Cloud identity

Cloud identity is a software-as-a-service solution that combines identity, access, application, and endpoint management. Administrators use this identity-as-a-service offering to manage users, applications, and devices from a central location. A unified solution, cloud identity benefits IT and security teams by streamlining the process to federate identities between identity providers.

Cloud identity benefits

Benefits of cloud identity include the following:

1. Allows users to easily access applications using single sign-on
2. Assesses domains’ overall exposure to a data breach
3. Automates mobile device management
4. Enables intuitive user experiences on endpoint devices
5. Extends on-premises directory to the cloud
6. Identifies users that pose security risks
7. Leverages threat intelligence signals to optimize security defenses
8. Protects user and organizational data with multi-factor authentication
9. Provides an easily accessible view of administrator activity logs and overviews of key metrics and trends
10. Secures devices by enforcing screen locks or passcodes
11. Supports policy enforcement for all devices (i.e., personal, corporate) with endpoint management tools
12. Unifies management of users, access privileges, applications, and endpoint management

Typical features of cloud identity solutions

Key features of cloud identity solutions include:

1. Ability to set up digital workspaces quickly
2. Account takeover protection
3. Automated user provisioning and de-provisioning
4. Context-aware access
5. Endpoint management
6. Hybrid identity management with Active Directory and secure LDAP (lightweight directory access protocol)
7. Integration with hundreds of cloud applications out of the box
8. Multi-factor authentication (MFA)
9. Single sign-on (SSO)
10. A unified management console

Cloud identity and single sign-on

Cloud identity, acting as a third-party identity provider (IdP), supports the OpenID Connect (OIDC) and Security Assertion Markup Language 2.0 (SAML) protocols. While SAML requires more effort to implement than OIDC, it is more well-established in enterprises. Conversely, OIDC is easier to establish, but is not widely adopted in enterprises.

Cloud identity provides administrators with the option to use the protocol that works best for their deployments.

Cloud identity and multi-factor authentication

Cloud identity allows organizations to implement MFA in several ways and at varying levels.

Levels include:

1. Optional
   Users opt-in to the use of MFA rather than it being required
2. Mandatory
   Users select which MFA method to use
3. Security keys mandatory
   Users are required to use a security key as an authentication factor

Cloud identity MFA options include:

1. Backup codes provided to users in advance of needing them for cases where users will not have connectivity to receive codes
2. One-time codes delivered via text message or phone call
3. Prompts sent to a mobile device to verify that the login attempt is legitimate
4. Security keys (e.g., physical key inserted into a USB (universal serial bus) port on users’ computers)

Cloud identity and the principle of least privilege

Cloud identity supports the enforcement of the principle of least privilege. That is, cloud identity helps ensure that a person or system only has access to resources limited to the minimal amount required to do their jobs.

Cloud identity helps enforce the principle of least privilege in a number of ways, including with:

1. The ability to evaluate the risks of identities, human and non-human, across multiple public clouds
2. Continuous monitoring of identities and access for activities that conflict with governance rules and normal operational behavior
3. End-to-end visibility

Cloud identity and just-in-time access

Just-in-time access is an approach to applying the principle of least privilege. For users who need privileged access, just-in-time access limits rights to only when they are required.

Just-in-time privileged access rights range from permanent (i.e., applicable until revoked) to eligible (i.e., approved for access on an as-needed basis). Cloud identity uses just-in-time access to:

1. Conduct audits and assessments of past activities
2. Create a record of why privileges were activated
3. Minimize the chance of a user compromising resources (i.e., modifying or deleting resources)

Cloud identity and regulatory compliance

Cloud identity helps organizations meet the compliance requirements of key regulations, including the following.

California Consumer Privacy Act (CCPA)

Functions included with cloud identity that support CCPA compliance are:

1. Access governance to control where the data is housed and who can access it
2. Centralized administration of access management and identity governance
3. Identity management capabilities that tie individual consumers to their data and privacy requests
4. Strong authentication

Family Educational Rights and Privacy Act (FERPA)

Cloud identity helps meet FERPA compliance requirements with:

1. The ability to delegate education data access to third parties
2. Accurate, complete, and time-stamped logging of users
3. Automated reporting with access management evidence to meet audit standards
4. A federated infrastructure that allows secure access based on the principle of least privilege

General Data Protection Regulation (GDPR)

GDPR requirements supported by cloud identity include:

1. Access governance
2. Access management
3. Authentication
4. Authorization
5. Identity governance
6. Identity management

Gramm-Leach-Bliley Act (GLBA)

GLBA compliance requirements that cloud identity addresses are:

1. Automated provisioning and de-provisioning of users as roles and employment status change
2. Enforcement of the principle of least privilege
3. Multi-factor authentication
4. Role-based management that grants access according to users’ roles rather than direct assignment
5. Separation of duties controls

Health Insurance Portability and Accountability Act (HIPAA)

Among the HIPAA compliance requirements addressed with cloud identity are:

1. Automatic access logging and automated reporting to facilitate auditing
2. Centralized access governance across organizations’ infrastructure, including human and non-human users (e.g., IoT (Internet of Things) devices)
3. Credential protection with single sign-on

New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act)

Cloud identity capabilities that support compliance with the NY SHIELD Act include:

1. Automated provisioning and de-provisioning of users as personnel change roles
2. Entitlement management to limit permissions to the least privileges
3. Federated identity management to simplify integration and tracking of business partners
4. Multi-factor authentication to increase the difficulty of stealing credentials to access data illicitly

Sarbanes-Oxley Act (SOX)

SOX compliance requirements addressed with cloud identity are:

1. Automatic logging and tracking tools that generate clear reports for compliance audits
2. Centralized administration of access management and identity governance
3. Enforcement of separation of duties rules
4. Verification of user rights and permissions across the infrastructure

Why cloud identities must be governed

To protect cloud environments, cloud entities must be governed by rules that tightly manage access privileges and permissions. Cloud infrastructures include thousands of human and machine entities that create a growing attack surface. Cloud identity governance solutions automate the management of identity, permissions, and access risks at scale to effectively and efficiently secure cloud infrastructures.

Modernize and strengthen security with cloud identity

Cloud identity solutions typically provide features and functionality that is purpose-built for modern infrastructures. Identities can be managed and protected from exploitation in complex cloud environments.

Organizations that leverage cloud identity reap numerous benefits, including adherence to many compliance requirements and support for enforcing the principle of least privilege, which is regarded as a must-have for mitigating risk and defending against threats.

Take control of your cloud platform.

Learn more about SailPoint Identity Security.