Traditional network security adopts a “castle and moat.” The castle represents the internal network that contains valuable data and resources. The moat represents the perimeter of the network, fortified with security measures. These perimeter protection systems include firewalls, intrusion detection, and access controls.

The widespread adoption of cloud technology has made the perimeter irrelevant. With it, the “castle and moat” approach also becomes unsuitable for keeping the network safe. The new nature of challenges forces security teams to adopt an identity-based approach.

Identity and Access Management (IAM) allows enterprises to manage the digital identities of users. It ensures access only to authorised employees, customers, or other stakeholders. Well-defined IAM ensures that only the right individuals access the right resources at the right times for the right reasons.

But the challenge is the sheer number of identities. The increase in the number of cloud services leads to the provision of more and more identities in service provider environments.

In PaaS and IaaS clouds, every asset has an identity. For most enterprises, the number of identity roles and policies soon spiral out of control. Tracking, monitoring, and controlling cloud accounts becomes a problem.

The proof of the pudding is the eating. In 2021, 84% of IT teams experienced an identity-related breach. Identity-focused security measures could have prevented 96% of such instances. 

Enterprises now seek stronger identity and access management (IAM) solutions to improve security. Here are the top cloud IAM best practices, to such ends.

Embrace the zero trust approach

The traditional “castle and moat” approach assumes every device or user is legit and safe once they access the server or resources. The zero-trust approach assumes everything is a threat unless proven otherwise. Users, devices, or services access specific resources by providing credentials. The system keeps verifying users with no implicit trust at any stage. 

Enforce the principle of least privilege

The principle of least privilege grants users and services only the least permissions to perform their tasks. Such an approach minimises the risk of unauthorised access and compromised credentials.

To put in place the principles of least privileges:

• Develop internal standards for account creation. Enforce controls such as authentication and authorisation for each account.
• Implement role-based access controls (RBAC) to manage permissions and access levels. The traditional approach assigns rights to individual user accounts. RBAC defines granular permissions for pre-defined roles. It syncs access with job responsibilities for each role, ensuring users do not have extra privileges needed to do their jobs.
• As an extra check, track the process of creating privileges.
• Establish robust data governance practices. Have clarity on how DevOps and other teams integrate identities and privileges into cloud deployments.

Implement Segregation of Duties (SoD) 

Identify and access management problems arise when users have too much power and such user accounts get compromised. Segregating administrative roles and responsibilities preempts such issues. If a single user does not have too many privileges, the potential damage through a possible compromise of such accounts also reduces. 

SoD defines policies that establish granular permissions for each role. It makes clear assignments of specific tasks to specific roles. This:

• Reduces the risk of privilege-heavy accounts making breaches or configuration errors.
• Enables a clear audit trail and makes it easy to pinpoint the source of any issues.

Use Multi-factor authentication 

Implement multi-factor authentication (MFA), especially for admin accounts with privileges. MFA adds extra security layers through multiple authentication forms. 

The most common type of MFA is a combination of a password and a one-time code delivered on the user’s registered mobile device. Other advanced types of MFA include biometric scanning, hardware tokens, and the like. MFA blunts most traditional attacks.

Embrace centralisation 

A centralised identity management solution simplifies user management. It manages all user identities, credentials, and access across the cloud environment. 

Centralisation:

• Simplifies user management. It creates a secure “front door” to all apps and services.The security team needs to secure only the “front door” instead of managing multiple doors.
• Ensures consistency. It reduces the risk of inconsistent or outdated access controls across different parts of the network. 

Leverage federation to centralise authentication and authorisation for end-user accounts. Federation refers to the system of trust that allows users to access different domains using a single set of credentials. It depends on pre-established agreements between organisations. Each organisation trusts the other to authenticate users. 

For best results, use a single sign-on (SSO) portal that accommodates federation.

Protect access keys

Human users access cloud resources using usernames and passwords. Machine-to-machine access is through access keys that authenticate applications or users. Unlike passwords that have limited validity, access keys enable long-term access. To mitigate the IAM security fallouts related to access keys:

• Rotate access tokens to minimise the risk of compromised credentials. Create new tokens and switch applications that use the new token. 
• Delete old and/or inactive access keys. Conduct periodic exercises to identify and delete such keys. Running automated scripts makes the task easy.
• Create non-person identities, such as an AWS Role, with short-lived access.

Implement bastion services 

Bastion services offer secure access points between public and private clouds, and serve as intermediaries between privileged users and critical workloads. These services integrate with IAM policies and controls, adding another layer to the security, and improving visibility. 

Most cloud service providers offer bastion services as managed services. It eliminates the need for manual configuration and maintenance and reduces the operational burden for IT teams. 

Log privileged access accounts

Admins and DevOps teams need privileged access to get their jobs done. Log activities from such accounts to ensure integrity. Audit logging and monitoring track user activities to unearth suspicious activities, such as accessing resources at odd hours. 

Logging comes with its fair set of challenges though. Collecting logs from disparate applications, devices, and services can be complex and time-consuming. The sheer volume makes it overwhelming to distinguish abnormal issues from usual activities. Worse, logs from different sources may use different formats, structures, and timestamps. This inconsistency makes it difficult to centralise, aggregate, and analyse logs.

To overcome such challenges,

• Implement a central log management platform to collect and aggregate logs from disparate sources. Centralisation streamlines analysis and eases troubleshooting.
• Define a common logging format across all systems upfront to simplify log parsing, analysis, and correlation.
• Set up automated filtering rules that highlight critical events and minimise false positives.
• Implement secure storage solutions and robust access controls to ensure log data integrity.

Conduct regular reviews and audits 

Despite the best precautions, some threat actors still compromise accounts. To nip such threats in the bud:

• Review user access and permissions to ensure everything is in order. Conduct such exercises at regular intervals. 
• Revoke access for inactive or terminated users without delay.
• Facilitate incident response in case of a breach or security incident. Also, enable forensic analysis for port-mortem analysis.

Use automation

Leverage automation tools and scripts to reduce the risk of human error. Automation also ensures consistent enforcement of policies.

Automated tools streamline access management processes, multi-factor automation, centralised SSO, SoD enforcement, and more. Another key area of automation is deprovisioning user accounts on exit. If the user account remains, the departing employee may use it to settle a grudge against the enterprise or his supervisors. Threat actors also target dormant accounts, as the detection chances are low. 

Conclusion

Implementing the above IAM best practice requires robust tools that cover everything. OpenText’s NetIQ identity and access management solution fits the bill. The suite delivers comprehensive IAM services for user identities across devices and locations. The solutions make identity management central to cloud security management. It co-opts the latest approaches, including privilege discovery, credential vaulting, and change monitoring. NetIQ access management enables simplified and ultra-secure access to the right users. The identity and access management solutions offer comprehensive identity and access services. The data access governance solutions address threats from unauthorised access. The identity governance and administration platform streamlines resource access, manages risks, and improves business agility.