How to think about the Principle of Least Privilege in a cloud native world
Verizon’s seminal annual analysis of cybersecurity breaches revealed that misconfigurations saw the highest growth year-over-year (4.9%) among all threat actions it analyzed. But as we’ve seen from some of the most high-profile cloud data breaches in the past year, misconfigurations are just the tip of the iceberg.
The real damage from most misconfigurations can be avoided through the Principle of Least Privilege. Sounds simple, right…?
The Principle of Least Privilege is one of the most fundamental and important concepts in cloud infrastructure security, but is quite often seen as the holy grail. Even the most mature security programs try to achieve it, but for most, it’s elusive.
I recently wrote about why determining least privileges for cloud infrastructure identities is complex and hard in IT Pro Portal, which covers the following:
- Determining what privileges or permissions are needed for a set of identities — at scale — across an organization’s multi-cloud or hybrid cloud environment with years of privilege creep is nearly impossible. The article explores how to know when an identity needs the privileges or permissions to perform a certain job.
- It requires visibility into how permissions are being used, determining additional permissions needed to perform an operation on a specific resource, granting them on request to perform that operation, and then revoking them. In the article, I discuss the steps required for this dynamic approach.
The key is focusing on the gap between those permissions that an identity requires do their job and all the permissions they might possibly need at any point in time. In other words, the goal is to deliver a comprehensive authorization model based on permissions used as opposed to permissions granted – and makes the holy grail within reach.
I invite you to read the article in full and comment here to share your perspective.
Post by Raj Mallempati
The post How to think about the Principle of Least Privilege in a cloud native world appeared first on CloudKnox.
- Attention AWS Users! CloudKnox Joins AWS ISV Accelerate Program
- JUST RELEASED: The Inaugural State of Cloud Entitlements Report: A Deep Dive into Permissions Management in Hybrid and Multi-Cloud Environments
- Cloud Entitlements Are the New Security Perimeter: Wipro State of the Cybersecurity Report 2020
*** This is a Security Bloggers Network syndicated blog from Blog – CloudKnox authored by pixels360. Read the original post at: https://cloudknox.io/how-to-think-about-the-principle-of-least-privilege-in-a-cloud-native-world/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-think-about-the-principle-of-least-privilege-in-a-cloud-native-world
