Why cloud security depends on robust identity controls

Akif Khan

VP Analyst, Gartner

Learn why identity and access management must be at the forefront of organisational efforts to secure their cloud environments.

Public cloud adoption is now the rule — not the exception. The Gartner 2023 Cloud End-User Behavior Survey found that 94% of surveyed organisations agree that public cloud is a crucial part of their digital business initiatives. Moreover, 77% of respondents were using SaaS applications, with a further 71% using public cloud infrastructure (IaaS) for their own applications. Four-fifths of respondents were using multiple cloud providers.

Benefits of cloud migration

The migration to the cloud offers multiple benefits around scalability and efficiency but also presents myriad cybersecurity challenges. Many cybersecurity operating models and skillsets were designed for on-premises environments. Functions related to platform, application and data security must evolve accordingly. However, one often overlooked aspect of cybersecurity that must be applied specifically to the cloud context is identity and access management (IAM).

Identity as the new perimeter

Modern cloud environments are complex and sprawling, even more so in multi-cloud or hybrid environments. The management of identities across these landscapes is very challenging. However, with identity now the fundamental unit of access to cloud environments and applications, securing this identity plane is essential.

Attackers have taken notice; and identity-based attacks involving phishing, MFA prompt-bombing and privilege escalation are now commonplace. Even a single compromised identity can give attackers a foothold from which to carry out reconnaissance, exfiltrate critical data, steal funds or plant ransomware. To protect data, applications, networks and digital infrastructure in the cloud, cybersecurity teams must have a strong focus on IAM.

The migration to the cloud offers multiple
benefits around scalability and efficiency.

IAM focus areas for cloud security

IAM is the framework that ensures that the right people can access the right applications to do the right things at the right time. As applied to cloud security, it involves robust identity governance and administration (IGA) to ensure accurate and timely provisioning (and crucially, de-provisioning) of access in line with business needs.

This goes hand-in-hand with privileged access management (PAM), which is a particular challenge in the cloud environment given the huge range of privileges and roles available in most IaaS offerings. Strong, phishing-resistant authentication is another key IAM tenet.

Assume attackers will get in

Even with robust IAM controls in place, always assume that an attacker will compromise an identity and gain access to your cloud environments. This is why many organisations are investing in solutions to build up a capability known as identity threat detection and response (ITDR). ITDR is not a single solution that can be purchased but is a broader set of capabilities designed to scan for and remediate identity-based attacks.

These capabilities include analytics to detect anomalous behaviour for a given identity, monitoring of user privileges and incident response workflows including triggering of MFA or access revocation. The growing focus on ITDR in cloud security reflects the fact that identities need their own category of security solution, in the same way that controls have traditionally focused on endpoints, networks and applications.