Navigating the Maze: Enhancing User Access Reviews for Comprehensive Security

Transcript

1. Navigating the Maze: Enhancing User Access Reviews for Comprehensive Security Nicolás Villalobos Staff Cloud Security Engineer at Okta
2. Introduction • On the Cybersecurity space for +5 years • Certifications (CCSP, AWS, Azure, etc.) • I’ve been part of blue and red teams • Now focused on protecting resources in cloud environments My name is Nicolás Villalobos I’m a Staff Cloud Security Engineer at Auth0 by Okta
3. Agenda 01 User Access Reviews 02 Value & Risks 03 Deep dive - Solution Architecture 04 Protecting the automation 05 Thanks & Questions
4. User Access Reviews
5. Why UARs are important Security • Data protection ◦ Reduces risk of data loss ◦ Align with the principle of least privilege • Mitigates security threats such as: ◦ Privilege Creep ◦ Insider threats Compliance • To fulfil audit requirements for: ◦ GDPR ◦ PCI DSS ◦ HIPAA • Follow industry standards and best practices
6. UAR - Process Define Scope 01 Collect Data 02 Format Data 03 Review Data 04 Adjust Access 05
7. Pain Points 1. Coordination - Multiple stakeholders 2. Manual - Laborious and error-prone 3. Time sensitive 4. Frequency
8. Automation!
9. UAR - Potential for automation Define Scope Collect Data Format Data Review Data Adjust Access 01 02 03 04 05
10. Value & Risks
11. Value & Risks Value • Proactive risk management ◦ Faster detection ◦ Reduce overall time to complete • Save stakeholders’ valuable time ◦ No need to collect user lists ◦ No need to adjust permissions • Reduce possibility of manual errors Risks • Automation may need admin privileges on platforms • Trust in vendor’s security controls • Secrets to access tools in a central location
12. Automating: Data collection
13. Let’s Centralize the info! Centralize info in a single system Requirements 1. Reduce Dependencies ◦ Grant security teams access to the system ◦ Information can be accessed at any time 2. Least Privilege ◦ Security teams can only access relevant datasets 3. Collect Data
14. Official Connectors Requirements • API Secret (token or key) Benefits • Manage entities lifecycle for you • Doesn’t need maintenance They work by calling platforms’ APIs
15. Custom connectors Requirements 1. Code - To retrieve and process information. 2. Notifications - to be informed about errors 3. Secrets Vault - to store API secrets 4. Scheduler - to run workflow periodically Benefits • Control over what info you ingest Drawbacks • Maintenance • Responsible for managing entities lifecycle
16. Custom connectors in AWS Services 1. Code - Lambda & Step Functions 2. Notifications - Slack 3. Secrets Vault - Secrets Manager, Parameter Store 4. Scheduler - EventBridge Message App
17. Automating: Data Formatting
18. Data Formatting Separated workflow with quarterly frequency Actions 1. Consolidates lists 2. Send lists out to Managers 3. Opens ticket for audit purposes Message App
19. Automating: Access Adjustments
20. Automated Adjustments
21. Security
22. Monitoring AWS Services • CloudTrail ◦ When secrets are viewed ◦ When changes are made to resources
23. Org Wide Policies - AWS Service Control Policy (SCP) • Control the maximum available permissions for IAM users and IAM roles • Can be applied at: ◦ Org ◦ OU ◦ Accounts • Use case in this scenario: • Protect security relevant resources Management Account OU OU Account OU Account OU Account Account Account Account Account
24. Recap
25. UAR Help your organization to stay secure and comply with industry best practices and regulations Recap Value Detect and mitigate risk faster Automation saves valuable time Automation Streamline process
26. Thank you!