IAM & Cloud Computing Security Risks

User management

In a traditional IT environment, users are managed by the organization itself. In a cloud computing environment, the users might be managed by the cloud service provider. Not being in control of all user data could make it difficult to comply with local laws and regulations for personal information. In case the cloud service provider is located in a region with different laws and regulations in place, the organization might be in noncompliance with the local laws and regulations.

Organizations may also be at risk because of possible differences in requirements for data security, or incompatible technology between the organization and the service provider. This might result in confidential or personal information being accessed or modified by unauthorized users. 

Organizations using the cloud services could have no control over the changes made to user management by the cloud service provider (E.g. The service provider could decide to store users differently, making it incompatible and/or noncompliant with the requirements of the organization using the cloud services.

Not being in control of user management makes it very difficult to verify if an update to the user data is successful.

Authorization management

There might be differences in authorization models used by the Cloud service provider and the organization using the cloud services. For example, if the organization has implemented a role-based access control model to manage authorizations and the Cloud service provider does not support this, it is difficult to synchronize authorization of users. Not being able to synchronize the authorization of users makes it impossible to ensure that users only access the resources that they are authorized to access. Incorrect authorization management can lead to noncompliance with laws and regulations.

Organizations might not be in a position to verify if authorization protocols of its users (in terms of which resources a user is able access) have been diligently followed by the Cloud service provider.  Therefore, organizations might not be able to detect erroneous authorizations (if any) done by the service provider. The organizations using cloud service are ultimately accountable for the authorization of their users, but the cloud service provider might have control (at least partial), over the processes involved.

Access management

Organizations using cloud services might not be able to control the enforcement of their security policies on the services provided by the cloud service providers, who ultimately control access to their services. In order to gain access to public cloud services, an Internet connection is generally used instead of a local network connection. Securing a local network is a lot easier than managing security on the Internet. The Internet is a public network that can be accessed by anyone with any compatible device. Another risk is the dependency of the Internet; if the connection to the Cloud service provider fails, the cloud services can no longer be accessed by the organization. Also, the fact that data is not stored and managed by the organization using the cloud services makes it very difficult to verify who has access to this data.

The possibility that there could be loss of control over the access management process combined with the fact that the cloud service are accessed over a public network, could pose certain risks to organizations using the cloud services. If data is not adequately protected, anyone using the Internet could gain access to the data of the organization using the cloud services. This data could be protected by laws or regulations, which would make the organization noncompliant.

Data management and provisioning

In the cloud computing environment, the data of the organization using the cloud services might be stored on the servers of the Cloud service provider. The organization using cloud services might not have control of this data.

There might be a risk of using incompatible technologies or incorrect deprovisioning, which might lead to unauthorized users continuing to have access to the cloud services even after dismissal. This could make the organization using the cloud services noncompliant with any applicable laws and regulations and put the data at risk of being stolen or lost. In addition to this, since data stored in a cloud environment might no longer be managed by the organization owning the data, requirements for removal and encryption might not be implemented according to the security standards and regulations.

Monitoring and auditing

In a cloud computing environment, the data of organizations using cloud services might be stored in the servers of the service provider. The Cloud service provider might control a part of the IAM processes, which might result in a lack of control of the monitoring and auditing processes. In a traditional IT environment, the organization can monitor and audit its own systems and network. When using cloud services, an organization might not have control over this part of IAM.

Organizations might be required by regulations to audit their processes, systems, and network periodically. However, it may not always be possible for the organization to audit the Cloud service provider which might be responsible parts of the IAM processes. It could also be storing a part of the data. In such cases, the organization using cloud services might be noncompliant with the regulations.

Organizations using the cloud services might not be in control of the quality and frequency of logging, monitoring, and auditing if the control lies with the cloud service provider. Additionally, not being able to monitor and audit cloud services could make it difficult to detect unauthorized access to data.

Figure 2: Summary of risks faced by organizations at each stage of the IAM Process

Apart from the above, Shadow IT and Lack of visibility and control are major risks faced by organizations as a result of the significant changes in the work environment brought about by the recent developments in cloud technology.

Shadow IT

Shadow IT is the use of unsanctioned apps or technology for work related purposes.  Employees might be doing to in order to solve business problems or to get around IT challenges or funding constraints, but this still constitutes risk.  This could mean that confidential and/or regulated data is exposed to sources outside of the organization or it could mean that data is being stored at undetermined locations without the knowledge of the organization.

Visibility and Control

In addition to the shadow IT practices, there are huge number of sanctioned could apps being used in organizations.  As a result of this, data is distributed over a huge number of cloud apps and organizations are losing the ability to maintain visibility and control over what apps are being used and how data is managed in these apps.  

Shadow IT and lack of visibility and control exposes organizations to myriad risks that they might not even be aware of.  This risk could manifest in the form of noncompliance with laws and regulations, loss or breach of data because of user error, or a malicious outsider or insider attack. Some apps have security built in but most of them work on shared responsibility models which means cloud vendors do not own the client’s data nor are they responsible for how it is used.

Mitigating IAM risks in the cloud computing environment

Organizations using cloud services need to perform a thorough risk analysis; carefully considering all the risks involved and put controls in place to mitigate those risks.

The first step in addressing these risks would be to select cloud service providers based on their ability to ensure compliance with the organizations operational and security requirements, as well as their ability to comply with the applicable laws and regulatory requirements.

The second step would be to ensure that robust contracts and service level agreements are established with the service providers setting strong emphasis on having controls in place to mitigate all the risks identified. Special focus should be given to aspects including (but not limited to):

• Compliance to laws and regulations.
• Data security Requirements.
• Change management (allowing the organization to have control over any changes made to the IAM processes, authentication mechanisms, etc).
• Right to audit the Cloud service provider (allowing the organization to audit the IAM processes among other things).

The third step would be to audit the cloud service providers periodically enabling the organizations to verify if the service providers are in fact compliant with the contractual and SLA obligations, which will in turn ensure that all the security concerns are addressed to the satisfaction of the organization.

In addition to the above, there are several solutions available to organizations using which they can mitigate the Identity and Access Management risks and challenges discussed above. Here are a few important ones among them:

Single sign-on (SSO)

This is a process used for authentication which enables users to access multiple applications, services, and accounts with just one set of login credentials.

One example of SSO is the Google login, which enables users to access multiple Google applications like Gmail, Google Drive, etc with the same set of login credentials.

Some of the advantages of SSO are:

• Users do not need to log on to multiple applications and remember multiple passwords.
• Higher security and better compliance resulting from a centralized single sign-on system, which enables easier monitoring of user accounts across multiple applications.
• Reduces the risk of phishing since there are lesser number of passwords to protect.

Enhanced Security

Organizations can identify critical applications and systems housing sensitive data and increase the security levels for these applications. This can be achieved by adding additional layers of security using Multi-factor Authentication.

Multi-factor authentication is an authentication method in which the user needs to provide two or more different proofs of identity before being granted access to a system. The authentication factors are based on knowledge, possession, and inherence.  Knowledge is something that only the user knows (E.g. passwords, passphrases, personal identification numbers, etc).  Possession is something that only the user has (E.g. Hardware or software tokens). Inherence is something that only the user is (E.g. Biometrics, fingerprint, face recognition, etc).

Resource Level permission/access control

Resource level access control enables organizations to control which resources a particular user is allowed to access and what kind of actions the user is permitted to perform on that resource.  This can be applied at an individual user level or at a group level (Role based).

This is somewhat akin to the Japanese Poka-yoke or fail-safe principles used in Quality Control; having control at a level of granularity, where you are essentially making it (nearly) impossible for unauthorized individuals to gain access or unduly modify resources.

Cloud Access Security Broker (CASB)

Cloud Access Security Brokers are security tools which help organizations set policy, monitor user behaviour, and manage risk across all the cloud services and service providers being used in an organization. CASBs (pronounced as cas-bee) enable organizations to control access to sanctioned cloud apps and prevent access to unsanctioned cloud apps, and help them protect sensitive data. CASBs use techniques like “user risk scoring” and “behaviour fingerprinting” to detect anomalous or suspicious activity by users to prevent accidental or malicious breaches.

CASBs might run on the client’s premises, or they might run in the cloud.  CASBs act as intermediaries between users and the cloud apps; they monitor user activity and enforce security policies.

CASBs provide a wide gamut of security services including Data Loss Prevention, and Malware protection, however, for the purpose of this article; only the aspects related to the IAM risks discussed previously in this article are addressed.

Access control
CASBs usually do not store User Identity data; instead, they work with the client organization’s Active Directory.  The organizations Active Directory groups are utilized to make Access control decisions. CASBs can control access to specific cloud apps for users (individuals or groups) based on device type, user behaviour, etc. Specific users or groups can be authorized to use specific apps. CASB’s can analyze risk related data like user behaviour, type of data, device being used, etc in access control decisions and initiate step-up authentication. 

There is no HR Identity feed or personnel information housed with the CASB, instead, there is a tight integration with the client organization’s Active Directory, so the organizations AD groups can be used in Access control decisions. Unsanctioned apps can be blocked and attempts to access undesirable apps can be used to educate users and steer them towards sanctioned apps.

Visibility
CASBs analyze logs from the edge of network devices like routers, switches, and integrated access devices to track the cloud apps being used.  This provides visibility into who is transferring the data, what data is being transferred, the volume and the type of data being transferred, and the locations to which the data is being transferred. This data can be used to identify policy violations and can be incorporated into policy construction in the CASB.  Once this has been incorporated into CASB policy, any similar undesirable actions can be prevented.

CSP vendor risk management
CASB vendors maintain dynamic lists of thousands of cloud applications and their risk profiles.  CASB vendors continually research cloud apps to keep the risk profiles accurate and up-to-date. They analyze terms and conditions and determine to what extent the vendors are responsible for data.  They analyze service organization controls or SOC reporting for effectiveness of security controls. And they also send security questionnaires to cloud service providers to gather information.

CASBs provide organizations with dashboards containing vendor risk profiles and ratings which help organizations to select the right vendors based on their risk appetite.

Cloud Access Security Brokers when used in conjunction with other IAM security solutions like Single sign-on tools and Multi-factor authentication techniques can be extremely effective in mitigating the cloud IAM risks.   An example of this is adaptive or risk-based authentication wherein, if a user is exhibiting what is seen to be risky behaviour when accessing a sensitive resource, the user is challenged to provide step up authentication (additional multi-factor authentication) to ensure that the resource is not accessed by unauthorized entities.

IAM Success Stories ^[4]

NASDAQ
Being the second-largest stock exchange in the world in terms of value, NASDAQ supports markets in over 50 countries and has to comply with strict regulations.  They faced a challenge where they had to integrate modern cloud apps and platforms with their internal processes.  This resulted in a complex matrix of controls which complicated the IAM process.

They were able to solve this problem by implementing Single Sign-on across their entire organization.  Users now had to remember only one password for accessing internal and external applications.  Enhanced security prevented the login credentials from being compromised without causing undue inconvenience to the users.

Adobe
When Adobe transformed into a cloud-first organization (from Adobe Creative Suite to Adobe Creative Cloud), there was a huge shift in their business model and it was faced with the immense challenge of providing secure access to a large number of enterprise customers. 

Instead of spending resources on building an internal solution, Adobe opted to engage the services of third-party IAM service providers, implementing Single Sign-on for its employees worldwide, and a comprehensive authentication layer for all their cloud applications.  This helped them gain massive growth in their customer base and revenues.         

21st Century Fox

Being one of the biggest content producers of the world, 21st Century Fox needs to collaborate with third parties, manage digital workflows and connect with content creators and professionals across multiple devices and platforms. Their traditional network security measures were not adequate to deal with this complex scenario.

Realizing that there was an urgent need to update their security strategy, they implemented adaptive Multifactor authentication.  With adaptive Multifactor authentication, in addition to having two or more factors of authentication, if any suspicious activity is observed when a user is attempting to access a resource, the user is required to proved additional authentication factors.  These steps have hugely reduced the risk of data breaches.