IAM lifecycle management, NHIs and zero-trust

IAM (Identity and Access Management) is a popular topic within cloud computing, however IAM lifecycle management (ILM) is often ignored. Yet, ILM is critical to the security posture of any organization. In this article, we discuss the differences between IAM and ILM, and suggest how to better secure organizations by following ILM best practices.

What is IAM (Identity Access Management)?

IAM in the cloud involves making sure only trusted users have access to an organization’s resources. Secure IAM practices can be applied to resources in the cloud, or an on-premise data center. In simple words, it’s about managing who has access to what within an organization’s digital estate, or who can do what. IAM is typically thought of as human-centric, that is managing people’s access. However, here, we’re talking about managing non-human identities (NHI). 

IAM for NHIs – What’s different?

Identity and Access Management (IAM), often seen as human-centric, actually deals with a significantly larger number of non-human identities such as service accounts, access tokens, API-Keys, and secrets used by applications. These non-human identities outnumber human ones and undergo rapid changes, necessitating software-driven management and stringent policies for effective governance and security.

What is Identity lifecycle management?

Managing the lifecycle of identities, from provisioning to decommissioning, is crucial for ensuring the security of applications. Whether an identity exists for mere minutes or spans months, the longer its lifespan, the greater the risk of exposure. Therefore, maintaining visibility across all lifecycle stages of an identity is paramount. This visibility entails comprehensive knowledge of the secrets involved, understanding the identity’s originator, the resources or data it grants access to, its creation time, its storage location within a vault, and other pertinent details. Such oversight ensures robust security measures are in place for secrets security.

What is the difference between IAM and ILM?

Identity and Access Management (IAM) is the ongoing management of access and permissions for identities, ensuring smooth business operations while maintaining secure access to applications and resources within an organization’s technology infrastructure. In contrast, Identity Lifecycle Management (ILM) encompasses the entire lifespan of identities, from creation to retirement, involving multiple stages and complexities. IAM is a component of ILM, focusing on day-to-day operational management, while secure ILM practices extend to long-term operational management. Although many organizations prioritize and regularly practice IAM, particularly in cloud environments, fewer devote attention to their ILM strategies. Amid the demands of daily tasks, they often overlook the need to evaluate the weaknesses in their IAM operations and consider the broader implications of identity management over time.

Challenges in ILM and IAM cybersecurity

Here are the  most common challenges with ILM:

• Too many NHIs: Organizations are typically dealing with thousands if not hundreds of thousands of NHIs at any given time. The larger the organization, the more critical non-human identity management becomes. 
• Third-party security is hard to control: Vendors and partners are a reality in an interconnected digital world. Usually, an NHI is given to the vendor in order to connect with your digital environment. However, it’s a huge challenge to get third-party organizations to keep to the same security protocols across the board. 
• Zombie IT: External threats like malware can lurk in the shadows of the cloud and may have access to NHIs without being noticed. They are hard to spot, but by looking for any abnormal behavior patterns, it is possible to sniff them out. However, this cannot be done manually, and it takes advanced tooling to find and report on them.
• Exposed NHIs: NHIs get exposed in source code repositories, employee communication channels, storage buckets, and many more ways. Once exposed, organizations find themselves unprepared and not knowing how to handle the situation. 
• Lack of centralized view: As organizations use multiple vaults and as multi-cloud adoption grows it becomes harder to have a centralized view of all IAMs. Yet, this is the need of the hour for security teams that are stretched thin in every direction.

What is zero-trust?

Zero-trust cybersecurity operates on the premise of distrusting all entities and activities by default, necessitating verification of every identity and action against established security protocols. In an era where the security perimeter extends beyond traditional firewalls to encompass interconnected cloud environments, adopting a zero-trust approach becomes imperative for maintaining robust security measures.

What are the principles behind the zero-trust framework?

The principle of least privilege advocates for granting minimal access to identities, providing only the necessary permissions for specific tasks rather than full access. This approach enhances security by limiting potential damage in the event of a breach. Similarly, microsegmentation, inspired by microservice architecture, involves dividing the technology stack into smaller segments or compartments. By employing need-to-know hierarchies, access to each segment can be finely controlled, bolstering security and minimizing the impact of unauthorized access or breaches.

Zero-trust IAM 

Zero-trust can be used effectively in IAM practices in the following ways:

• JIT: Pioneered by Toyota on their manufacturing line, just-in-time (JIT) is an idea that can be applied to ILM for great results. NHIs can be short-lived so they give access to identities only for a short period of time, just enough for the identity to complete the required task. This is hard to achieve and requires a lot of development work but this is how cloud-based systems can bake security in by default.
• Attribute-based security: RBAC is the conventional form of assigning access where it depends on the role of an identity. However, today, attribute-based access control (ABAC) is becoming more popular as it is more mature and allows for a greater number of parameters. Here are some examples:
  • Context: which resources an NHI protects? which teams have access to it?
  • History: Have there been past instances of exposures or breaches that make some types of NHIs more vulnerable than others?
  • Location: Which cloud data center an NHI is located in? which vault it is created and stored in?
  • Suspicious activity or behavior: Any suspicious behavior patterns that are cause for concern and reason enough to restrict or decommission the NHI?
  • Risk score: How valuable is the data that the NHI protects? What’s at stake for the organization if it is compromised?

Challenges in zero-trust IAM

Some of the biggest challenges with implementing zero-trust IAM are misconceptions about NHIs. For example, a huge mistake is assuming that a vault is able to manage NHIs. Or that secrets scanning is enough to stop any exposures. In reality, it takes an end-to-end non-human identities security platform like Entro to implement zero-trust and secure NHIs.

Mature IAM

Finally, let’s talk about the end in mind. The goal that every organization should be driving towards as they implement ILM. Here are the key principles to keep in mind:

• ILM should not be manual but software-driven
• It should not be trust-based, but every step should be verified
• NHIs should be safely decommissioned after their task is complete, or rotated frequently
• ILM should be policy-based rather than role-based or manual
• It is imperative to have end-to-end visibility across the entire non-human identity lifecycle
• NHIDR (Non-Human Identity Detection and Response) is essential to make sure there are no NHIs abnormal behaviors that can indicate a destructive breach
• Centralized management of NHIs makes ILM easier to manage

If you try to manage numerous NHIs and are looking for a robust platform to manage their lifecycle from start to finish, look no further than Entro. Its contextual intelligence on NHIs goes way deeper than any vault or secret scanner can. Entro enables you to secure the entire lifecycle of NHIs by following the zero-trust model.