Insufficient IAM, secrets, and key management
Insufficient IAM can happen in a scenario where we have many user identities (such as in an enterprise organization) but we fail to properly manage the identities. Or, we might use cryptography to protect sensitive data but fail to follow secrets or key rotation best practices and, as a result, increase the chance of data exposure by unauthorized parties.
Common consequences of insufficient IAM and key management
Here are some common consequences of insufficient IAM and key management:
- Failing to follow the principle of least privilege (PoLP) leads to excessive permissions being granted.
- Failing to configure access controls – for example, allowing unauthorized access to sensitive data (such as personally identifiable information (PII), credit card data, healthcare data, and so on), which leads to exposed credentials.
- Failing to enforce password policy (for example, allowing short passwords, not enforcing password...
