Download to read offline
Uploaded byDevOps.com
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case Study
The document discusses the challenges of managing identities and entitlements in cloud infrastructure, highlighting that by 2023, 75% of security failures will stem from IAM mismanagement. It cites a case study from Appsflyer, emphasizing the risks associated with poor access controls and misconfigurations, as well as the emergence of new categories like Cloud Infrastructure Entitlement Management (CIEM). Additionally, it presents a solution through Ermetic's full-stack governance and entitlement management to enhance visibility and control in cloud environments.
Technologyâ—¦
More Related Content
Similar to How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case Study
![Governance, Deployment & Methodologies for Agentic Automation [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day2-251112135038-a386476d-thumbnail.jpg?width=640&height=640&fit=bounds)
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case Study
- 1. How to GovernIdentities and Manage Entitlements in Cloud Infrastructure AppsFlyer Case Study
- 2. 75% Gartner predicts that “by2023, 75% of security failures will result from mismanagement of IAM privileges”
- 3. 79% of therespondents admitted to experiencing a cloud data breach in the past 18 months 3 IDC Survey of 300 US CISOs Confirms the Challenge Top IaaS/PaaS Concerns In a survey of 300 companies in the United States, we asked senior decision makers responsible for cloud security about their concerns regarding their cloud production environments. Below are the top responses. Security Misconfigurations IAM Lack of Visibility Improper IAM Configurations 67% 64 % 62 %
- 4. CIEM •Cloud Infrastructure Entitlement Management(CIEM) – a new category named by Gartner CIG Cloud Identity Governance (CIG) – a new category named by Forrester
- 5. 5 â–Ş A toxiccombination: â–Ş EC2 is exposed to the internet â–Ş EC2 has privileged permissions â–Ş The role is over-provisioned â–Ş Potential mitigation: â–Ş Review and remove risky permissions â–Ş Review network exposure CASE STUDY Poor Access Controls Lead to Cloud Breaches EC2 Virtual Server S3 Virtual Storage AWS Account Internet Network exposure Privileged permissions
- 6. Common Challenges 6 “ Knowing whocan access what and making permissions granular are top goals for security teams ” Stephen Schmidt, CISO, AWS ▪ Quantify IAM risk ▪ Resolve organizational disconnects ▪ Govern 3rd party (e.g. SaaS) access ▪ Govern user and machine permissions ▪ Protect access to sensitive resources ▪ Unblock access and accelerate business
- 7. Governing Identities and Entitlementsin IaaS and PaaS 7 Platform Capabilities Visibility Discover all human and machine identities, data and compute resources, roles and policies Analytics Analyze all access policies and activity to model and identify risks, while ensuring business continuity Enforcement Eliminate excessive access and privileges based on actual access patterns and data sensitivity • “Who can access what?” • “Which resources this user can access?” • “Who has access to this bucket?” • “Who are all my privileged users?” • “What is the risk of this 3rd party?” • “What permissions does this app require?” • “How do I remove stale access, at scale?” • “How do I remediate over provisioned users and apps?”
- 8.
- 9.
- 10. 10 Marketing measurement and analyticsplatform What is AppsFlyer?
- 11. 11 AppsFlyer In Numbers Marketersand Developers 75K+ 55B+ Mobile Actions Measured Per Month 5,000+ Integrated Partners 7B+ Devices with AppsFlyer SDK 0 On-Prem Servers 100B+ Mobile Actions Measured Per Month 3+5 3 Different cloud providers (AWS, GCP, AliCloud) in 5 Different countries 15,000+ Servers 80T Of Data on a Daily Basis
- 12.
- 13. 13 WE ARE OUTNUMBERED </></> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </> </>
- 14.
- 15.
- 16.
- 17.
- 18. 18 Security work isn’t “special”.It gets planned the same as other engineering work.
- 19. 19 How do wedo it?
- 20. 20 New Service Host Image ContainerImage Secrets Dependencies Health, Logs, Utils Other services Network
- 21. New Service Host Image ContainerImage Secrets Dependencies Health, Logs, Utils Other services AWS Account Security Groups & IAM Configuration Network
- 22.
- 23.
- 24. 24 â–Ş SaaS platform â–ŞSubscription service â–Ş Predictable pricing model â–Ş API-based, agent-less â–Ş Rapid, easy deployment â–Ş REST API â–Ş IaC support Technology, Architecture, and Licensing
- 25. Introducing Ermetic Full-stack Cloud Identity Governance andEntitlement Management Solution 25 Unique Leadership Truly Global Presence Your picture here USD 30M Investment Arick Goomanovsky CBO & Co-founder
- 26.
- 27. Introducing Ermetic Full-stack Cloud Identity Governance andEntitlement Management Solution 27 Amy Ariel, CMO Meta Networks (PFPT), Secdo (PAN) Shai Morag, CEO Secdo (PAN), Integrity P. (MLNX) 8200, Talpiot elite program Michael Dolinsky, CTO Aorato (MSFT) IDF cybersecurity unit Sivan Krigsman, CPO Aorato (MSFT) Israeli Air Force Leadership Arick Goomanovsky, CBO Sygnia (Temasek), McKinsey 8200, Talpiot elite program USD 30M Investment
- 28. It is Difficultto Manage Entitlements in Public Cloud Infrastructure 28 • Lack of visibility • Complex configurations • High scale KMS AWS Cloud IAM user Role3 DynamoDB RDS S3 KMS DynamoDB RDS S3
- 29. It is Difficultto Manage Entitlements in Public Cloud Infrastructure 29 • Lack of visibility • Complex configurations • High scale KMS AWS Cloud IAM user Role3 DynamoDB RDS S3 KMS DynamoDB RDS S3