Identity and Access Management Controls
Identity and access management (IAM) components are key areas to assess for risk and compliance of any system, and this holds especially true for cloud environments where there may no longer be physical controls to mitigate risk and provide a gatekeeping function to critical services and applications. Security breaches within cloud environments are widely acknowledged to be because of cloud misconfigurations, and the ability to configure (or misconfigure) cloud services requires an account with access to those services. Ensuring the appropriate accounts have access to only the resources they need and in the timeframe needed is a principle of the Zero Trust methodology that has grown in adoption as companies continue to adopt and shift services into cloud environments. Zero Trust requires that all identities be authenticated and authorized before gaining least-privilege access to resources, and each of the three major cloud providers offers functionality and configurable controls in support of this. As an IT auditor, you should review these areas to ensure the features are properly set and configured in alignment with business risk objectives.
In this chapter, we’ll cover the following main topics:
- User authentication and authorization
- Permissions, roles, groups
- Device management
- Reviewing activity logs
By the end of this chapter, we will be able to identify the configuration for identity authentication, authorization, and access to assess if it meets control requirements. We will have also learned how to assess audit and activity log configuration, which is important to capture any malicious behavior and attempts to bypass risk controls.
