The Black Unicorn Report for 2021

Is The Cloud Leaving You Exposed?
Exploring the public cloud and addressing its unanticipated security challenges
By Chuck Slate, Lead Architect, Attivo Networks, Inc.
On a traditional network, user accounts are the main identity type and, therefore, the primary security focus.
In the public cloud, the concept of identity is extended to any object with entitlements (permissions) to
another object. This includes “non-human” identities like applications, containers, virtual machines, and
other object types that have historically played the role of a resource only.
A core benefit of the public cloud is that it offers managed services such as database, DNS, and storage
services. Managed services free admins from the responsibility of having to build and maintain substantial
pieces of the cloud infrastructure for themselves. Instead, they define a database table, for example, and
grant access to the applications that need it. (In such a scenario, the applications function as non-human
identities vis-à-vis the managed database because they have permissions to read or write to the managed
database’s table.)
The sheer volume of cloud identities and entitlements resulting from new concepts like non-human
identities and managed services can leave cloud security professionals overwhelmed and often blind to
the full extent of their exposure.
The Wild West of Identities and Entitlements
What might amount to hundreds of identities on a traditional network could translate into thousands in the
public cloud. That increase in the number of identities exacerbates existing security challenges. For
example, “privilege creep” is the idea that identities accumulate access to more resources than they need
over time. This situation has historically been a common problem on traditional networks. Because the
public cloud has that many more identities, privilege creep is that much more probable and dangerous in
57