In the age of digital transformation, organisations have experienced a wealth of advancements, helping them reshape how they operate. However, with this progress has come additional and significant challenges relating to cybersecurity, exacerbated by the rapid evolution of technology outpacing the adoption of appropriate security measures.

In particular, the rapid and widespread adoption of the cloud has introduced entirely new environments, roles and scenarios, necessitating a re-evaluation of  Privileged Access Management (PAM) and its application in securing identities. 

PAM, an overview

Initially conceived as a means to oversee high-privileged admin users' access and built on the notion that identities must be secured, not just managed, to protect an organisation’s most valuable assets, the recognised values of PAM remain highly desirable – least privilege, role-based access control and auditability of high-risk sessions. The challenge is applying all those principles to these new environments, roles and circumstances. 

For example, PAM has had to evolve to encompass a broader spectrum of identities in today’s dynamic landscape and consider them all identities, human and non-human. Still grounded on the principle of least privilege - meaning minimum levels of access required are granted - to protect access to high-value data and assets, PAM strives to safeguard access to critical data and assets across the entire enterprise IT environment, including cloud and DevOps. 

Navigating the complexities of cloud security 

In addition, cloud security introduces a paradigm shift in how business applications are secured, blurring the boundaries between administrators and regular users. Unlike the delineated roles in on-premises settings, the cloud, regardless of whether it is a hybrid or cloud-native environment setting, grants users the ability to assume multiple access controls simultaneously, posing a considerable challenge in delineating security responsibilities.  

As a case in point, CyberArk’s analysis of the three major cloud service providers (CSPs) shows that a user can access approximately 1,400 native services (e.g. AWS S3, Microsoft Azure Kubernetes Service or Google Cloud BigQuery), which collectively have 40,000 different access controls … and that number grows every day.

The delicate balance between velocity and security

Additionally, the imperative for speed and innovation in cloud operations must be balanced with robust identity security measures. This is a critical challenge organisations must address in their journey towards secure and agile cloud operations.

As organisations extend their ecosystems to encompass third-party vendors and suppliers and increasingly rely on contractors and sub-contractors,  additional risks and vulnerabilities are introduced.

For example, the drive to modernise the software supply chain and streamline operations adds another layer of complexity and significantly expands the attack surface, especially from an identity security perspective. In particular, security teams must address vulnerabilities in any development environment that exposes the entire organisation and minimise access availability and risk while maintaining the velocity of developers, DevOps and IT.   

Organisations, therefore, need to proactively address internal identity security concerns and the complexity of third-party risk management, fortifying security measures at every touchpoint within the extended enterprise ecosystem and safeguarding against threats from various sources within and beyond organisational boundaries.

Embracing zero trust privileges for cloud identity security

Amid these evolving ecosystems, organisations must embrace a zero-trust approach to identity security. By dynamically provisioning user entitlements on the fly, based on contextual factors and mitigating lateral movement risks, zero-trust frameworks offer a formidable defence against credential theft and unauthorised access.  

In conclusion, as organisations progress through their digital transformation journey, prioritising identity security must remain paramount. Utilising PAM will allow them to deploy a comprehensive cybersecurity strategy – comprising people, processes and technology – to control, monitor, secure and audit all privileged identities. Furthermore, by leveraging approaches such as zero trust, organisations can navigate the challenges of complex cloud environments and overcome the vulnerabilities of development environments while safeguarding against evolving cyber threats.