The new complexities of cloud access control

New guidance from the National Institute of Standards and Technology on access control for cloud systems focuses on the different access types that service delivery models require.

“The access control guidance of functional components in a lower-level service model are also applicable to the same functional components in a higher-level service model,” the publication states. “In general, access control guidance for [Infrastructure as a Service] is also applicable to [Platform as a Service] and [Software as a Service], and access control guidance for IaaS and PaaS is also applicable to SaaS. However, each service model has its own focus with regard to access control requirements for its service.”

The guidance comes as IT managers review systems they rapidly improvised this spring when government employees went from onsite to remote work, and as agencies prepare for that remote work to continue for the foreseeable future.

We spoke with Ben Johnson, CTO and co-founder of Obsidian Security, a cloud security specialist, to learn more about trends in cloud use and security.

This interview has been lightly edited for clarity and length.

Governments at all levels have been marching to the cloud for years. Has the pandemic turned that walk into a sprint?

It definitely accelerated cloud adoption, and what we also saw was it woke up the executive team or the boards in saying, “Hey, look, now we’re actually conducting very critical business – maybe a board of directors meeting over Zoom or something like that – and yet is that really fully supported internally as a production-grade application when it comes to security and policies?”

Things took a turn quickly in March, when many governors began issuing stay-at-home orders. Governments didn’t have a choice but to throw together systems that ensured workers and the public still had access to what they needed. How did that open security vulnerabilities?

As this shift to cloud happens, you’re now connecting to these cloud applications or cloud infrastructure that are not just sitting in your agency or your headquarters. It’s out there and it’s always on and it’s always reachable and you’re always connecting to it; does your security team have the right expertise or the right understanding of what the risks are? I think it very quickly shifts away from this notion of control to this notion of monitoring and visibility and understanding because they’re connecting from their house to the cloud. That doesn’t go through your environment so you have to shift how you defend it.

How does the guidance from NIST help?

I think it’s a great start. In fact, even in the document they say this is just the start. Having said that, it’s not very prescriptive in the sense that it’s trying to be more of a generalized information-sharing document and [offers] best practices, but it doesn’t ever talk about the specifics of what you need to do if you’re working with Amazon or Microsoft 365 or Salesforce or these different tools. Each one of those is different and that’s the challenge we see. It’s hard to know how to defend or how to optimize the security settings on these different tools. That’s where a document like this gives a good foundation, but if someone just reads it, they’re not going to know what to do to go to Microsoft 365 and lock it down.

How can chief information security officers best safeguard apps and data as they move to the cloud?

I think first and foremost, it’s getting a seat at the table. A lot of times, these cloud services or applications are brought in through the IT portion and not really the security portion of the organization or even a business unit and so [it’s about] making sure security has time to understand the policies, encryption standards and other things of the tool. But then once you have it, how does security get involved? Is security even going to be given access to see who the users are and who the admins are and what are the logs they can look for suspicious behavior in?

Secondly, it’s how are we going to incorporate this into our day-to-day security operations? Third is there’s not a lot of expertise on this because it’s so new. We all grew up defending internal networks or defending our computers and endpoints from malware. Now this is a whole world with a lot of different applications and cloud environments, so we need more training as well.

It looks like a full return to office-based work is unlikely. Do you expect more rapid deployment to the cloud?

Everyone moved as fast as they could to get back to a level of productivity or to maintain productivity, but now it’s stepping back to ask: Did everyone do the right thing? What does this mean for the next five years? How do we assume that we’re going to have some level of work-from-home maybe forever but for a while and what does that mean?

I think everyone was already on this cloud journey so it wasn’t like they didn’t want to go here, it was just more like they had to rush a little bit. [Now] pretty much everything across the board needs to have a reassessment of is this the right way to do secure computing.

What security challenges still lurk?

Again, it’s about protecting different accounts’ access. Who’s logging in as these different users or getting access to these systems? Another challenge is most of these systems are so focused on collaboration and sharing that often it’s easy to just click a button or have a wrong setting and you share a file. Third is these [application programming interfaces] or integrations. A lot of these tools are meant to have integrations between the clouds and so there’s a lot of ways in that people don’t think about through these API keys or integrations.

Finally, if it’s more of the infrastructure cloud, it’s ripe for misconfiguration. You flip the wrong switch and no one needs multifactor authentication. These are some of the challenges we hadn’t really seen before because you had everything in your data center or on-premise.