In March 2021, we posted a three-part series about whether cloud-native identity and access management (IAM) controls are good enough for an enterprise. Many of the points we raised at that time are still valid. However, the industry has developed and learned a lot since then.
More companies and analysts now recognize cloud identity and access governance (CIAG) as key. The lack of CIAG is a potential threat to any organization with a cloud environment. This is a big step forward. After all, you can only fix problems you know about.
The Challenges of a Cloud Environment
When you have a cloud environment (or multicloud environment), one of the biggest challenges is to understand what’s really happening with users and access rights. Why? Freely granting undefined access to anyone who needs to manage a cloud device creates uncertainty within and among environments. Therefore, it’s difficult to manage access privilege controls.
If threat actors obtain access rights, they can breach the system. Many of the access conditions in cloud environments hold privileges in such a way that they can create a back door into the business. For example, an administrator might have access to business data. The misuse of these privileged access rights can cause severe damage to your data, people and reputation.
A good example of the impact of unmonitored access is the Lapsus$ group. They used human and non-human identities to get access to cloud accounts and stage further attacks. Once they had the identities, they could then set up virtual machines for nefarious purposes and make other unwanted inroads.
What Is CIAG?
The first goal of CIAG ..
Support the originator by clicking the read the rest link below.
