What are the most important IAM technologies for managing cloud-based applications?

Below are notable ones are: 1. SSO using SAML2.0, OAUTH2.0 and OpenID connect, JWT. 2. Using cloud native identity solution to allow users to access services. 3. Integration of on-premises Active Directory solution with Cloud. 4. Cloud based application aware proxy to onboard legacy application into SSO realm authentication. 5. Adding MFA with any of the above combinations. 6. Privilege remote access solutions like Cyberark, BeyondTrust to orchestrate identify and access management. 7. Zero Trust IAM solutions. 8. Managed API gateway to monitor and manage access not just to user account but also to service accounts. 9. Using CASB that sits between cloud service users and cloud applications to monitor & enforces security policies.

3 pillars of IAM: Build: Authentication and Authorization mechanisms (SSO, OAUTH, SAML etc.) Monitor: Policy management, Role and Access lifecycle management Operate: Tokens, cyberark, Access authorization and lifecycle automation (OKTA, PingID etc)

The adoption of cloud-based applications offers numerous advantages, but it also introduces unique identity and access management challenges. Leveraging these essential IAM technologies, along with comprehensive planning and continuous monitoring, is critical for organizations to secure their cloud environments while providing a user-friendly experience. IAM remains a cornerstone in building a robust security posture for the cloud.

Single Sign-On (SSO) Multi-Factor Authentication (MFA) Role-Based Access Control (RBAC) Privileged Access Management (PAM) Federated Identity API Security Attribute-Based Access Control (ABAC) Identity as a Service (IDaaS) Access Certification and Attestation Password Management Authentication Protocols Identity Governance and Administration (IGA) Cloud Directory Services Security Information and Event Management (SIEM)

Another advantage of using SSO is the possibility of having enhanced reporting and auditing. On the other hand, SSO also has some disadvantages: a single point of entry also means single point of failure. If the SSO system is compromised, it might grant unauthorized access to multiple applications. Or, if the user is logged out, they will be logged out from multiple applications. Another consideration is that not all applications offer out of the box integration capabilities and there might be additional development costs. Finally, depending on the area you're in, it might also constitute privacy concerns.

This simplifies the user experience but also enhances security by reducing the number of login credentials users need to manage. SSO solutions, like Okta or Microsoft Azure Active Directory, are essential for ensuring seamless access to various cloud-based applications.

MFA is particularly useful to prevent brute forcing attacks and credential stuffing. It also offers user friendly options with more modern authentication techniques. However, in some cases its implementation depends on third-parties, increasing the complexity and risk. Also, MFA doesn't protect against all phishing attacks. Users can still be tricked in providing their authentication codes to malicious websites or applications.

While MFA has provided better protection over passwords in the past, it however is still vulnerable to Account take over (ATO) attacks like phishing and MFA bypass. Traditional MFA is broken and high assurance phishing-resistant MFA is what's needed to protect access to critical infrastructure, resources and data. Certificate-based authentication, FIDO2 and Passkeys are some ways of implementing phishing-resistant MFA and mitigating MFA bypass attacks.

MFA is one excellent way of adding an efficient security layer to an application access. It gives a two way benefit for the user and for the application. It stops exploitations arising from some uneventful password breaches to the more impactful brute force attacks. Enabling MFA can considerably reduce the IAM risks as well as meeting various compliance requirements. And most of the players in the market are providing MFA as a free of cost additional benefit or charging very less when compared to the other features. So, with the simple implementation process and very low cost involved, this MFA is an excellent choice for all types of Organizations improving their security posture.

In addition to Identity federation, utilizing just in time (JIT) provisioning with protocols like system for cross-domain identity management (SCIM) helps with setting up users during on-boarding and off-boarding. JIT provisioning not only helps lower licensing costs by only provisioning users when they first single sign-on to an application, it also reduces the attack surface by reducing the number of dormant accounts.

Identity federation is often a pre-requisite for enabling SSO. So all the cons of federations should also be considered for SSO.

The biggest change for IAM that is really going to need wide adoption is phishing-resistant MFA. Things like: Smart cards YubiKey Cert-based MFA Biometric MFA ETC. These will become the foundation for authentication over the next year due to the level of more sophisticated phishing attacks. A big ask and a nice-to-have would be to also include user behavior analytics and correlation to create identity trends... There is a lot of pushback in some of the corporate space because it does take away a lot of privacy. However, people are creatures of habit, and by tracking those habits, we can sometimes tell when a user's account has possibly been compromised. I am excited for the future of IAM and all cybersecurity!

One of the things I anticipate we will see when it comes to RBAC and IAM, is the use of AI to automatically isolate or downgrade access based on out of policy / out of compliance users and devices in order to proactively protect against cyberattacks.

AI can be used for sending contextual push notifications to upgrade for policy renewal. So limitation becomes an opportunity and most of the user remain compliant.

Many vendors are now offering consolidated security service edge (SSE) platforms that combine secure web gateways, CASB and zero trust network access tools.

Risk-based adaptive step-up authentication helps provide a dynamic approach to authentication. Evaluating the risk of a user when authenticating themselves using a variety of inputs such as behavioural biometrics, contextual data such as velocity, time-of-day / day-of-week login, ip address, etc allows for a dynamic approach to authentication by requiring additional verification through a different 2FA or by blocking access if the risk level is beyond a pre-configured threshold. It allows for introduction of friction in the login process only when necessary.

There is a growing overlap between IAM and other markets, especially in cloud security that must be taken in consideration when thinking about IAM for cloud apps. Cloud infrastructure entitlement management (CIEM) is one of these functions that crosses the boundaries between the 2 disciplines. CNAPP and CSPM have been incorporating more CIEM capabilities in the past 2 years. With a growing number of machine identities (10 to 1 human) in the cloud, and explosion of entitlements, controlling permissions “by hand” becomes near to impossible

All of these technologies wrapped up with Governance, Risk & Strategy are great UNTIL staff or contractors leave and companies forget to revoke their access rights!!! So ensure you have a robust processes for Off-boarding and if possible automate it to keep you resilient.

Crucial IAM technologies for managing cloud-based applications include SSO for user convenience and security, MFA to bolster authentication, RBAC for granular access control, PAM for privileged accounts, and conditional access policies to enforce context-specific access rules. API security and CASB solutions help secure data and access points, while UBA and SIEM provide behavioural analysis and incident detection. Implementing IDaaS simplifies IAM, and a Zero Trust framework ensures continuous verification. Encryption and DLP protect data, and an IGA system manages user identities and entitlements. Assess your organisation's specific needs to select the most effective IAM technologies for cloud application security.

Secret storage and management system. Automate cryptography and use a well-established secret management system. Scan, audit, identify, and rotate secrets. Establish a secured technique for passing secrets.