How do you control cloud user access?

AI for Anomaly Detection: Employ artificial intelligence and machine learning tools for real-time anomaly detection. Such tools can spot abnormal user behavior that human monitoring might miss. Data Masking: Implement data masking techniques to obscure specific data within a database, making it inaccessible to unauthorized users. This is particularly useful for non-production environments. Zero Trust Architecture: Moving beyond perimeter security, consider a Zero Trust approach where trust is never assumed, and verification is required from anyone trying to access resources in your network.

There are tools which can help you in identifying your cloud assets. They can scan and enumerate your cloud environment. Of course, from the other end, you need strong policies in place to register any asset when the are created, generated, procured, or deployed.

If you are coming from a practical IT experience, policies may seem a waste of time on unuseful documents. But they actually form the backbone of your technical controls. They also support in legal matters when needed, whether for staff or even otherwise.

MFA can prevent almost all attacks against credentials theft. While very effective, MFA is not foolproof. Different methods of MFA have different levels of security. SMS or call-based MFAs are two of the weakest ones (although still a lot better than no MFA). Hardware tokens or software authenticators (like the ones from Microsoft or Google) are the stronger ones. If using a software authenticator, try to use the features available against MFA-specific attacks (like MFA fatigue/spamming). These features can include entering/selecting matching numbers.

Strong IAM life cycle practices are still very important in the cloud as they were in the traditional on-premises setups. Remember that some of the most infamous breaches in the recent years came from publicly accessible databases, storage, and APIs in the cloud.