Implementing Least Privilege for Interconnected, Agile SOAs/Clouds

Abstract

The principle of least privilege – users/programs should operate using the least amount of privilege necessary to complete the job – is stated as a critical security (access control policy) objective in most high-level information security policy documents and information security related government regulations and guidance documents. “True least privilege” is a (mostly) theoretical optimum of exactly only the access provisioning that is required, while most real-world least privilege implementations are “suboptimal” in that they overprovision access (e.g. in privilege user account access, government regulations/guidance/ standards) – with disasters such as the U.S. embassy Wikileaks incident as a result. Least privilege is harder to implement the more optimal it should be, because doing it right can be highly complex: (1) it requires fine-grained access policy management that goes beyond identity and roles based access controls, towards attribute-based (ABAC), resource-based (ResBAC), and authorization-based (ZBAC) access controls; (2) access policies need to be highly contextual in order to minimize excess access provisioning; (3) implementing such fine-grained, contextual across policies reliably and verifiably is particularly challenging for today’s dynamically changing IT application landscapes such as agile Service Oriented Architectures (SOAs) and emerging Cloud mash-ups (with “Platform as a Service”, PaaS).