Traditional solutions like privileged access management or identity governance and administration tools falls short when it comes to managing the complexities of cloud entitlements. Access to cloud infrastructure and resources are known as entitlements. Cloud Infrastructure and Entitlement Management (CIEM) is a new solution for it.

What is CIEM?

CIEM tools are purpose built solutions that help enterprises manage permissions, identities and entitlements within cloud environments and resources within them. Ultimately the goal is to apply the principle of least privileged access, which just means giving users the lowest level permissions needed to perform their work. But, when you are handling complex, multi-cloud environments, enforcing least-privileged access is a challenge because there is no easy way to see a complete list of entitlements across different service providers or to compare the different definitions those providers have for them. CIEM helps to address the issues by reducing the amount of excessive cloud infrastructure entitlements and streamlining least privileged access controls across all of your cloud environments.

Why these issues are problematic?

Companies aren’t providing excessive access on purpose. There are several factors that make it difficult to calculate that minimum level of access. First, each cloud service provider, CSP, uses different definition for functionally similar entitlements. They are in fact, competing, and even overlapping, controls within and across CSPs. Then simply there is an enormous number of entitlements or access to cloud resources out there. Manually calculating how any of those entitlements affects user’s permissions is an incredibly tedious challenge, let alone across hundreds of users. Not to mention that those calculations have to account for the fact that these cloud environments are constantly shifting along with the entitlements associated with them. And finally there is an inherent level of risk in exposing access to cloud infrastructure. These users have privileged access to resources, permissions and data. Although developers and DevOps teams need this kind of access to execute efficiently, this must be balanced against broader risk management considerations.

Fundamental Functions of CIEM

There are 4 key functions that a CIEM solution should help with.

1. Gain visibility into net effective permissions – A solution must be able to account for all the different entitlements and show exactly what a given user can do within the cloud environment. Without effective monitoring of these identities, or their associated effective permissions, the cloud landscapes are exposed to greater security risks and threats.
2. Discover and remediate excessive and outdated permissions – Monitoring permissions on a continuous basis offers an additional level of visibility that will allow to determine whether a user has too much access or, if the level of access is still needed at all. Expired, outdated or excessive permissions poses threats to cloud environment. So it is crucial to eliminate any unnecessary broad region access.
3. Enforce least privilege access – Once we have an understanding of permissions, a CIEM solution should be able to tell how to adjust them to get a user to a state of least privilege. Goal is to protect data and cloud. To enforce least privilege, consider what cloud users can access , how they can access it and what they can do with given access. The identities should be able to do their job while ensuring that your resources are protected from unnecessary exposure.
4. Perform advanced investigations – A CIEM solution should be able to offer tools that enable to run a query against all cloud identity data in order to answer user access related questions and gain additional insights. Performing advanced investigations will help protect your cloud by immediately detecting permission vulnerabilities and misconfigurations.

Final Word

CIEM tools are purpose built solutions that help enterprises manage access within large, multi-cloud environments. Without a specialized solution, teams must manually compare entitlements across CSPs and calculate what a user’s permissions are. CIEM solutions monitor the access assigned to each user recognize if permissions need to be modified or adjusted and help guide you in making those adjustments.