A Guide to Effective Cloud Privileged Access Management

Over the last decade, the cloud has gone from being a radical, disruptive new technology to becoming the default setting for organizations of all shapes and sizes. The days of enterprises and heavily regulated companies citing security as the main barrier to cloud adoption are over.

So have all the cloud security challenges been solved? Is the cloud secure in 2024?

The short answer is yes. But as ever, the devil is in the details…

The Challenge of Cloud-Based IT Environments

In truth, it’s not quite as simple as saying the cloud is or isn’t secure. Like with any IT environment, you are only as safe as the technology and processes you’re using to protect yourself. But with the right privileged access management policies, a cloud environment certainly can be secure.

But the early skeptics of cloud technology certainly had one thing right: Cloud technology requires a fundamentally different approach to cybersecurity. Back then, existing security software and tools weren’t really equipped to deal with this new way of working, which is why so many organizations steered clear.

Since then, the situation has changed. Now a range of tools, features, and functionality exists across various products to effectively manage privileged access and achieve endpoint privilege management across these complex, distributed environments. Such tools are specifically designed to solve the specific security challenges that cloud computing creates.

Now the hybrid working revolution is underway and a lot of employees are working from home or bringing their own devices. This requires more focus on local device access management rather than domain-related PAM. This is one of the hardest things about cloud PAM – if you have 200 or 2000 devices, then each of these has to be managed individually.

Mikkel Pederson, Head of Global Sales Enablement, Heimdal®

To understand what those features are and why they’re important, it’s helpful to first identify the specific challenges they aim to address:

Bring Your Own Device (BYOD)

Traditional IT environments usually involved a series of endpoints that were wired up to a physical network. But today, an HR manager might access sensitive information in the New York office one day and log in to their emails from London the next. This need for remote access makes it more difficult to authenticate users and identify malicious activity.

It also makes it difficult to secure end-user devices, because they’re increasingly likely to belong to the employee, rather than the company.

In short, this means that access rights now need to focus much more on local devices rather than protecting the network as a whole. This creates a challenge of scale – since the number of endpoints requiring protection in most IT environments is vast.

Explosion of Assets, Software, and Sensitive Data

Today, organizations could have any number of SaaS apps, virtual machines, RPA workflows, DevOps environments, and much more. As the potential of technology increases, so too does its complexity. Each new software, workflow, or system comes with its own set of identities and privileged administrative access, all of which need to be carefully managed.

This is particularly the case when it comes to so-called ‘service accounts’. These are used when machine identities (eg IoT devices, RPA workflows etc.) require access to sensitive information instead of a person. Often, it’s easy to forget these elevated privileges exist – because they’re not associated with people.

Whether it’s across user or service accounts, the sheer scale of modern cloud deployments makes managing them a real challenge.

Privilege Creep

Privilege creep refers to the process of rights gradually expanding in an organization over time. Often, it’s easy to grant elevated permissions and then forget to revoke them when users leave a company, change a role, or finish a project. This creates multiple new entry points for hackers to target.

If left unchecked, this means the organization’s attack surface will expand over time. Organizations looking to mitigate this risk will conduct regular ‘least privilege’ audits to identify and remove unnecessary privileges. But in reality, these often get missed or postponed for a less busy month, so it’s far from a silver bullet.

Democratization of authority

Historically, IT admins were the omniscient gods of the network. They alone had access to, control over, and oversight of the whole environment. But cloud technology promised a democratization of productivity, which was great news for end users and even better news for hackers.

Today’s employees increasingly expect to purchase their own SaaS products, design automated workflows, and spin up virtual machines. This, effectively, has created a whole new tier of privileged users for hackers to target – further increasing the overall attack surface.

One key theme that runs through all these challenges is the sheer complexity of today’s environments. This makes it increasingly untenable for IT admins to manually add and remove permissions. Instead, a new approach is needed.

PAM in the Cloud vs. PAM for the Cloud: What’s the Difference?

Before we can discuss the solutions to these challenges, there’s one frustrating confusion it’s helpful to clear up: Do you need a PAM solution for the cloud or one in the cloud?

On the surface, these might seem like the same thing, but this isn’t the case:

PAM in the Cloud

This refers to the licensing model of the security software you’re using. A PAM solution that’s ‘in the cloud’ is almost certainly a SaaS-based program, sometimes known as PAMaaS.

Organizations use these services to balance costs, eliminate overheads, and increase flexibility – in the same way as with any other SaaS app. Crucially, whether or not a PAM product is in the cloud has no bearing on the features it offers, or how effectively it defends against cloud-based attacks.

PAM for the Cloud

A PAM solution that’s ‘for the cloud’ is designed to protect cloud, hybrid, and multi-cloud environments from modern security risks. The features these products offer are specifically designed to address the challenges discussed in the last section. In theory, a PAM solution that’s ‘for the cloud’ could itself be hosted entirely on-premises – though in practise this isn’t likely.

So which solution do you need? The truth is, these options aren’t mutually exclusive – the features you need and the licensing model you use to access them will be separate considerations.

But it’s important to clear up the distinction, because many providers will call themselves a ‘cloud PAM’ without necessarily having the features you’d need to protect cloud environments.

If you’re using cloud technology, then you need PAM for the cloud – including many of the features we discuss below. Whether or not you choose to do that through a SaaS or PAMaaS-based program is down to you.

But unless you’re an enterprise, cybersecurity vendor, or have particularly complex infrastructure requirements – SaaS is probably going to be the better choice.

What Cloud PAM Features Should You Look Out For?

To overcome the challenges we discussed earlier, there’s really no alternative but to get a PAM solution that’s built for the cloud. So where do you start?

Unfortunately, this is a lot easier said than done. Different PAM solutions vary significantly in the features they offer and how they market them. While there are some industry-wide terms, providers don’t tend to use them in a clear, consistent, and comparable way.

For that reason, it can be a real challenge to understand what type of product you need and which provider is best for you.

So how do you choose the right software for your business? The best approach is to familiarize yourself with the most advanced security features and how they can protect you from malicious attacks. Then, you can compare the functionality offered by the leading cloud PAM solutions and decide which one is best placed to keep you safe.

1. Continuous monitoring

One of the key drawbacks of traditional PAM solutions is a lack of visibility or responsiveness. Often, there’s simply no way of knowing an attack is taking place until after it’s too late.

Continuous monitoring, or behavioral monitoring aims to solve this issue by analyzing the realtime activity of end users. The goal is simple: to identify hackers before they can do damage. So how does this work?

Generally, hackers’ behavior can be pretty abnormal. They will almost certainly access information from a new device or location. They might also log in and out of different accounts in an attempt to move laterally through an environment. They will also likely access a number of files, protocols, or network services that aren’t typical for the user they’re impersonating.

All of these signals can be detected by the most up-to-date anomaly detection algorithms. Continuous monitoring, therefore, lets you dynamically lock down accounts and revoke access whenever suspicious activity is detected.

2. Just-in-time access

Traditional PAM solutions work by restricting access to sensitive assets and data to only those people who absolutely need it. Just-in-time (or ‘just enough’ access) adds an extra layer of defense to this: offering access to privileged accounts only when they need it. These instances are referred to as privileged sessions.

The goal of this is to eliminate ‘standing privileges’ – where specific users have access to sensitive assets all the time. Instead, just-in-time access seeks to replace this with dynamic, conditional, and temporary access. This requires privileged users to have a specific reason to access sensitive data. Then, access should be revoked again after a specified period.

In practice, this means creating a set of automated policies and rules for when access can be granted, to whom, for which assets, and for how long.

All this limits the potential damage that hackers can do if they manage to gain access to a privileged account. It also reduces the amount of time the IT team has to spend manually approving access requests and de-provisioning unused accounts.

The main benefit here is obvious: it limits the damage a hacker can do even if they access a privileged account. But it also helps to reduce the amount of housekeeping and admin involved in constantly auditing and revoking privileges. This means least privilege is consistently and constantly enforced, meaning the organization is less reliant on manual privilege audits to stay safe.

3. Automated privileged accounts discovery

One of the biggest challenges in cloud environments is simply knowing what privileged accounts exist in the first place. It’s incredibly common for organizations to have several redundant, unused, or unnecessary privileges – across both user and service accounts. And just because an employee no longer works for a company – doesn’t mean their account can’t be used as an entry point.

But if you can’t understand what privileges exist, you can’t effectively protect yourself against attacks. Hackers are adept at using disused accounts to access sensitive data and systems.

Automated discovery helps with this. By identifying all the privileged user and service accounts that exist within an IT environment, we can enforce least privilege by removing any unnecessary access.

4. Role-based access

Effective identity management is about having a predefined list of roles and privileges, so you know when you hire someone or change roles it’s clear what privileges they should be assigned. The goal of role-based access is to take away the individual and the person and assign rules based on their identity.

Mikkel Pederson, Head of Global Sales Enablement, Heimdal®

Most privileges in an organization can be clearly associated with a particular job role. HR workers, for instance, need access to personal and financial employee information. Team leaders need access to information about their direct reports, but nobody else.

In both cases, the privileges are specific to the job role and will become redundant if the user in question switches roles. But often, IT teams don’t rescind these privileges when they become unnecessary – which is a key cause of privilege creep.

Role-based access aims to solve this problem. Like just-in-time access, it relies on automation to reduce the burden on IT teams in situations when users leave or change roles. The goal is to have pre-defined privileges that are associated with roles rather than people.

Let’s look at an example: The Head of Sales at most companies will have access to the salary and contact information of their direct reports. But if the team lead gets promoted or moved in a restructure, they no longer need those privileges. Role-based access lets IT teams create automated policies so these privileges are withdrawn once the user’s job title changes. It also means new employees get the right privileges for their role when they first join, and reduces the overall burden for IT teams in managing and provisioning them.

5. Password encryption

One of the biggest problems with traditional security is the tendency to put all its eggs in one basket. Enter: the humble password. Here’s the issue – if a hacker gets access to privileged passwords, there’s traditionally very little stopping them from wreaking havoc in your IT environment.

This is one reason why phishing attacks are so popular. If successful, it could give them the keys to the kingdom. Therefore, a series of password-less and password-lite authentication policies are increasingly becoming the default setting in cloud PAM products:

MFA & SSO

An increasingly common alternative or supplement to passwords. This creates multiple layers of protection, usually something the user has (e.g. a key/token), something they are (e.g. biometric information), and something they know (e.g. a password). These can be used alongside or instead of traditional passwords. This improves security by adding an extra layer of defense if passwords are breached.

Single sign on

This works to reduce the total number of passwords an end user has to remember. Users can log in Windows, Gmail, Outlook – and additional services (e.g. SaaS apps) can effectively piggyback off that password. This makes it easier for end users to have difficult passwords that change regularly – since there are fewer to remember.

Password vaulting & encryption

Increasingly, the gold standard of cloud PAM is to avoid end users having access to the password at all. In this case, encrypted credentials are stored in secure vaults, making it difficult or impossible for end users to reveal them through phishing attacks.

Generally, access can then be granted via multi-factor authentication or filled in automatically by the password manager itself – without the user needing to see it. These then use anomaly detection algorithms to identify phishing activity, making it much less likely that the passwords will be leaked via fake landing pages that look suspiciously similar to your email login.

Once you uncouple the relationship between end user and password, it also becomes much easier to manage, rotate, track, and dispose of credentials in a consistent and effective way.

If the end user doesn’t know the password, there’s no impact on their user experience when it changes. At its extreme, these passwords can be rotated after each use (essentially making one-time passwords the default setting) – meaning any stolen credentials are effectively useless.

The most up-to-date PAM solutions will offer all of these password features so organizations can create a layered defense. No single feature is infallible, so it’s important to mix the benefits of them all.

How Heimdal® Can Help You With PAM

The challenge with modern, cloud-based IT environments largely comes down to complexity and scale. There are simply too many endpoints across too diverse a range of systems for IT teams to manually monitor and govern.

That’s why it’s so important to make sure you’re getting access to modern, cloud-based PAM solutions like Heimdal®’s Privileged Access Management tool – so you can effectively implement the strongest possible defense.

With our solution, you will get a tool that is equiped with:

• Total Privilege Management: This function lets you define and manage role-based access control and delegation policies with ease.
• Just-in-Time Secured Privilege Access: Allows your admins to grant temporary enhanced privileged access to users only when necessary.
• Audit and Reporting: Lets you generate comprehensive reports, monitor privileged access/session activities, and easily prove adherence to local or global regulatory standards.

and many more functions that will make managing privileged access in your company as easy and safe as it can get!

How to Get Cloud Security Right First Time

Now that the conversation of cloud vs. security has passed into the distant, pre-pandemic years, it’s easy to fall into the trap of assuming cloud security is a solved problem.

The truth as ever, is more complex. As we’ve discovered in this blog, solutions do exist to the most modern PAM-related challenges. But without the right tools, you can’t keep your sensitive data, assets, and information safe. That’s why it’s so important to make sure you’re using tools like Heimdal® to access the features we’ve outlined throughout this blog.

With these capabilities in hand, you’ll have the tools you need to reduce privilege creep and implement least privilege at every level of the organization.

FAQs

What is cloud privileged access management?

Cloud privileged access management refers to any tools or policies specifically designed to manage elevated permissions in cloud environments. These will generally feature more granular privileged access controls to manage rights on local devices, as well as automation, automated discovery, continuous monitoring, and password encryption.

What features are needed for cloud privileged access management?

There’s no single defined feature-set for cloud PAM products and different providers will offer varying combinations of features. But generally, the most important cloud PAM features to watch out for are continuous monitoring, automated discovery, privileged session management, just-in-time access, role-based access, and password encryption.

PAM for the cloud vs PAM in the cloud: What’s the difference?

PAM for the cloud refers to traditional privileged access management tools adapted for cloud environments, securing access to critical assets. PAM in the cloud refers to the licensing model of the technology you’re using, usually a SaaS license. While both have their benefits, PAM for the cloud generally includes the features you’ll need to keep your environment safe.

Cristian Neagu

CONTENT EDITOR

Cristian is a Content Editor & Creator at Heimdal®, where he developed a deep understanding of the digital threat landscape. His style resonates with both technical and non-technical readers, proof being in his skill of communicating cybersecurity norms effectively, in an easy-to-understand manner.