Implementing CCM: Identity & Access Management Controls

The Cloud Controls Matrix (CCM) is a framework of controls that are essential for cloud computing security. The CCM is created and updated by CSA and aligned to CSA best practices.

You can use CCM to systematically assess and guide the security of any cloud implementation. CCM also provides guidance on which actors within the cloud supply chain should implement which security controls. Both cloud service customers (CSCs) and cloud service providers (CSPs) use CCM in many ways.

CSCs use CCM to:

• Assess the cloud security posture of current or potential cloud vendors. If a cloud vendor isn’t transparent about their security controls, the risk of doing business with them can be quite high.
• Compare vendors’ level of compliance with relevant standards like ISO 27001.
• Clarify the security roles and responsibilities between themselves and the CSP.

CSPs use CCM to:

• Assess, establish, and maintain a robust and internationally accepted cloud security program. CCM helps solidify CSPs' positions as trusted and transparent providers of cloud services.
• Compare their strengths and weaknesses against those of other organizations.
• Document controls for multiple standards in one place. CSA has mapped the controls in CCM against several industry-accepted security standards, regulations, and control frameworks.

CCM contains 197 control objectives structured into 17 domains that cover all key aspects of cloud technology:

CCM Domains

Today we’re looking at implementing the tenth domain of CCM: Identity & Access Management (IAM). The IAM domain helps CSPs and CSCs follow security best practices for managing identities and access to cloud resources. Key principles, such as least privilege and segregation of duties, are essential for securing access to the cloud. The IAM domain consists of 16 control specifications:

1. Identity and Access Management Policy and Procedures: Establish, document, approve, communicate, implement, apply, evaluate and maintain policies and procedures for identity and access management. Review and update the policies and procedures at least annually.
2. Strong Password Policy and Procedures: Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.
3. Identity Inventory: Manage, store, and review the information of system identities, and level of access.
4. Separation of Duties: Employ the separation of duties principle when implementing information system access.
5. Least Privilege: Employ the least privilege principle when implementing information system access.
6. User Access Provisioning: Define and implement a user access provisioning process which authorizes, records, and communicates access changes to data and assets.
7. User Access Changes and Revocation: De-provision or respectively modify access of movers/leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.
8. User Access Review: Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.
9. Segregation of Privileged Access Roles: Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.
10. Management of Privileged Access Roles: Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.
11. CSCs Approval for Agreed Privileged Access Roles: Define, implement and evaluate processes and procedures for customers to participate, where applicable, in the granting of access for agreed, high risk (as defined by the organizational risk assessment) privileged access roles.
12. Safeguard Logs Integrity: Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.
13. Uniquely Identifiable Users: Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.
14. Strong Authentication: Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equivalent level of security for system identities.
15. Passwords Management: Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.
16. Authorization Mechanisms: Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.

 

Organizing the IAM Controls

The IAM controls can be divided into three areas. First is identity and access governance. This area is all about:

• Maintaining an inventory of systems and user identities
• Monitoring the levels of access those user identities have on those systems
• Implementing separation of duties based on least privileged access
• Clearly defining policies and procedures

The second category is access lifecycle management. The lifecycle includes:

• Requesting access (by users)
• Approving access (by system administrators)
• Provisioning access
• Reviewing access (at regular intervals)
• Removing access (when someone leaves the firm)
• Updating access (when someone changes departments)

The third area is identification and authentication. This includes strong:

• Multi factor authentication (MFA) with secure mechanisms
• Authentication credentials
• Password policies

When you put all the IAM controls together, you get strong governance, access provisioning, and authentication and identification.

 

IAM Shared Responsibilities

Under the Shared Security Responsibility Model (SSRM), CSPs and CSCs share IAM responsibilities. 

CSPs are typically responsible for offering robust identity and access capabilities, controls, and mechanisms. This allows the customers to effectively implement the controls within their environments. In addition, the CSP has the responsibility of designing and implementing policies and procedures in their own organization. 

CSCs, in turn, define user roles, enforce strong authentication and authorization methods, and manage the full identity lifecycle. This includes provisioning, modifying, and revoking access, while continuously monitoring for suspicious activities. The customer also must establish their own policies and procedures, define roles, and manage those roles among users.

Collaboration between CSPs and CSCs ensures that the necessary IAM protections are in place. Ultimately, the goal is to prevent unauthorized access to data and cloud resources.

 

The Risks of Not Implementing IAM Controls

If you don't thoroughly implement IAM controls, you will:

• Expose your environment to unauthorized access
• Have poor visibility to what entitlements which user has on what system and which data
• Be hard pressed to answer regulators about how you are managing least privileged entitlements and other compliance requirements
• Encourage unintended breaches made by unknowledgeable staff

 

Mitigating the Risks

Thankfully, we have best practices that can be employed to mitigate these security risks.

The first best practice is to obtain a good understanding of the platform features. That is, the capabilities that the CSP has provided for their customers to leverage. Usually, CSPs will provide manuals and tutorials on the platform. The customer should consume all provided materials. Make sure all staff are educated on these best practices, according to their job function.

The second best practice is to develop robust procedures for the implementation and operation of controls in the environment. This is true for both the provider and the customer. Educate users about these policies and procedures, why they are important, and the consequences of violating them. 

Finally, CSA’s CCM and CCM Implementation Guidelines were created especially to educate you and empower you to write policy and procedures. All CSA documentation is free to download and use. Apply these guidelines to reduce the risk associated with whatever cloud you're using.

You can also learn about implementing the other CCM domains by checking out the other blogs in this series. Be on the lookout for the next installation: Interoperability & Portability.