Identity Security Enforces Zero Trust of Your AWS Cloud

Trust No One Automatically when Giving Access to Cloud-based Assets

Businesses today are increasingly moving critical workloads and valuable assets to the cloud in order to reap cost savings and achieve productivity increases enabled by their Amazon Web Services (AWS) Cloud platform.

The proliferation of cloud resources, devices, and users present tempting targets for cybercriminals looking to infect systems with malware, steal valuable data, hijack resources, or even shut down critical services.

Download PDF

Conventional perimeter-based security models that relied solely on network location are now obsolete. In its place is Zero Trust — a security paradigm that aims to help organizations drive digital business with maximum security in their AWS Cloud without compromising efficiency or compliance.

Identity security is the cornerstone of an effective Zero Trust strategy. Identity security solutions add “identity awareness” to native AWS access control by automating the identity lifecycle in a number of ways. By enforcing “least privilege”, they restrict access rights for accounts, computing processes, and users based on what they require for performing typical activities — and nothing more. These solutions can also leverage roles and dynamic policy logic, continuously monitoring the environment to adapt to changes and threats.

When evaluating identity security solutions for your AWS Cloud, look carefully at how they help you implement three essential requirements of an identity-aware Zero Trust security model.

• Never trust – always verify
• Deliver Just-in-Time (JIT) access
• Continuously monitor, analyze, and adapt

In IDC’s 2020 Cloud Security Survey, 64% of organizations stated that one of their top three cloud security threats was lack of visibility into access in production environments.¹

Never Trust – Always Verify

With Zero Trust, you need to keep asking questions, including about behavior patterns as well as taking a more in-depth look at the user’s attributes. It’s essential to make accurate access decisions in your AWS Cloud based on contextual, up-to-date identity data.

Choose an identity security solution certified to work with your AWS Cloud that:

• Gives you 360° visibility into all user types and their related access in your AWS Cloud – including all permissions, entitlements, attributes, and roles
• Provides a single source-of-truth with clean, accurate identity records on which all access decisions for resources in your AWS Cloud can be confidently based
• Maintains the integrity of identity data by continuously refreshing and updating it through automated identity lifecycle management

Deliver Just-enough, Timely Access Through Least Privilege

Limit access rights for accounts, computing processes, and users to what they actually require when performing their typical activities in your AWS Cloud. This least privilege approach helps reduce the attack surface area, eliminate unneeded pathways to data, and can provide governance rules or guardrails that will automatically monitor and alert you to any cloud access that is not within standard policy or appears anomalous.

Choose an identity security solution certified to work with your AWS Cloud capable of:

• Automatically granting, updating, and revoking access as new users are created or roles change
• Reducing risk exposure by automatically de-provisioning unused access and accounts
• Granting least privilege access using roles, fine-grained entitlements, permissions and rules
• Detecting and preventing toxic access combinations to avoid potential fraud or data theft

Continuously Monitor, Analyze, and Adapt within Your AWS Cloud

Keep security up-to-date and dynamically respond as changes and threats are detected anywhere in your AWS Cloud.

Choose an identity security solution certified to work with your AWS Cloud that can:

• Monitor and drive deep visibility and understanding into all user access, including trends, roles, outliers, and relationships (typically AI-driven)
• Measure the efficacy of access controls for apps, data, and cloud to ensure permissions comply with policy
• Adjust access controls and policies as your business evolves and threats surface
• Continuously evaluate risk signals within your AWS Cloud and communicate with your Zero Trust gateway to ensure real-time enforcement of security policies
• Leverage custom workflows, APIs, and event triggers to further automate your identity security program

SailPoint Can Help

SailPoint and Amazon Web Services together deliver the best identity security for any AWS Cloud. As the leader in identity security, SailPoint offers AI-driven identity solutions that automate the identity lifecycle, enforce least privilege using roles and dynamic policy logic, and continuously monitor your AWS Cloud and adapt to changes and threats using AI/ML.

When combining SailPoint Identity Security with basic AWS access management capabilities, you can ensure your AWS Cloud is secure and governed in the same manner as the rest of your infrastructure. SailPoint imports AWS user identity information to help you:

• Control access to your AWS accounts
• Aggregate access information
• Govern AWS federation for a more secure cloud infrastructure

For more information visit: https://www.sailpoint.com/integrations/amazon-web-services.