Subscribe
  • Home
  • /
  • Malware
  • /
  • Eliminating excessive permissions via least privilege approach

Eliminating excessive permissions via least privilege approach

In a cloud environment, it’s easy to accidentally enable excessive user permissions, but these can serve as entries for cyber criminals. A least privilege approach can prevent this.

Johannesburg, 21 Jan 2021
David Higgins, Technical Director - EMEA, CyberArk
David Higgins, Technical Director - EMEA, CyberArk

The speed at which digital transformation initiatives are occurring and with which new services from cloud providers are being introduced has created a unique new security challenge, thanks to the explosion of identity-based permissions.

Looking at things from a security perspective; each cloud identity represents a potential opportunity for a cyber criminal to infiltrate an organisation surreptitiously. Getting in unseen is the first step towards accessing the company’s most valuable assets.

David Higgins, Technical Director for EMEA at CyberArk, points out that in cloud environments, any human or machine identity can be configured with thousands of identity and access management (IAM) permissions, allowing it to access cloud services containing sensitive information. However, many organisations unintentionally configure their various identities with permissions to access cloud services that they don’t actually use or need.

“These excessive permissions pose a major challenge for enterprises, particularly as they move towards a zero trust security framework. Zero trust demands that every identity attempting to access corporate resources must be verified, while at the same time, their access must be intelligently limited,” says Higgins.

“In fact, a recent survey indicated that over-permissioned accounts and roles were the top-ranked cloud service misconfiguration. On the other side of the coin, the survey also ranked overly permissive privileges as the most common attack vector against cloud applications.”

Therefore, the best way to address this challenge is to begin implementing least privilege – an approach whereby all identities have only the minimum necessary entitlements to perform their ongoing responsibilities. This has been established as best practice for organisations attempting zero trust and/or cloud journeys.

“If you are thinking about introducing or extending least privilege to your cloud environment, there are four key reasons to adopt such an approach. Firstly, data breaches are increasingly linked to cloud identities. However, in a least privilege model, organisations proactively protect themselves from insider threats while greatly limiting the potential damage of external attacks.

“It must be understood that a compromised identity in a least privilege framework can’t immediately access resources outside of that identity’s standard job responsibilities. Therefore, adopting a least privilege approach limits attacker movement and protects mission-critical workloads, buying valuable time to detect and respond to an attack.”

The second reason, adds Higgins, is that although accelerated cloud adoption tends to expand the potential attack surface – the more cloud services you utilise, the more identities you need and thus the greater the risk – least privilege helps instead to shrink it.

“The nature of the cloud is such that certain aspects of it make proper configuration of privileges and permissions a challenge. A good example here might be how cloud-based identity and access management roles for some application services are provided with a range of permissions, something usually done to reduce developer friction.

“In situations like these, establishing and continuously validating least privilege is necessary in order to shrink the attack surface and thus lower your risk by both dissuading insider threat actors and impeding potential external attackers,” says Higgins.

Then, of course, as cloud services continue to multiply, so too do misconfiguration risks, he adds. In essence, the speed of cloud innovation is definitely increasing business productivity, thanks to a number of powerful tools like data streaming, blockchain networking and Internet of things (IOT) analytics.

“It must be remembered that while these tools are more accessible than ever before, such accessibility also comes at a price – and the price can be high, considering that one simple misconfiguration can open the door for cyber attackers.

“With a least privilege model, the emphasis is instead placed on managing permissions, with the aim of identifying potential misconfigurations that result in excessive, unauthorised access to key cloud services. In this way, you mitigate risk while enabling the necessary access to advanced workloads.”

Perhaps the single most important reason to undertake a least privilege stance is because this is exactly what is recommended by cloud providers, the industry and various regulatory frameworks. This is because they all recognise the dangers of over-permissioned identities, as well as the difficulty of securely configuring services in immense cloud environments. Understanding this, it should be clear why they all specify least privilege access as a security best practice.

“Ultimately, least privilege is recognised as a security best practice for a reason, but at the same time it must not come at the expense of end-user productivity or overburden IT teams. The delivery of effective least privilege enforcement involves the right mix of privileged access management practices, together with flexible controls, in order to balance security and compliance requirements with operational and end-user needs,” Higgins concludes.

Share