Walk-Through – Assessing IAM Controls

From Chapter 1, Cloud Architecture and Navigation, to Chapter 6, Tips and Techniques for Advanced Auditing, we built foundational knowledge of cloud structure, navigation, and security controls, and in Chapter 7, Tools for Monitoring and Assessing, we learned about tools available for auditing. Now, it’s time to put our learning into practice by performing some example audit walk-throughs of basic controls within the major cloud providers.

In this chapter, we’ll cover the following main topics:

• Preparing to assess cloud IAM controls
• Assessing authentication and authorization
• Assessing access assignment controls
• Assessing privileged access controls
• Assessing device controls

We will pose an assessment question for each of the topic areas and execute a basic test procedure. By the end of this chapter, you will be able to perform a basic audit walk-through of a few IAM controls across the three...

Preparing to assess cloud IAM controls

As we covered in Chapter 2, Effective Techniques for Preparing to Audit Cloud Environments, developing a good audit plan requires a thorough understanding of how the enterprise environment is architected and connected. When it comes to IAM controls, knowing that the cloud environment is federated with another identity store versus using a localized identity store only, for example, will change the test procedures that should be used and the evidence that you would expect to gather. It may also influence the points of contact within the organization you would need to work with to obtain evidence details. In addition to understanding the architecture and integration design of the environment, like other audits, it’s essential to understand the risk and control objectives the organization is trying to address as part of the cloud audit process. As we’ve uncovered throughout Chapter 1, Cloud Architecture and Navigation, to Chapter 6...

Assessing authentication and authorization

In the case of user authentication and authorization, it’s important to understand the source of identities and where they are managed. Cloud providers offer the ability to consume, share, and/or sync identity information within hybrid environments, across cloud providers, and with on-premise identity stores. As a brief reminder, authentication is the process of verifying an identity claim, and authorization is the process of verifying that the identity has the proper permissions to access content or resources. Both processes should be inclusive of human and non-human (service accounts, workload identities, and automation accounts) identities.

For our walk-through in this section, our control testing will determine whether the organization’s cloud environment adheres to a control policy that requires accounts that are inactive for 180 days to be disabled. In our example, we will walk through simple methods to obtain this...

Assessing access assignment controls

Beyond establishing who can access an environment and what they can do, another important area to assess is who can configure or modify access assignments for identities. In some environments, the assignment of access may be a completely automated procedure through account life cycle workflows. However, even with this automation, it’s important to establish who can modify it and influence the access being granted. It’s also important to clarify whether there are any exception processes in place that could potentially bypass that automation.

In this walk-through, we will assess which identities can perform user and access administration. For our control, we will look at testing Azure and GCP cloud environments to validate that all user access is provisioned through the organization’s entitlement life cycle process. For our example control, we need to verify that there is no evidence of access being manually assigned.

...

Assessing privileged access controls

As an auditor, it’s important to understand who has been granted privileged access within an environment. Knowing who has been granted privileged access and whether that level of access is appropriate given the individual’s job responsibilities is often a foundational step before assessing other IT general computing controls.

AWS IAM

One primary way of identifying users in AWS that have privileged access is by reviewing which users have access keys and when those access keys were last used. To pull this evidence, you can perform the following steps:

1. Navigate and log on to the AWS console.
2. Select the Identity and Access Management (IAM) service.
3. Select Users within the Access management option.
4. Within the Users report, you can review and filter users by a given set of criteria. To ensure all relevant options are visible in the report, you will need to open Preferences and ensure the options related to privileged...

Assessing device controls

In our last walk-through session for IAM controls, let’s look at assessing a common control related to devices – the configuration of multi-factor authentication (MFA). In our sample walk-through, we will validate whether MFA is being enforced for all users and their devices in our AWS and Microsoft Azure cloud environments.

AWS IAM

In the previous section on assessing privileged access controls, we saw that AWS provides a Users report within the Identity and Access Management (IAM) service. As shown in Figure 8.16, we can see that MFA requirements for individual users can be found here. In the screenshot, we can see that the user is not enrolled in or required to use MFA, which would mean the control test fails in this instance:

Figure 8.16 – The AWS IAM Users report column selection

Another way to see the same information is within the credential report, which we reviewed in the section on assessing...

Summary

In this chapter, we performed a walk-through of common and practical IT general computing controls that may be performed when auditing cloud environments. We covered steps to assess authentication and authorization and reviewed that in a multi-cloud environment, these controls should be tested in all clouds. We also performed an assessment of access assignment controls and executed steps to determine who has privileged access.

We finished this chapter by performing a walk-through of a device-related control (MFA) and saw the importance of understanding how relying on overview details as test results could prevent the detection of configuration that does not align with the control objectives.

In the next section, we’ll continue with our walk-throughs – this time assessing policy settings and resource controls.