Modernization Strategies for Identity and Access Management

Originally published by Britive.

Shifting technology and access needs make identity and access management (IAM) a priority for all major organizations today. As infrastructure modernization efforts accelerate and businesses are increasingly adopting cloud-first approaches to their architecture and business, IAM has grown beyond its traditional IT, access-based function into a foundational element of cybersecurity.

As modernization becomes a priority for organizations hoping to stay relevant in a competitive technological landscape, security and access management must follow suit.

IAM is a critical component of a comprehensive cybersecurity strategy that ensures only authorized and validated users can access specific data, applications, and systems.

One of the most important—and challenging—security concerns when it comes to identity is privileged access management (PAM). With the dynamic nature of the modern cloud landscape, PAM approaches must be able to handle rapid changes and complex organizational requirements.

Authorization Modernization

In the context of IAM, PAM deals with the most sensitive, highest-risk systems and data. Typically, this meant limiting access to things like administrative access on servers and workstations.

Modernization may begin with migration to the cloud, but this is far from the end of the journey. Identity and cybersecurity teams must work together and rethink how they manage and modernize sensitive access to meet cloud access management needs.

Traditional PAM systems focused heavily on identity verification or authentication, confirming that a user is who they say they are. If a user provides a valid set of identifying information or credentials, access to a resource is granted. Frequently, this is done by providing the user with a pre-authenticated session tied to a static account with the proper level of permissions.

While this is still a critical step in securing access, the focus is on restricting who can access the resource, not removing the ability to access the resource in general. The user may not see the credentials used to access the resource using a privileged account, but the account itself—with its powerful assigned permissions—is always in place.

Another drawback to this approach is the tendency towards overprivileged access. A systems administrator may have the right to superadmin access on a server but that does not mean they need all the permissions associated with such a powerful account type every time they access the server.

A common practice is creating multiple accounts such a user can access, ideally selecting the one with the least privileges needed to accomplish the task at hand. Of course, this creates a new problem in the exploding number of such privileged accounts and the management headache of tracking and managing them.

At the core of these limitations is the multiple, fixed accounts gated inside the PAM tool. Users are effectively borrowing an identity rather than having permissions attached to their own, individual identity.

Access management is meant to address core security challenges, but changing technology and environments have revealed shortcomings in this approach:

• Static Access: Long-term, “always-on” permissions exist perpetually on a system. Administrators can easily overlook the presence of these permissions, leaving these accounts as potential vulnerabilities that can be exploited by bad actors. Modern provisioning approaches should be done dynamically and temporarily. An identity receives its permissions only upon request, and only for a certain period of time, reducing the likelihood of misuse.
• Overprivileged Accounts: As an identity accumulates accounts with new projects or roles and responsibilities in an organization, they accumulate more permissions than they need because of static permissioning. This creates a larger attack surface for potential breaches and a greater blast radius, depending on the scope and breadth of permissions attached to the account. Dynamic, time-bound provisioning reduces the likelihood of an identity accumulating excessive privileges.
• Misconfigured Permissions: Misconfigurations occur when permissions are assigned incorrectly, granting either too much or too little access. This can result in either unauthorized access to sensitive resources or too little access that hinders workflows and productivity. Modern access management solutions can automate the configuration and provisioning process based on security policy including identity attributes, reducing the likelihood of errors and ensuring that permissions align with the needs of the team or business unit.
• Inconsistent Access Management Processes: Inconsistent access management enforcement can lead to gaps in security, especially in complex hybrid and multi-cloud environment configurations with different tools and platforms. Tool limitations can lead to multiple access management solutions to fully cover an organization’s various environments. Modern access management platforms should be flexible enough to cover both traditional and modern cloud infrastructure needs. They should also centralize access according to the organization’s security policies to ensure consistency across environments, regardless of the number or location of the tools and resources that need to be protected.
• Lack of Operational Agility and Adaptability: Traditional IAM and PAM systems often lack the flexibility to adapt to changing business needs due to configuration requirements and long deployment times. This slows down operations and can defeat the agility and flexibility that organizations want, particularly in the cloud. Modern access management solutions should deploy and integrate quickly. They should also work seamlessly with existing tools to efficiently keep pace with the team’s access needs.

Shaking Off Outdated, Traditional Access Approaches

Access management modernization shifts the focus from slow and static to fast and dynamic. More subtly, it shifts from a model of focusing on identity authentication as a gate to over-provisioned, static accounts to one directly managing the authorizations associated with these identities.

It isn’t enough just to confirm who a user is; the user is continuously evaluated as to what they’re allowed to do. And, most crucially, permissions do not exist on target resources until the evaluation determines the user is properly authorized.

In the days of the traditional, fully on-premises business environment, verifying a user identity (having them log in with their unique username and password) with standing access to the tools and resources required for their job was secure enough. Resources on site were only accessible through specific endpoints, like the desktop sitting in their office. The assumption was any valid identity moving inside the firewall was secure enough because the servers and workstations on premises were not (usually) exposed to the public internet.

With the rise of cloud technology and remote work, however, organizations are faced with a departure from the traditional network architecture. Data and resources are no longer entirely stored on internal, physical databases or servers and employees can log in from anywhere.

Cloud services are publicly accessible by default, and many cannot be placed inside the corporate VPN or VPC, limiting the effectiveness of traditional firewall rules and making standing employee access a greater risk.

Modern Cloud Architecture Needs Modern Access and Authorization

Modern organizational network architectures with dynamically changing environments, tools, and access needs demand new access management approaches. Legacy IAM and PAM solutions often have lengthy deployments and strict configuration requirements, making them difficult to incorporate in cloud-based workflows and processes that demand speed and flexibility.

Permissions need to be as dynamic as the environments they govern to eliminate the risk associated with traditional access management approaches without hindering employee access and efficiency.

Modern access management solutions address this with dynamic, just-in-time (JIT) access that adapts with the needs of the environment. Users can temporarily elevate their accounts with specific permissions approved for them based on their role, department, or identity attributes providing access to the tools and resources they need to complete their work.

Sensitive or privileged permissions can also be temporarily applied with additional approvals and are automatically scoped according to the task that needs to be completed. Regardless of permission type, all are removed from the user’s account on the resource when the user is finished with their task or after a set period.

Separating permissions from logins eliminates the risks caused by standing and overprivileged access to meet security and compliance initiatives. Allowing users to request and access these permissions through a single platform that integrates seamlessly with existing workflows ensures security without additional friction or confusing and burdensome processes. This also provides centralized visibility of access privileges across all resources whether in the cloud or in traditional on-premises or hybrid infrastructure.

The continuous evaluation of authorization also aligns with the principles of Zero Trust, which assumes that no identity, regardless of whether their access request comes from inside or outside the network, should be trusted by default. Decoupling authentication from authorization ensures that no identity automatically has access to any resource, regardless of where it lives in the network. This also allows highest efficacy in a Zero Trust architecture as authorization can be granularly applied at multiple levels. For example, authorization verification can happen at the network, server, application, and data layer, protecting the most critical and sensitive information with increasing verification requirements.

As organizations continue to adopt and expand their use of cloud technology, modernizing identity and access management strategies is essential. Shifting the focus from securing authentication and moving away from strict, manual permissioning is critical to protecting users across increasingly complex environments.