Implementing Identity and Access Management

The core principle of identity and access management in the cloud is that everyone and everything in it is an identity. In this chapter, we will learn how we can manage identities and control their behavior by granting them specific roles, allowing them to perform only those activities that are related to the primary job of an administrator. We will see that Role-Based Access Control (RBAC) is very important to keep our cloud environments secure. We will learn about authenticating and authorizing identities, how to deal with least privileged accounts, what eligible accounts are, and why a central depository is needed. We will learn how we can federate with Active Directory from the various public clouds.

After this chapter, you will have a good understanding of technologies such as federation, single sign-on, multi-factor authentication, privileged access management, and Identity as a Service (IDaaS).

In this...

Understanding identity and access management

Identity and access management (IAM) is all about controlling access to IT systems that are critical to a business. A key element of IAM is Role-Based Access Control, or RBAC for short. In an RBAC model, we define who is allowed to have access to systems, what their role is, and what they are allowed to do according to that role. An important principle of RBAC is least privilege, meaning that a system administrator will only get the rights assigned that are required to perform the job. For example, a database administrator needs access to the database, but it’s not very likely that they will need access to network switches too.

In this chapter, we will discuss concepts such as Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Privileged Access Management (PAM). Before we go into those, let’s have a look at the basics of IAM. There are three...

Using a central identity store with Active Directory

One of the most used identity stores is still Active Directory. Before we get into AD itself, it’s important to understand that it should definitively not be confused with Azure Active Directory. The key difference is that Azure AD is a cloud-native IDaaS solution whereas AD is a traditional Lightweight Directory Access Protocol (LDAP), a network protocol that determines how information is exchanged from directory services using, for instance, TCP/IP.

Understanding AD is not easy, but basic knowledge is necessary when talking about IAM. An enterprise should only have one central directory. Identities should only be kept in one place. That also comes with a risk—if a directory gets breached, an attacker will have access to all identities that exist within the enterprise. It’s crucial that the directory and the IAM system are very secure and that directory data is extremely well protected. This...

Join our book community on Discord

https://packt.link/multicloud

Whatever we do in the cloud, it needs to be secure. Cloud providers only provide tools. You need to define how to use these tools. In order to determine what these tools should do, you need to think about what type of assets you want to protect and how you need to protect them. There are quite a number of security baselines; for example, the baseline as defined by the Center for Internet Security (CIS), which provides guidelines.

We will learn what a security framework is and why it's important as a starting point for security policies. We will discover what we need to protect in our cloud environments. Next, we will look at the globally adopted CIS benchmark for Azure, AWS, GCP, Alibaba Cloud and OCI and learn how to implement CIS using the security suites of these platforms. Lastly, we will learn what the difference is between security governance and management. Lastly, we will study Cloud Security Posture...

Understanding security policies

Let's start from our traditional, on-premises data center—a building traditionally used to host physical equipment that runs applications and stores data. The building is very likely secured by a fence and heavy, locked doors that can only be opened by authorized personnel. Access to the computer floors is also secured. There may be guards in the building or CCTV systems watching over equipment 24 hours a day. The next layer of defence is the access to the systems and data. Access to systems is strictly regulated: only authorized and certified engineers may access the systems. It's all common sense when it comes to running systems in a physical data center.

You would be surprised to see what happens if companies move these systems to cloud environments with Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions. For some reason, companies...

Understanding the dynamics of security and compliance

Security and compliance are two completely different things, yet they are closely related to each other. Security policies are required to achieve compliance. We will get into the relationship a bit further in this section.

First, let’s get a good definition of security. Security involves all activity to protect assets of a company and the users of their systems. This activity can be defined in security controls: physical, technical, and administrative. Typically, we don’t have to worry about physical controls in cloud. Microsoft, Amazon, Google, Alibaba, and Oracle will make sre that their datacenters and all the hardware that’s in the datacenter is well protected. We do have to worry about the technical and the administrative controls. We need to take action to for instance implement antivirus and antimalware software on workloads that we host in the cloud: these are technical controls. Administrative controls...

Defining the baseline for security policies

It just takes a few mouse clicks to get a server up and running on any cloud platform. But in an enterprise, that's migrating or creating systems in the cloud, there's a lot for an architect to think about – securing environments being the top priority. It is likely that IaaS, PaaS, and SaaS solutions will be used to build our environment. It could grow in complexity where a lack of visibility could lead to vulnerabilities. So, with every service enrolled in the cloud environment, we really need to consider how best to secure each service. Every service needs to be compliant with the security baseline and the policies defined in that baseline.

What are the steps for creating policies and the baseline?

1. Check regulations: Every company is subject to regulations. These can be legal regulations such as privacy laws or industry compliance standards. Make sure the regulations and compliance frameworks your company needs...

Implementing security policies

We have studied the compliance and security frameworks and we've defined our security baseline. Now we need to implement it in our cloud environments. In this section, we will explore implementations in the major clouds, using the native security platforms. Since CIS is widely and globally adopted as the baseline for security policies, all sections will explore specific settings that CIS benchmarks recommend for the different platforms. Links to the benchmarks are provided in the Further reading section of this chapter. CIS provides recommendations, but also documents how policies should be implemented.

For example, in GCP there is a recommendation to "ensure Cloud Audit Logging is configured properly across all services and all users from a project." CIS benchmarks also guide users to find where the setting needs to be configured and how; in this example, by going to audit logs at https://console.cloud.google.com/iam-admin...

Managing security policies

It doesn't stop with implementing security policies. We need to have governance in place to manage the policies. Governance is required on two levels:

1. The security policies themselves, auditing these to the compliancy frameworks that a business has to adhere to.
2. The technical implementation of the security policies, keeping the monitoring up to date, making sure that all assets are indeed tracked against the policies.

The first level is the domain of people concerned with the security governance in a business, typically, a Chief Information Security Officer (CISO) or Chief Information Officer (CIO). They need to set directions for security policies and make sure that the business is compliant with the security strategy, industry, and company frameworks. The CISO or CIO is also responsible for assurance from internal and external auditing.

Level two is more about security management, concerning how to deal with security...

Manage risks with Cloud Security Posture Management

We discussed methodologies to implement security policies in the various clouds. Now, we also have to make sure that these policies are followed to ensure that our environments stay compliant. That’s the key function of Cloud Security Posture Management (CSPM):

• Detect cloud misconfigurations
• Remediate cloud misconfigurations, preferable through automation
• Manage best practices for different cloud configurations and services
• Check cloud health status to a security control framework and compliance standards
• Monitor cloud services, including storage solutions, encryption and account permissions

CSPM is designed to detect and remediate risks that might be caused by bad configurations of cloud services. Since we work in multi-cloud, we have to find tools that can scan multiple environments in clouds. Some of these tools are also able to check against regulatory frameworks such as HIPAA, alert and even automatically remediate issues...