible for responding to incidents or emergencies outside of normal working hours. On-call schedules are typically managed using a scheduling tool or software, which allows managers or supervisors to easily create and manage schedules, assign on-call duties, and track response times and performance metrics. These tools can also be used to automate the scheduling process, reducing the administrative burden and ensuring that schedules are created fairly and equitably. Popular on-call providers include PagerDuty and Opsgenie.

However managing access during on-call is really difficult. Not having the required permissions to triage urgent issues has forced many companies to provision engineers permanent admin access to production systems – often through birthright access. This significantly increases the risk of compromised engineers because they have privileged access all of the time – even when they don’t need it. On the other end of the spectrum, companies can choose to revoke all access to production systems. Anyone who requires access must make a request, which will be manually triaged. Although this practice guarantees a much stronger security posture, it also greatly increases the operational overhead and can severely impact response times if there are any errors.

How to Automate On-Call Access Management

Revisiting the principles of least privilege – granting the right level of access to the right people for the right amount of time – on-call access management requires customers to adopt both security and agility. Opal has partnered with the leading on-call provider, PagerDuty, to provide a new solution. This new approach highlights the least privilege - granting the right level of access to the right people for the right amount of time.

Right level of access: Instead of granting full admin access to engineers, Opal can grant fine-grained resources as a bundle.

To the right people: Rather than granting access to engineers based on static job functions, Opal can grant privileged access based on dynamic needs, such as whether an engineer is assigned to a Pagerduty on-call schedule or not.

For the right amount of time: Instead of granting permanent access - Opal's pagerDuty integration will grant access when engineers are on-call and revoke it when they are off-call. You can learn more about Opal's integration with PagerDuty through the official documentation.