Evaluate the IAM Risks Associated with outsourcing your SOC to an MSSP

This paper will provide an initial assessment of the new initiative by the government agency to outsource its Security Operations Center to a Managed Security Services Provider (MSSP).? The objective is to evaluate the potential risks and considerations associated with identity and access management (IAM), asset and data classification, and authorization mechanisms due to this engagement.? The paper examines key IAM issues that may arise, including risks of unauthorized access, insider threats and loss of control over sensitive information.? It also will address the critical role of asset and data classification in determining the level of access granted to the MSSP and how to ensure the MSSP's compliance with best practices around identity and access and provisioning (Crowdstrike).

?

Further, the paper outlines how to determine appropriate authorization mechanisms (such as RBAC and MAC) for MSSP personnel accessing the agency's data and identifies strategies to prevent access control attacks.? The assessment provides actionable recommendations to help the agency's senior management and Board make informed decisions, ensuring that the MSSP engagement aligns with security requirements and operational objectives while minimizing risk exposure (Swimlane).

The first step to creating a secure partnership with the MSSP is to establish the responsibilities and expectations of the MSSP.? By completing a Scope of Services we have outlined what the services the MSSP is expected to deliver. The MSSP will be responsible for managing the Security Operations Center (SOC). Which will include monitoring, detecting and responding to security incidents, performing identity and access management(IAM), including provisioning and de-provisioning for employee access.? The MSSP will also be required to manage compliance with industry standards, conduct forensic investigations when needed, and provide regular reports on security performance and incidents.? With these responsibilities clarified we can ensure we will meet the needs of the security needs of the government agency? (Palo Alto Networks).

When partnering with a MSSP managing who has access to what becomes the central challenge.? The MSSP will be ultimately responsible for overseeing security operations which means that Identity and Access Management (IAM) must be a primary focus.? With the correct implementation of IAM we can prevent unauthorized access and maintain control over sensitive data.? Focusing on IAM allows us to address such issues as provisioning and de-provisioning access, insider threats, and ensuring proper authorization protocols are in place with the MSSP partnership (CrowdStrike).

When outsourcing to an MSSP for the SOC, Identity and Access Management does come with its own risks and setbacks. Let us address a few of these known risks.

?

Over-Provisioning of Access Rights: Granting broad access to MSSP employees may lead to over-provisioning, allowing access to data or systems that are not part of their role. This can lead to data misuse by exposing sensitive data and creating unnecessary risk. Implementing well-defined controls will help mitigate this potential risk (Swimlane).

Insider Threats: Excessive privileges for MSSP employees can increase the risk of insider threats, whether accidental or intentional. Allowing privileged access could result in data breaches or leaks. A mitigation strategy is to enforce IAM policies such as least privilege and need-to-know, ensuring users have only the access required to perform their tasks. In conjunction with these strategies, continuous monitoring will add an additional layer of security, allowing the detection, investigation, and response to suspicious activities or behavior (CrowdStrike).

Lack of Visibility: When IAM functions are outsourced, the agency might lose the ability to see who has access to sensitive systems and data. Without regular reviews and visibility into access logs, privilege creep can occur. This happens when users retain access permissions that are no longer necessary. Over time, this can create vulnerabilities such as unauthorized access to sensitive areas. A mitigation strategy that greatly reduces the risk of privilege creep is to implement regular access reviews and Role-Based Access Control (RBAC) (Frontegg).

?

To elaborate on mitigation strategies for the above-mentioned risks associated with outsourcing the SOC to an MSSP, we will dive deeper into how we can further reduce and prevent the possibilities of these vulnerabilities becoming exploitable weaknesses (CrowdStrike).

Least Privilege:?

• Ensure employees, including MSSP staff, only have access to what they need for their job and tasks. This prevents unnecessary data exposure (Frontegg).

Just-in-Time (JIT) Access:?

• Implement JIT access where employees are granted temporary access to specific systems or data only when needed, and it automatically expires after use (Frontegg).

Need-to-Know Policy:?

• Limit access to critical information so that only those directly involved in a task can view it, reducing exposure to sensitive data (CISSP CBK Volume 6).

Continuous Monitoring:?

• Set up real-time monitoring and alerts to track unusual activities, helping detect potential insider threats early (CISSP CBK Volume 6).

Role-Based Access Control (RBAC):?

• Assign access based on job roles, ensuring the only authorized users have access to specific data or systems (CISSP CBK Volume 6).

Regular Access Reviews:?

• Audit who has access and ensure it aligns with their role. Adjust permissions if necessary to avoid privilege creep (CISSP CBK Volume 6).

Service Level Agreements (SLAs):?

• Clearly define expectations for MSSP accountability, including regular audits, compliance checks, and response times for incidents (CISSP CBK Volume 6).

Let us take a look at Assets and Data Classification and why it is so important to ensure a secure partnership.? When outsourcing to an MSSP, asset and data classification plays a very important role in determining what information the MSSP will need to access.? It will also apply proper classification (public, internal, confidential) on the data to ensure that only the authorized staff have access to specific data. In order to correctly determine the value and sensitivity of the assets and data we must follow these steps:

?

Define a clear purpose and scope for the data collection

• Identify what types of data we will include
• Who the intended audience is
• Ensure we align with business goals

Create an inventory

• Develop a detailed inventory of all assets (physical and digital).? This should include servers, database, applications, intellectual property (IP), documents and customer data (PII)
• Collect metadata, serial numbers, location, determine asst type, and any unique identifiers

Create a Data Governance Policies

• Ensure data stays up-to-date, accurate, and secure
• Define standards, access controls and data quality measures

Classify the data/asset

• Identify Asset/Data

Regulatory and Compliance Requirements

• We must work with industry-specific regulations and considering this is a government agency apply we may need to apply either the Policy on Government Security (PGS), ITSG-33 - IT Security Management or the more popular NIST framework.? We also need to align with the Personal Information Protection and Electronic Documents Act (PIPEDA)

Assign Ownership

• Every asset should have a designated owner who is responsible for its management,? protection, and lifecycle decisions.

Document the Asset

• For each asset, document important details such as its classification, retention requirements, and access levels.
• ?Maintain the metadata, including when the asset was created, modified, and accessed, as part of its catalog.

Apply Access Controls:

• Define who has access to each data type or asset based on its classification. Use methods such as Role-Based Access Control (RBAC) to ensure only authorized users can access sensitive assets.

Track the Asset's Lifecycle:

• Monitor the entire lifecycle of each asset, from creation or acquisition to disposal, ensuring that each phase is documented in the catalog.
• Set procedures for asset retirement, ensuring secure disposal of both physical and digital assets.

Regular Audits and Updates:

• Conduct regular reviews to ensure that the asset catalog remains accurate and up to date, especially as assets change ownership, usage, or classification.

?

This process will help ensure that all assets and data are well-organized, protected, easy to locate, and managed according to their classification and organizational importance. This is essential for effective risk management and compliance with legal and regulatory frameworks.

?

Now that we have established the roles and responsibilities of the MSSP and created an Asset and Data Classification Catalog we can now address in detail the need for correct implementation of Identity and Access Management (IAM) practices for the MSSP's identity and access provisioning lifecycle

?

In order to make sure the MSSP complies with the best practices over the course of the partnership, we need to address a few critical steps and ensure proper implementation.? The main goal is to reduce security risks while being able to ensure the MSSP can effectively complete their tasks and maintain integrity with the access control process. Let's take a look at how we can do this:

?

?

Provisioning with Least Privilege and Need-to-Know:

• During the initial provisioning phase, it is important to follow the least privilege and need-to-know principle. MSSP staff should only be granted the minimum access necessary to perform their duties. This will reduce the risk of unauthorized access to sensitive data and systems.
• Implement Role-Based Access Control (RBAC) to assign access rights based on specific roles within the MSSP, ensuring that access is limited to what is required for each function (Frontegg).

?

Just-in-Time (JIT) Access:

• For tasks that require elevated privileges, JIT access can be utilized. This practice allows for temporary access that will automatically expire after the task has been completed, reducing the likelihood of privilege creep (Frontegg).

?

Regular Access Reviews:

• Conduct regular audits and reviews of user access levels to ensure they remain aligned with their job duties and tasks. This will prevent incorrect access from lingering and help us maintain compliance with the least privilege and need-to-know principles.
• Audits should include automated tools that can identify any anomalies or excessive access rights quickly (CISSP CBK Volume 6).

?

De-provisioning Process:

• The de-provisioning process must be done as soon as required and efficiently. When an MSSP employee changes roles or leaves the organization, their access should be revoked quickly to avoid potential insider threats and any potential mishandling of sensitive data.
• Set it up so that offboarding is fully automated to prevent human error, and that de-provisioning connects to all systems, applications, and services to avoid one being forgotten (Microsoft).

?

Multi-Factor Authentication (MFA):

• Enforcing MFA across the MSSP’s environment will be required to enhance security and add an additional layer of security. It ensures that even if credentials are stolen, unauthorized access will be much harder to achieve (Microsoft).

?

Privileged Access Management (PAM):

• PAM focuses on securing privileged accounts with elevated access to critical systems.
• It enforces just-in-time (JIT) and least privilege principles, granting temporary access only when needed.
• Key tools: session monitoring, password management, MFA, and activity logging to detect suspicious behavior (Microsoft).

?

Privileged Identity Management (PIM):

• PIM adds time-based (JIT) and approval workflows for elevated permissions.
• It helps control the lifecycle of privileged accounts, ensuring access is granted for limited periods and monitored for abuse (Microsoft).

?

Monitoring and Reporting:

• Continuous monitoring of access activities is a must. MSSP staff should be regularly monitored for any unusual patterns or suspicious behavior.
• Implement logging and alert systems that will immediately notify the agency of any unauthorized attempts or access anomalies, ensuring timely response to potential threats (NordLayer).

?

Compliance with Regulatory and Security Standards:

• The MSSP must adhere to relevant regulations and standards, such as PGS, NIST, and ITSG-33, to maintain the highest level of security and data protection.
• Ensure that the MSSP conducts third-party security audits to verify compliance with best practices (CISSP CBK Volume 6).

?

By enforcing these as best practices across the identity and access management lifecycle, we can ensure that the MSSP will be aligned with the security policies and the necessary controls are in place to protect sensitive data and systems.

Now that we've covered the identity and access provisioning lifecycle, it's time to look at how we’ll determine the best authorization methods for MSSP users who need access to our assets and data. Choosing the right method or combination of methods is key to ensuring security and proper access control. Whether we use Role-Based Access Control (RBAC), Rule-based Access Control (RuBAC, Mandatory Access Control (MAC), or Discretionary Access Control (DAC), the decision will depend on the sensitivity of the data and the operational needs of the agency.

First let us take a look at the authorization methods that are available to us:

?

Role-Based Access Control (RBAC):?

• This method grants access based on the user’s role in the organization.? RBAC works well for predictable access needs, ensuring users only have the permissions necessary for their tasks(CISSP CBK Volume 6).

Rule-Based Access Control:?

• Here, access is determined by predefined rules or conditions, such as time of day, location, or other context-based factors. This is useful for limiting access during specific time frames or for particular tasks(CISSP CBK Volume 6).

Mandatory Access Control (MAC):?

• Typically used in highly secure environments, MAC enforces strict policies where access is assigned based on predefined security labels. This is ideal for data classified as highly sensitive, such as government secrets or critical infrastructure systems. Access rights are non-negotiable and cannot be altered by users or even data owners, ensuring strict compliance(CISSP CBK Volume 6).

Discretionary Access Control (DAC):?

• With DAC, the data or asset owner decides who gets access to their information. This system allows flexibility, but it could lead to more relaxed security controls, which may be less suitable for highly sensitive environments. DAC is better for less sensitive environments that may benefit from more flexibility(CISSP CBK Volume 6).?

Attribute-Based Access Control (ABAC):?

• This model uses attributes related to users, resources, and the environment to decide access. It offers more flexibility by factoring in multiple conditions (e.g., time, location).. ABAC provides more fine-grained control by evaluating conditions before granting access (Frontegg).

Policy-Based Access Control (PBAC):?

• Access is determined based on policies that include rules, roles, and contextual factors. PBAC is often easier to implement compared to ABAC but still provides fine-grained contro (Frontegg)l.

Taking into consideration that the MSSP is being outsourced by a government agency, we must setup strict controls for sensitive and highly sensitive data while also maintaining availability when needed. To achieve this, we will implement multiple access control mechanisms that will meet the MSSP’s requirements. This approach will help maintain both compliance and security, ensuring the MSSP has appropriate access to perform their job duties (CrowdStrike).

?

When looking at which access control mechanism to implement, we need to include the sensitivity of the data. For highly sensitive data (e.g., secret government information), strict controls like Mandatory Access Control (MAC) are ideal because they enforce predefined, non-negotiable security policies. For moderate sensitivity or internal data, a more flexible option like RBAC in conjunction with ABAC could be applied, allowing access based on roles or attributes. These systems help balance security with the need for operational flexibility and data availability (CISSP CBK Volume 6).

?

Using multiple access controls can be highly effective, as it allows us to use specific security controls for different types of data sensitivity and user roles, ensuring both flexibility and security. For example, you can use RBAC for standard tasks while applying MAC or ABAC to more sensitive data (Frontegg).

?

However, this approach can increase complexity in management. We will need to ensure the access control rules are consistently applied and regularly audited. We will set up automated tools and/or access management systems to help reduce the burden of managing multiple access controls (CrowdStrike).

?

Adding PAM (Privileged Access Management) and PIM (Privileged Identity Management) within the MSSP infrastructure is extremely important to ensure highly sensitive data stays protected. PAM ensures that privileged access is strictly controlled, session activity is monitored, and access is only granted on a just-in-time basis.? PIM helps manage the privileged accounts by forcing time-limits on approved-based access which reduces the risk of abuse. With both PAM and PIM working together, sensitive data is restricted to authorized personnel and closely monitored, with alerts for suspicious activity enabling quick remediation and access revocation (Microsoft).

To wrap up the topic on Access Management, we’ve covered how using multiple access control mechanisms—like RBAC, MAC, ABAC, and DAC—ensures flexibility and security based on data sensitivity. We've also addressed the importance of PAM and PIM for managing privileged access for highly sensitive data. Together, these systems help protect sensitive data while ensuring that only the right people have the required access at the right time, helping us maintain security and compliance across MSSP operations(CISSP CBK Volume 6).

As we move into the final section of our discussion, let's address how we can prevent or mitigate access control attacks. These attacks target weaknesses in Identification, authentication, authorization, or data access safeguards. To protect against these threats, we must explore important strategies such as strong authentication, least privilege, continuous monitoring, and data encryption.

Strong Authentication:

• Enforcing multi-factor authentication (MFA) ensures only authorized users gain access (Microsoft).

Least Privilege:

• Apply the least privilege principle to minimize access rights and limit lateral movement with the network (Frontegg).

Continuous Monitoring:?

• Implement real-time monitoring and logging to detect, alert and respond to unusual access behavior quickly (NordLayer).

Access Reviews:

• Regular audits help ensure that access permissions remain aligned with user roles and security policies (CISSP CBK Volume 6).

Encryption:

• Ensure sensitive data is encrypted both at rest, in use and in transit (Jatheon).

?

We have addressed MFA, Least Privilege, Continuous Monitoring, and Access Reviews throughout this paper, so I would now like to focus on encryption and its importance in ensuring the integrity and accuracy of data.? Here is how we can either prevent or mitigate the risk of data at rest, in transit or in use.

?

Data at Rest:?

• We need to make sure stored data is encrypted, like using AES-256, and manage the encryption keys securely, rotating them regularly to stay ahead of threats (Jatheon).

Data in Transit:?

• When data is moving across networks, we use TLS or SSL encryption to keep it safe from interception (Jatheon).

Data in Use:?

• For active data, techniques like data masking or homomorphic encryption allow us to process sensitive info without exposing it (Jatheon).

In conclusion, outsourcing the SOC to an MSSP requires detailed consideration to access management and security controls. By using multi-factor authentication, least privilege, continuous monitoring, and encryption for data at rest, in use, and in transit, we can ensure the data is protected. The use of PAM and PIM further secures privileged access and highly sensitive information. Combining multiple access control mechanisms tailored to data sensitivity ensures that both compliance and security needs are met, helping the MSSP securely perform its duties while minimizing the risk of unauthorized access (CISSP CBK Volume 6).

Works Cited

"What a MSSP Does/Responsibilities." CrowdStrike, https://www.crowdstrike.com/cybersecurity-101/secops/msp-vs-mssp/ .

"SOC Metrics." Swimlane, https://swimlane.com/blog/soc-team-roles-responsibilities/ .

"SOC Tiers." Palo Alto Networks, https://www.paloaltonetworks.com/cyberpedia/soc-roles-and-responsibilities .

"MSSP Challenges and Benefits." NordLayer, https://nordlayer.com/learn/iam/challenges-and-benefits/ .

"Privileged Access Management." Microsoft, https://www.microsoft.com/en-us/security/business/security-101/what-is-privileged-access-management-pam .

"Access Control Mechanisms." Frontegg, https://frontegg.com/guides/access-control-in-security .

CISSP CBK Volume 6, (ISC)2.

"Data at Rest, Data in Transit, Data in Use." Jatheon, https://jatheon.com/blog/data-at-rest-data-in-motion-data-in-use/ .