Cloud Compliance Blog

Is Perfect Access Control Possible?

Bruce Schneier, the Chief Security Technology Officer of BT and a highly regarded security guru, engaged in a point/counter-point debate with Marcus Ranum in an Information Security Magazine article entitled Schneier-Ranum Face-Off: Is Perfect Access Control Possible?

The question is particularly relevant today, especially in light of the fact that, as I've reported here and here, excessive access rights were the top audit finding over the past two years. Why is that? The general consensus is that organizations should implement a role-based access control (RBAC) system to manage entitlements. But as Schneier points out:

RBAC is very hard to implement correctly. Organizations generally don't even know who has what role. The employee doesn't know, the boss doesn't know--and these days the employee might have more than one boss -- and senior management certainly doesn't know.

Ranum seems to argue that at least part of the problem is that we're paying for decisions made over the past decade to make critical data easier to access and where it can be managed more cheaply, and that many of these decisions were incompetent and negligent.

What both Schneier and Ranum agree on is that over-entitlement is the norm today, and these excess entitlements -- also called excessive access rights -- represent a security and compliance exposure.

So where does that leave us? Based on what I've seen and the customers I've spoken to, I have to agree with Schneier's assessment:

In the end, a perfect access control system just isn't possible; organizations are simply too chaotic for it to work.

If RBAC systems are so hard to implement correctly, and even if doing so still leaves the organization with excessive access rights and their associated risks and vulnerabilities, what can be done? As I've suggested in my prior post, user activity monitoring in the form of an Identity and Access Control solution can complement RBAC identity management systems by providing feedback that uncovers excess entitlement in the form of dormant (aka zombie) accounts. Therefore, even if RBAC is very hard to implement correctly, and a perfect access control system just isn't possible, at least the organization can gain visibility into and remove the vulnerabilities and compliance exposure associated with excessive access rights.

Cloud Compliance is developing an Identity and Access Control (IdAA) solution as referred to above. We identify dormant accounts, and provide tools for isolating high rates of dormancy by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, in contrast to software-based IdM solutions, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.