Automated Detection of Excessive Privileges in Enterprise Cloud Environments

  • Authors

    • Uday Allala Lead SRE Engineer, USA. Author

    DOI:

    https://doi.org/10.67228/30716357/IJMRSE-2020PI3K5R

    Published 06-09-2020

  • Excessive Privileges, Privilege Detection, Cloud Security, Identity and Access Management, Least Privilege, Access Control, Zero Trust, Machine Learning, Cloud-Native Security, Identity Governance

    Issue

    Vol. 3 No. 1 (2020)

    Section

    Articles

  • Abstract

    As enterprise cloud services become ubiquitous, the management of identities and access has become more complex, and it is crucial to identify excessive privileges as a security concern. The proliferation of enterprise cloud services has made identity and access management more complex, and it has become important to detect excessive privileges as a security concern. Users, service accounts, and applications often end up with more permissions than needed, which can lead to unnecessary attack surface and risk of unauthorized access, privilege escalation, and misuse of sensitive cloud resources. Traditional access control and periodic auditing methods are primarily rule-based and manual, and fail to effectively discover unused, unnecessary and high-risk privileges in dynamic cloud environments continuously. To overcome these restrictions, this paper presents an automated detection framework of excessive privileges that considers identity attributes, roles assigned, resources sensitivity, and access behavior observed to detect potentially unnecessary privileges. The methodology proposed integrates the analysis of permissions, assessment of privileges with risks, behavioral features with automated classification to continuously analyze the appropriateness of access that has been granted. Experimental evaluation of the proposed framework is done with representative enterprise cloud identity and access scenarios, and then compared with traditional privilege analysis methods. The accuracy, precision, recall, F1-score, false-positive rate, detection time, and computational overhead are used to measure performance. The evaluation shows the ability of the proposed approach to detect over-privileged and unused permissions while achieving good detection rates in different identity and permission settings. The framework also introduces a risk-based prioritization for identified privileges so that security administrators can prioritize remediation activities for high-risk access relationships. The primary idea of the work is an automated and scalable solution to detect excessive privileges continuously that enhances the least-privilege enforcement, and enhances the security posture of enterprise cloud environments by supporting cloud identity governance.

  • References

    [1] Ross, R., Pillitteri, V., Dempsey, K., Riddle, M., & Guissanie, G. (2019). Protecting controlled unclassified information in nonfederal systems and organizations (No. NIST Special Publication (SP) 800-171 Rev. 2 (Draft)). National Institute of Standards and Technology.

    [2] Hu, V. C., Ferraiolo, D., Kuhn, R., Friedman, A. R., Lang, A. J., Cogdell, M. M., ... & Scarfone, K. (2013). Guide to attribute based access control (abac) definition and considerations (draft). NIST special publication, 800(162), 1-54.

    [3] Hu, V. C., Ferraiolo, D., & Kuhn, D. R. (2006). Assessment of access control systems (Vol. 76). Gaithersburg, MD: US Department of Commerce, National Institute of Standards and Technology.

    [4] Ferraiolo, D., Chandramouli, R., Hu, V., & Kuhn, R. (2016). A comparison of attribute based access control (ABAC) standards for data service applications. NIST Special Publication, 800(2016), 178.

    [5] Yu, S., Wang, C., Ren, K., & Lou, W. (2010, March). Achieving secure, scalable, and fine-grained data access control in cloud computing. In 2010 proceedings ieee infocom (pp. 1-9). IEEE.

    [6] Krutz, R. L., & Vines, R. D. (2010). Cloud security: A comprehensive guide to secure cloud computing. Wiley Publishing.

    [7] Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2019). Zero trust architecture (NIST Special Publication 800-207, Initial Public Draft). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207-draft

    [8] Jensen, M., Schwenk, J., Gruschka, N., & Iacono, L. L. (2009, September). On technical security issues in cloud computing. In 2009 IEEE international conference on cloud computing (pp. 109-116). IEEE.

    [9] Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM computing surveys (CSUR), 41(3), 1-58.

    [10] Andress, J. (2014). The basics of information security: understanding the fundamentals of InfoSec in theory and practice. Syngress.

    [11] Chandramouli, R., Ferraiolo, D., & Kuhn, D. (2007). Role-Based Access Control. Artech.

    [12] Sabelfeld, A., & Myers, A. C. (2003). Language-based information-flow security. IEEE Journal on selected areas in communications, 21(1), 5-19.

    [13] Sanders, M., & Yue, C. (2017, October). Automated least privileges in cloud-based web services. In Proceedings of the fifth ACM/IEEE Workshop on Hot Topics in Web Systems and Technologies (pp. 1-6).

    [14] Hatamian, M., Momen, N., Fritsch, L., & Rannenberg, K. (2019). A multilateral privacy impact analysis method for android apps. In Annual Privacy Forum (pp. 87-106). Springer, Cham.

    [15] Man, N. D., & Huh, E. N. (2011, December). A collaborative intrusion detection system framework for cloud computing. In Proceedings of the International Conference on IT Convergence and Security 2011 (pp. 91-109). Dordrecht: Springer Netherlands.

    [16] Sanders, M. W., & Yue, C. (2018, March). Minimizing privilege assignment errors in cloud services. In Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy (pp. 2-12).

    [17] Zhou, L., Varadharajan, V., & Hitchens, M. (2013). Achieving secure role-based access control on encrypted data in cloud storage. IEEE transactions on information forensics and security, 8(12), 1947-1960.

    [18] Kuhn, R., Coyne, E., & Weil, T. (2010). Adding attributes to role-based access control.

    [19] Covington, M. J., Fogla, P., Zhan, Z., & Ahamad, M. (2002, December). A context-aware security architecture for emerging applications. In 18th Annual Computer Security Applications Conference, 2002. Proceedings. (pp. 249-258). IEEE.

    [20] Wang, Y., Zheng, J., Sun, C., & Mukkamala, S. (2013, July). Quantitative security risk assessment of android permissions and applications. In IFIP Annual Conference on Data and Applications Security and Privacy (pp. 226-241). Berlin, Heidelberg: Springer Berlin Heidelberg.

    [21] Ou, X., & Singhal, A. (2011). Quantitative security risk assessment of enterprise networks. Berlin: Springer.

    [22] Celik, Z. B., McDaniel, P., Izmailov, R., Papernot, N., Sheatsley, R., Alvarez, R., & Swami, A. (2018, May). Detection under privileged information. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security (pp. 199-206).

  • Downloads