Policy-Evolving IAM Architecture for Just-in-Time Privilege Control in Multi-Account Cloud Enterprises
Article Sidebar
Main Article Content
Abstract
Multi-account cloud enterprises spread workloads across multiple accounts, each of which is managed separately, but privileged access is often given to users within these accounts as default and is built up over time increasing the attack surface. This systematic review combines 23 studies and standards into a policy-evolving identity and access management (IAM) architecture for the following: risk-based access control, formal policy verification, identity federation, just-in-time (JIT) elevation, role and attribute mining, multi-tenancy authorization, and zero trust architecture. The proposed design is to perform risk-scoring on each elevation request, validate it with a trust-safety property using satisfiability modulo theories (SMT) reasoning and issue a per-session credential that only lasts long enough for a specific session; and record the credential in a log for log-driven policy mining, followed by regression tests to test the candidates before promotion. A formal check of the results shows that the tests are sufficiently quick to be used in an inline mode, with 99% of the production policy questions answered within 160 milliseconds; in addition, the tests are able to handle a task that the other algorithms were not able to handle within 24 hours, while the attribute based miners scored an area under the curve of 0.9973, compared to 0.9269 for the role based miners. The use of a modeled scenario further suggests that four two-hour JIT sessions a week provide 95.3% less privilege exposure than standing access, over the course of the year. Approval fatigue, proportionality monitoring, scalability of mining, and continuity of break glass are mentioned as the major challenges to adoption.
Article Details
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
References
[1] H. F. Atlam, M. A. Azad, M. O. Alassafi, A. A. Alshdadi, and A. Alenezi, “Risk-based access control model: A systematic literature review,” Futur. Internet, vol. 12, no. 6, p. 103, 2020, doi: https://doi.org/10.3390/fi12060103.
[2] J. Backes et al., “Semantic-based Automated Reasoning for AWS Access Policies using SMT,” in 2018 Formal Methods in Computer Aided Design (FMCAD), 2018, pp. 1–9. doi: 10.23919/FMCAD.2018.8602994.
[3] C. Blundo, S. Cimato, and L. Siniscalchi, “Role Mining Heuristics for Permission-Role-Usage Cardinality Constraints,” Comput. J., vol. 65, no. 6, pp. 1386–1411, Jun. 2022, doi: 10.1093/comjnl/bxaa186.
[4] M. Bouchet et al., “Block public access: trust safety verification of access control policies,” in Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, in ESEC/FSE 2020. New York, NY, USA: Association for Computing Machinery, 2020, pp. 281–291. doi: 10.1145/3368089.3409728.
[5] I. B. Haimed, M. Albahar, and A. Alzubaidi, “Exploiting misconfiguration vulnerabilities in microsoft’s azure active directory for privilege escalation attacks,” Futur. Internet, vol. 15, no. 7, p. 226, 2023, doi: https://doi.org/10.3390/fi15070226.
[6] B. Cook, “Formal Reasoning About the Security of Amazon Web Services,” in Computer Aided Verification, H. Chockler and G. Weissenbacher, Eds., Cham: Springer International Publishing, 2018, pp. 38–47. doi: https://doi.org/10.1007/978-3-319-96145-3_3.
[7] S. Fugkeaw, “Achieving decentralized and dynamic sso-identity access management system for multi-application outsourced in cloud,” IEEE Access, vol. 11, pp. 25480–25491, 2023, doi: https://doi.org/10.1109/ACCESS.2023.3255885.
[8] M. J. Haber, “Just in Time,” in Privileged Attack Vectors, M. J. Haber, Ed., Berkeley, CA: Apress, 2020, pp. 285–294. doi: 10.1007/978-1-4842-5914-6_21.
[9] H. Huang, F. Shang, J. Liu, and H. Du, “Handling least privilege problem and role mining in RBAC,” J. Comb. Optim., vol. 30, no. 1, pp. 63–86, 2015, doi: 10.1007/s10878-013-9633-9.
[10] I. Indu, P. M. R. Anand, and V. Bhaskar, “Identity and access management in cloud environment: Mechanisms and challenges,” Eng. Sci. Technol. an Int. J., vol. 21, no. 4, pp. 574–588, 2018, doi: https://doi.org/10.1016/j.jestch.2018.05.010.
[11] P. Iyer and A. Masoumzadeh, “Mining Positive and Negative Attribute-Based Access Control Policy Rules,” in Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies, in SACMAT ’18. New York, NY, USA: Association for Computing Machinery, 2018, pp. 161–172. doi: 10.1145/3205977.3205988.
[12] X. Jin, R. Krishnan, and R. Sandhu, “A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC,” in Data and Applications Security and Privacy XXVI, N. Cuppens-Boulahia, F. Cuppens, and J. Garcia-Alfaro, Eds., Berlin, Heidelberg: Springer Berlin Heidelberg, 2012, pp. 41–55. doi: https://doi.org/10.1007/978-3-642-31540-4_4.
[13] J. C. John, S. Sural, and A. Gupta, “Optimal Rule Mining for Dynamic Authorization Management in Collaborating Clouds Using Attribute-Based Access Control,” in 2017 IEEE 10th International Conference on Cloud Computing (CLOUD), 2017, pp. 739–742. doi: 10.1109/CLOUD.2017.104.
[14] M. Mehmood, R. Amin, M. M. A. Muslam, J. Xie, and H. Aldabbas, “Privilege Escalation Attack Detection and Mitigation in Cloud Using Machine Learning,” IEEE Access, vol. 11, pp. 46561–46576, 2023, doi: 10.1109/ACCESS.2023.3273895.
[15] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero trust architecture,” Natl. Inst. Stand. Technol. Spec. Publ. 800-207, 2020, doi: https://doi.org/10.6028/NIST.SP.800-207.
[16] N. F. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, and R. Doss, “Zero Trust Architecture (ZTA): A Comprehensive Survey,” IEEE Access, vol. 10, pp. 57143–57179, 2022, doi: 10.1109/ACCESS.2022.3174679.
[17] L. Karimi, M. Aldairi, J. Joshi, and M. Abdelhakim, “An Automatic Attribute-Based Access Control Policy Extraction From Access Logs,” IEEE Trans. Dependable Secur. Comput., vol. 19, no. 4, pp. 2304–2317, 2022, doi: 10.1109/TDSC.2021.3054331.
[18] M. W. Sanders and C. Yue, “Mining least privilege attribute based access control policies,” in Proceedings of the 35th Annual Computer Security Applications Conference, in ACSAC ’19. New York, NY, USA: Association for Computing Machinery, 2019, pp. 404–416. doi: 10.1145/3359789.3359805.
[19] Z. Xu and S. D. Stoller, “Mining Attribute-Based Access Control Policies,” IEEE Trans. Dependable Secur. Comput., vol. 12, no. 5, pp. 533–545, 2015, doi: 10.1109/TDSC.2014.2369048.
[20] B. Tang, R. Sandhu, and Q. Li, “Multi-tenancy authorization models for collaborative cloud services,” Concurr. Comput. Pract. Exp., vol. 27, no. 11, pp. 2851–2868, 2015, doi: https://doi.org/10.1002/cpe.3446.
[21] Y. A. Younis, K. Kifayat, and M. Merabti, “An access control model for cloud computing,” J. Inf. Secur. Appl., vol. 19, no. 1, pp. 45–60, 2014, doi: https://doi.org/10.1016/j.jisa.2014.04.003.
[22] R. Shimizu and H. Kanuka, “Test-Based Least Privilege Discovery on Cloud Infrastructure as Code,” in 2020 IEEE International Conference on Cloud Computing Technology and Science (CloudCom), 2020, pp. 1–8. doi: 10.1109/CloudCom49646.2020.00007.
[23] D. R. Kuhn, E. J. Coyne, and T. R. Weil, “Adding Attributes to Role-Based Access Control,” Computer (Long. Beach. Calif)., vol. 43, no. 6, pp. 79–81, 2010, doi: 10.1109/MC.2010.155.