{"id":106367,"date":"2020-02-26T06:00:27","date_gmt":"2020-02-26T14:00:27","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=106367"},"modified":"2020-07-31T10:46:38","modified_gmt":"2020-07-31T17:46:38","slug":"cloud-iam-security","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2020\/02\/cloud-iam-security\/","title":{"rendered":"The Role of Identity Access Management (IAM) in Cloud Security"},"content":{"rendered":"

It has been well established that certain traditional IT security paradigms must be reimagined when approaching cloud native security. One component of a strong security posture takes on a particularly critical role in the cloud \u2013 identity. The concept of identity in the cloud can refer to many things, but for the purpose of this discussion, we\u2019ll focus on two main entities: users and cloud resources.\u00a0<\/span><\/p>\n

Historically, defense-in-depth was mostly performed through network-layer controls. Advanced threat prevention tools are able to recognize the applications that traverse the network and determine whether or not they should be allowed. This type of security is still very much required in cloud native environments, but it\u2019s no longer sufficient on its own.\u00a0<\/span><\/p>\n

Public cloud providers offer a rich portfolio of services, and the only way to govern and secure many of them is through identity and access management (IAM). In this blog we examine three specific challenges security teams face in regard to IAM, as well as guidance on remediation.\u00a0<\/span><\/p>\n

 <\/p>\n

Identity and Access Management<\/b><\/h2>\n

IAM is a cloud service that controls the permissions and <\/span>access for users<\/span><\/a> and cloud resources. IAM policies are sets of permission policies that can be attached to either users or cloud resources to authorize what they access and what they can do with it.<\/span><\/p>\n

The concept \u201cidentity is the <\/span>new perimeter<\/span><\/a>\u201d goes as far back as the ancient times of 2012, when AWS first announced their IAM service. We\u2019re now seeing a renewed focus on IAM due to the rise of abstracted cloud services and the recent wave of <\/span>high-profile data breaches<\/span><\/a>.\u00a0<\/span><\/p>\n

Services that don\u2019t expose any underlying infrastructure rely heavily on IAM for security. For example, consider an application that follows this flow: a Simple Notification Service (SNS) topic triggers a Lambda function, which in turn puts an item in a DynamoDB table. In this type of application, there is no network to inspect, so identity and permissions become the most significant aspects of security.\u00a0<\/span><\/p>\n

\"Alt<\/span><\/div>
Figure 1: Example application flow<\/figcaption><\/figure>\n

As an example of the impact of a strict (or over-permissive) IAM profile, let\u2019s consider the Lambda function. The function is only supposed to put items in the DynamoDB table. What happens if the function has full DynamoDB permissions? If the function is compromised for whatever reason, the DynamoDB table is immediately compromised as well, since the function could be leveraged to exfiltrate data.\u00a0<\/span><\/p>\n

If the IAM profile follows the \u201cleast-privilege\u201d principle and only allows the function to put items in the table, the blast radius will be greatly reduced in the case of an incident. A hands-on example of this can be found in this <\/span>CNCF webinar.<\/span><\/a><\/p>\n

Managing a large number of privileged users with access to an ever-expanding set of services is challenging. Managing separate IAM roles and groups for these users and resources adds yet another layer of complexity. Cloud providers like AWS and Google Cloud help customers solve these problems with tools like the Google Cloud IAM recommender (currently in beta) and the AWS IAM access advisor. These tools attempt to analyze the services last accessed by users and resources, and help you find out which permissions might be over-privileged.\u00a0<\/span><\/p>\n

These tools indicate that cloud providers recognize these access challenges, which is definitely a step in the right direction. However, there are a few more challenges we need to consider.\u00a0<\/span><\/p>\n

 <\/p>\n

Identity and Access Challenges<\/b><\/h2>\n

IAM and SSO<\/h4>\n

Most businesses today use some form of single sign-on (SSO), such as Okta, to manage the way users interact with cloud services. This is an effective way of centralizing access across a large number of users and services. While using SSO to log into public cloud accounts is definitely the best practice, the mapping between SSO users and IAM roles can become challenging, as users can have multiple roles that span several cloud accounts.\u00a0<\/span><\/p>\n

 <\/p>\n

Effective permissions<\/h4>\n

Considering that users and services have more than one permission set attached to them, understanding the effective permissions of an entity becomes difficult.\u00a0<\/span><\/p>\n

\u201cWhat can Mary access? Which actions can she perform on these services? If she accesses a virtual machine, does she inherit the IAM permissions of that resource? Is she part of a group that grants her additional permissions?\u201d With layers upon layers of configurations and permission profiles, questions like these become difficult to answer.\u00a0<\/span><\/p>\n

 <\/p>\n

Multi-cloud<\/h4>\n

According to <\/span>RightScale<\/span><\/a>, more than 84% of organizations use a multi-cloud strategy. Each provider has its own policies, tools and terminology. There is no common language that helps you understand relationships and permissions across cloud providers.\u00a0<\/span><\/p>\n

 <\/p>\n

Getting IAM Security Right<\/b><\/h2>\n

IAM is only one, albeit crucial, aspect of cloud security. Businesses must look at IAM as a part of their overall security posture and add an integrated layer of security across their application lifecycle. We\u2019d be remiss if we didn\u2019t mention that this is where a <\/span>Cloud Native Security Platform<\/span><\/a> such as Prisma Cloud would come in handy.\u00a0<\/span><\/p>\n

Cloud providers deliver a great baseline for implementing a least-privileged approach to permissions. As cloud adoption scales in your organization, the challenges mentioned above and more will become apparent, and you might need to look at multi-cloud solutions to solve them. As a starting point:<\/span><\/p>\n