Configuration and Monitoring of IAM

By Shruti Kulkarni and Alon Nachmany of the CSA Identity and Access Management Working Group.

Introduction

Identity and Access Management (IAM) is a critical component in maintaining the security and integrity of an organization's information systems. The role of IAM is to manage the authentication and authorization of users, applications, and systems. Proper configuration and monitoring of IAM is essential to ensuring that access to sensitive information and systems is secure and properly managed.

Top 7 Attributes to Monitor

1. User Identities

User identities should be monitored regularly to ensure that only authorized individuals have access to sensitive information and systems. This includes verifying the accuracy of user information, such as names, roles, and group memberships. It also includes monitoring the identities that create and modify roles and group memberships (aka administrators).

2. Permission Grants

The permissions granted to each user should be monitored regularly to ensure that they match the user's role and responsibilities within the organization. This includes verifying the accuracy of group memberships, role assignments, and access control policies.

3. Session Management

The management of user sessions should be monitored regularly to ensure that sessions are being terminated properly and in a timely manner. This helps to prevent unauthorized access and potential security breaches.

4. Logs and Audit Trails

Logs and audit trails should be continuously monitored to ensure that all access to sensitive information and systems is being recorded and tracked. This helps to identify any potential security breaches and to investigate any suspicious activity.

5. IAM Configuration

The configuration of the IAM system itself should be monitored regularly to ensure that it is secure and functioning properly. This includes verifying the accuracy of configuration settings, such as authentication methods, access control policies, and session management policies.

6. Service Principals

Service principals (aka service accounts and resource accounts) should be monitored regularly to ensure that interactive rights are not provided and that users cannot use service principals to access any resources.

7. Programmatic Access

Access granted to APIs, roles, and machine identities should be monitored regularly also as the identifiers of these entities. API keys, client IDs and secrets, and public and private keys have the potential to be compromised and as such should be monitored for unauthorized access and any misuse.

Monitoring of Known State of Identities

It is important to continuously monitor the known state of identities on the identity provider or directory to ensure that they are accurate and up to date. This includes verifying that all user information, such as names, roles, and group memberships, is accurate and up-to-date. Additionally, it is important to continuously monitor the identity provider or directory to ensure that it is secure and functioning properly.

Conclusion

Proper configuration and monitoring of IAM is critical to ensuring the security and integrity of an organization's information systems. By continuously monitoring the top 7 attributes and the known state of identities on the identity provider or directory, organizations can ensure that access to sensitive information and systems is secure and properly managed.