All-In-One Identity Management and Cloud Security

It is easy to see how the fragmentation of the modern IT landscape caused by the adoption of a Cloud-first model has increased the importance of a having well-managed authorization strategy and the complexity of achieving this goal. 

To help you choose the best access control model for your organization or application, we compare the most popular options, we'll also analyze and discuss the various attribute-based and role-based approaches for application authorization, including their applicability, strengths, and weaknesses: 

A well-designed authorization system is essential for managing the day-to-day activities to control who has access to what and enable organizations to safely undergo a digital transformation moving more of their business online and into the Cloud.

Understanding the differences between different authorization models is critical for choosing an appropriate access control method for your organization or application. 

Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is a security and authorization model for securing access to computer
resources used by almost all enterprises to secure their systems. RBAC access is based on roles defined by the business using them. In the RBAC model, roles are created, and then sets of permissions for resources are assigned to the role. Users are then granted one or more roles to receive access to resources. 

Fig: RBAC PDP Flow Determining Access to Bob’s X-Ray for Alice

RBAC Benefits
In the RBAC model, since access is not directly assigned to users but bundled into assignments made to roles, the correct assumption is that controlling and maintaining access is easier. Moreover, because roles and access management can be centralized, it is evident who has a role and access to the role grants. There are fewer assignments to be managed, which decreases the cost of security management and compliance auditing. Furthermore, according to a 2010 NIST study, correct RBAC implementation and efficient provisioning can also reduce employee downtime resulting in significant ROI.

• RBAC is deterministic. An RBAC approach makes it easy to know who has access to what at any moment in time.
• RBAC is more direct and easier to visualize. Security admins can visualize the actors and resources they will affect when creating or modifying a policy.
• RBAC is inherently auditable. With RBAC assignments, as the consequences of that access are visible, it is simple for business owners to certify or attest to access granted. This visibility contrasts with ABAC where a “before the fact audit" is impossible and the effects of a rule are difficult to ascertain.
• RBAC can be simpler than ABAC. For example, with RBAC, bundles of access can be directly assigned to a user. To do this in ABAC requires the creation of a new rule.

RBAC Weaknesses

Unfortunately, the precise nature of the RBAC model can also be considered the source of many of its weaknesses:

• RBAC requires advanced knowledge of the Subjects and Resources and, typically, does not support making on-the-fly contextual decisions.
• An RBAC-only approach can result in an enormous number of roles to accomplish fine-grained authorization.
• Resource owners must know something about the roles and their intended purpose to grant access to those roles accurately.
• Resources must be organized into collections to facilitate delegation.
• Probably the most well-known problem with RBAC is “role explosion.”  Organizations often end up with large numbers of roles to accommodate people performing the same job function within different geographical or functional areas within the company. Given a substantial number of roles and collections of resources, a correspondingly large number of delegations would need to be created and managed. 

ATTRIBUTE-BASED ACCESS CONTROL (ABAC)

Attribute-Based Access Control (ABAC): An access control method where the subject requests to perform operations on objects are granted or denied based on assigned attributes of the subject, assigned attributes of the object, environment conditions, and a set of policies that are specified in terms of those attributes and conditions.

The policies that can be implemented in an ABAC model are limited only to the degree imposed by the computational language and the richness of the available attributes.

Essentially, the more decision data at your disposal at runtime, the more sophisticated your ABAC policies can be. 

ABAC relies on user attributes for authorization decisions. ABAC policies are rules that evaluate access based upon the following four sets of attributes:

• Subject – the attributes concerning the person or actor being evaluated.
• Resource – the attributes of the target or object being affected.
• Action – describe the action to be performed on the Resource
• Environment – includes attributes such as the time of the day, IP subnet, and others that do not relate to
  either the Subject or the Resource. 

Fig: NIST SP 800-162 ABAC Definition

ABAC Benefits

The key advantage of ABAC is that it does not allow application developers to hardcode a static list of roles and oversimplify their authorization source code. Rather, ABAC forces them to centralize all authorization decisions and call out at runtime to decide based on the Subject, Resource, Action, and Environment request attributes. Another key benefit is ABAC’s sometimes simpler nature. This simplicity can make it easier to understand how a rule grants access to a resource when dealing with a small number of rules. In contrast, RBAC does seem foreign to many users, and, especially during the early phase of its adoption, the levels of abstraction can be challenging for an IT team.

One other added advantage of ABAC is its flexibility. With ABAC, as long as the necessary data is available, almost anything can be represented as a rule-based query. For example, a rule evaluated at runtime in a login session can use contextual information—even information passed in via SAML claims or JWT tokens. In contrast, when delivering the role membership for a user to the application, a standard RBAC engine would not evaluate this type of information.

Everything we cover in this blog can be explored further in our whitepaper “A Guide to Authorization”. You can find that whitepaper here: 

ABAC Primary Benefits

• ABAC enforces centralized management of authorization policies
• ABAC makes it easy to specify access rules as simple queries.
• ABAC rules can be extraordinarily fine-grained and contextual.
• ABAC rules can evaluate attributes of Subjects and Resources that are not inventoried by the authorization system.
• ABAC rules need less maintenance and overhead because they do not require the creation or maintenance of the structure on which an RBAC model depends, e.g., roles and resource locations.

ABAC Weaknesses
The first challenge we encounter with implementing policies like this is the information needs to be obtained and evaluated at runtime. In our policy example, if we needed to know if the user’s nationality was Swiss, then this information would likely reside in either the corporate Active Directory or HR system. Moreover, if we needed to know if the company was in Emergency Mode or not, this essential information might be difficult to obtain in a live corporate environment. Likewise, if we needed to as certain their out-of-office status, this would reside in a corporate email system such as Microsoft 365. Furthermore, to attain information for network login sessions or the MFA status would require a query to an Identity Provider such as Ping Federate. 

ABAC’s Primary Weaknesses

• ABAC makes it extremely difficult to perform a “before the fact audit” and determine the permissions available to a specific user. To successfully determine access, not only might a considerable number of rules need to be executed, but they must also be done in the same order in which the system applies them. As a result, this could make it impossible to assess risk exposure for any given employee position.
• In a comparable manner to how a “Role Explosion” can occur with RBAC, an explosion can also occur with ABAC where a system with N number of attributes would have 2N possible rule combinations.
• Unless rules are kept extremely simple and do not access data from various source systems, ABAC systems with complex rules from multiple attribute sources can be unacceptably slow to answer authorization queries. 

RBAC Versus ABAC: Tradeoffs and Balance
As shown in Figure 28, the decision between ABAC and RBAC is a trade-off. On the one hand, you can have fast, simple, and other RBAC related benefits and, on the other, you can have extensible, scalable, and other ABAC-related advantages. To date, the challenge has been to find the right balance for your own organization’s needs. This is where Policy-Based Access Control (PBAC) helps. 

 

POLICY-BASED ACCESS CONTROL (PBAC)

Policy-Based Access Control (PBAC) is not a formally defined standard but rather describes an authorization model that combines RBAC and ABAC concepts and eliminates some of their shortcomings. The key concept behind PBAC is that policies are expressed as assignment relationships that can be visualized and manipulated graphically. Access rights to perform operations against resources or objects are acquired through relationships referred to as associations. This includes the ability to define complex hierarchical relationships with inheritance, which is overly cumbersome in ABAC. One might consider PBAC as “relational ABAC.” PBAC is best used for real time enforcement of authorization decisions where a well-developed role model can be leveraged for policy assignment.

PBAC policies are inherently more efficient than ABAC policies because authorization decisions are not based on multiple computed and then combined local decisions. Instead, they are based on the net result of multiple policies based on relationships existing within a single database. This aspect also allows PBAC to enforce dynamic Segregation of Duties (SOD) rules, which are not entirely achievable with ABAC. A last key feature mentioned is PBAC support for “before the fact audit,” which is the ability to see who has access to a resource at any time, and not just during the real-time evaluation of a policy set.



EMPOWERID’S HYBRID ROLE & ATTRIBUTE-COMPLIANT ACCESS APPROACH 

Defining and maintaining compliant access for a large organization can be a daunting task. Some types of applications and use cases are better suited to a more structured role-based approach, whereas others require real-time contextual decisions. RBAC, ABAC, and PBAC are three ways of managing authorization policies. Moreover, while both have overlapping qualities, individually, each one cannot cover all the necessary aspects of access control. However, for optimal, dynamic support of an IT organization’s needs, EmpowerID supports RBAC relational modeling. RBAC relational modeling provides the backbone or structure for defining an organization and its overall policies while leveraging the flexibility and real-time contextual nature of ABAC and PBAC to offer the best comprehensive solution. 

EmpowerID’s sophisticated role and relationship modeling allow security architects to model the organization and its structure and policies, including segregation of duties policies to prevent undesired combinations of access. As illustrated above, flexible attribute-based ABAC or PBAC policies support the centralized real-time decision point for applications that can call the EmpowerID API for authorization decisions. The ABAC/PBAC engine enhances or modifies the powerful RBAC engine's decisions, allowing their use only when greater flexibility or contextual information such as risk, location, and MFA type is required. By including the pre-calculated access results that the engine derives from complex RBAC policies that account for inheritance and even attribute-based queries, ABAC/PBAC policies are made much more potent. The end-goal of leveraging each approach's best is to deliver what EmpowerID calls “Compliant Access Delivery.” 

What is Compliant Access Delivery: Sign up for our Newsletter!

Conclusion

In summary, we learned that no single method covers all use cases and application technologies. The overall goal of Compliant Access Delivery requires using the best of each approach implemented following the principles of Zero Trust and Least Privilege. When executed correctly, this automates access assignments and reduces an organization’s attack surface, making it harder for attackers to find privileged credentials and offers them fewer capabilities to perform malicious activities when they compromise a privileged account. 

 

 

 

In the realm of cybersecurity, the Zero Trust model has emerged as a robust framework for enhancing security. A key aspect of this model is effective identity governance, which can be significantly streamlined and made more efficient through the use of proxy models and workflows.

Today we'll be exploring how these tools can be leveraged to bolster security and efficiency in identity governance within Zero Trust environments.

What are Proxy Models?

Proxy Models in identity governance can be likened to gatekeepers in a business organization, ensuring that only authorized individuals gain access to sensitive resources. Just as a gatekeeper verifies the identity and permissions of individuals before granting entry, proxy models act as intermediaries between users and the systems they wish to access. They authenticate and validate user identities, ensuring that only authorized personnel are granted appropriate access privileges.

The Power of Proxy Models

Proxy models provide a powerful tool for managing identities in a Zero Trust environment. By acting as an intermediary between users and resources, proxy models can enforce strict access controls, ensuring that users only have access to the resources they need. This approach significantly reduces the attack surface and helps to prevent unauthorized access.

Moreover, proxy models can help to alleviate some of the challenges of the cybersecurity labor shortage and skills gap. By reducing the need for costly IT staff with specific knowledge and training in each of the proxied systems, proxy models can help organizations to manage their resources more efficiently.

By implementing proxy models, businesses can establish a robust and secure system where user actions are monitored and controlled, mitigating the risk of unauthorized access and potential data breaches. Think of proxy models as vigilant guards, protecting your business assets and maintaining the integrity of your identity governance framework.

The Efficiency of Workflows

Workflows, particularly those that are automated, can greatly enhance efficiency in identity governance. By automating routine tasks, workflows can reduce the time and effort required to manage identities, freeing up IT staff to focus on more strategic tasks.

For instance, consider the process of onboarding a new employee. An automated workflow could streamline this process, ensuring that the new employee's identity is properly set up across all necessary systems. This not only saves time but also reduces the risk of errors that could lead to security vulnerabilities.

Practical Strategies for Implementation

Implementing proxy models and workflows in identity governance involves several key steps. First, organizations need to identify the resources that need to be managed and the users who will need access to these resources. Next, they need to define the access controls that will be enforced by the proxy models.

Once the proxy models are in place, organizations can then develop workflows to automate routine identity governance tasks. These workflows should be designed to be flexible and adaptable, allowing for changes in the organization's needs and circumstances.

Today, most modern Identity Governance Platforms such as EmpowerID, are equipped with the requisite toolsets to implement these robust policy frameworks. Developing and integrating these systems separately might require significant planning, resources, and expertise for most organizations; instead opting for a modern Identity Platform that easily integrates with your enterprise's existing applications might be the way to go forward. The flexibility to easily handle on-prem, cloud, and even hybrid workflows paired with the ability to integrate with Microsoft 365, SAP, ServiceNow, SalesForce, etc creates an extremely compelling offering for any organization looking to manage their identities. 

Conclusion

Proxy models and workflows offer powerful tools for enhancing security and efficiency in identity governance, particularly within Zero Trust environments. By implementing these tools and techniques, organizations can streamline their identity governance processes, improve their security posture, and better manage their resources. As the cybersecurity landscape continues to evolve, such strategies will be crucial for maintaining robust security.

If you are an ActiveRoles user, you know the value of a powerful and flexible Active Directory management solution. But as IT environments become more complex and diverse, managing identities and access across multiple systems and platforms requires a more comprehensive approach.

A modern Identity Governance solution provides more diverse features that understand the growing complexities of modern IT environments enabling deeper use cases than what you'd be limited by Quest Active Roles. While it provides many useful features for managing AD, it has quite a few limitations compared to other AD and identity governance platforms.

One of the biggest game-breakers with Active Roles is that it offers very limited functionality for Cloud users. While in theory, Quest can manage cloud users, but only to an extremely limited extent. The tool allows you to create and provision an AD user to a cloud system. However, the cloud system objects aren't inventoried and managed in the user interface, and you always need to have an AD user as your starting point for management.

This limitation can be problematic for organizations that rely heavily on cloud-based systems, as it creates an additional layer of complexity that may not be necessary. Without proper inventory and management of cloud-based users, organizations may struggle to maintain security and compliance standards.

Aside from this, here's a list of a few more of these limitations for Quest ActiveRoles:

1. Restrictive reporting and analytics capabilities:

   Quest ActiveRoles provides limited reporting and analytics capabilities, limited to just Users and Groups, as compared to other IGA Platforms that can provide in-depth and comprehensive analytics on every single AD Attribute. This severely limits you from getting a complete picture of your identity and access management activities.

2. Neglible support for non-Microsoft platforms:

   Quest Active Roles is designed to work only with Microsoft Active Directory environments and does not support other directory services. This can be a significant limitation for your organization if you use a mix of different platforms, such as Unix or Linux. 

3. Limited integration with other Systems and IAM solutions:

   Quest ActiveRoles does not integrate well with other IAM solutions, making it difficult for organizations to implement a comprehensive identity governance program. Active Roles also is limited to just being able to manage only your Active Directory, providing no way to manage users on other Systems and Applications. 

4. Finite automation capabilities:

   Quest ActiveRoles does not provide extensive automation capabilities, which can make it difficult for organizations to automate repetitive tasks and workflows. Users will have to rely on writing scripting to complete tasks, which, when managing directories with millions of groups, objects, and users, can make even small tasks take exponentially longer and more expensive.

5. Lacking Cloud readiness:

   ActiveRoles Server was designed to work with on-premises Active Directory environments, which is not ideal for organizations that are moving to the cloud or adopting hybrid environments. A modern Identity Management solution offers better cloud-ready features, such as support for multi-cloud environments and identity as a service (IDaaS) capabilities, reported missing in Quest ActiveRoles. 

6. Lacking essential Identity features:

   ActiveRoles Server lacks advanced features like identity governance, access certification, risk-based access control, and identity analytics that are essential for modern organizations to manage identity and access in complex environments. Self Service features such as Access Requests and Password Resets are shown to have saved organizations millions of dollars in helpdesk costs and are seen as a must for any good IGA platform.

EmpowerID offers a modern, web-based solution that goes beyond Active Directory management to provide full Identity Governance and Administration, Access Management, and Privileged Access Management capabilities. With EmpowerID, you can manage identities and access across on-premises and cloud-based systems, applications, and platforms, including Microsoft Azure, SAP, Oracle, and more.

EmpowerID's True Zero Trust administration for Azure and other platforms allows for fine-grained access controls and risk management, and its low-code identity orchestration engine allows for easy automation of complex business processes. EmpowerID's powerful RBAC and PBAC hybrid authorization engine provides efficient and flexible administration and runtime policy enforcement.

Not only does EmpowerID offer advanced capabilities beyond Active Roles, but it also offers the convenience and scalability of a modern SaaS platform. EmpowerID's modular licensing allows you to add or remove features as your needs change easily, and its cloud-based deployment means you can manage your identities and access from anywhere.

Don't settle for less with ActiveRoles - Make the switch to EmpowerID and experience the power and flexibility of a modern, web-based Identity Governance and Administration solution that goes beyond Active Directory management.

If you'd like to read more about Cloud Ready Identity Governance Platforms, we'd recommend our Whitepapers on these subjects: Siemens Case Study, Cloud Infrastructure Entitlement Management (CIEM) Report

 

 

Gartner Peer Insights is the market-leading peer-review platform by Gartner for comparing and rating enterprise technology solutions to ease decision-making making journeys for buyers.

We’re incredibly excited to share that EmpowerID ranks among the industry’s leading best-of-suite Identity Governance and Administration (IGA) providers on Gartner's Peer Insights.

More than 50% of our customers have given us a full 5 STAR recommendation on the peer-review website. Let’s see what they have to say about us!

"Simple and Easy to use Identity Management & Cloud Security Platform."

 

“EmpowerID - One of the Best Application Provisioning Platforms in the Market.”

 

"We have been able to accomplish more in 6 months with EmpowerID than in 2 years with our previous IAM platform."

 

“Flexible Pricing and Cost-effective”

 

“Ahead of its competitors in many things like its Quick Customer Support.”

“I like that it has increased our Workflow Efficiency.”

Read on Gartner to see what other customers think about EmpowerID's low-code orchestration platform!

EmpowerID has consistently emphasized our customers' needs in our products. We know that when they succeed with EmpowerID, we succeed. In this past year, as the vast majority of companies shifted towards remote work, EmpowerID was not only their partner to ensure a smooth and secure transition but also a guide in accelerating their digital transformation journey.

Our end-to-end support, starting from the platform itself and extending down the line to the entire Deployment support, is designed to ensure that our customers achieve the fastest time to value and grow their return on investment with EmpowerID right from Day One. Our products, such as Azure License Manager and Azure SCIM VDS, reflect all these ideals.

Identity Governance and Administration (IGA)

In Gartner’s Words, IGA or Identity Governance and Administration refers to managing “Access rights for Individuals, Roles, Groups, and identity repositories within organizations, both on-premises and in the cloud. Ensuring appropriate access to resources across highly connected IT environments.”

For an IGA platform, it is necessary to have a broad array of capabilities in order to meet the needs of the ever-growing complexities of modern organizations and IT Systems, these features that complete an IGA Suite are: Identity life cycle management, Entitlement management, Support for access requests; Workflow orchestration; Access certification Provisioning via automated connectors and service tickets; Analytics and reporting.

In 2020, Gartner chose to retire it’s incredibly viral Magic Quadrant for IGA. This was because the Magic Quadrant is designed to capture the most significant innovations in a particular market, but since IGA has already had it’s exponential growth phase, and has reached a state of maturity, it has made measuring improvements much more, but that doesn’t mean that growth has stopped. With the shifting of existing work models in the post-COVID world, IGA has seen growth and expansion to previously unimaginable heights.

IGA today has expanded and adapted to manage increasingly complex Identities spanning across different cloud platforms to provision access and entitlement of the vast repertoire of applications that modern enterprises use today in their ever-expanding workflows.

You can learn more about how EmpowerID competes in these ever-expanding domains in this all-new 2022 Leadership Compass Report by Kuppinger Cole, which examines the market for solutions that increase security in business application environments for managing cloud entitlements—measuring the growth of IGA and Access Management platforms beyond the traditional limit of imagination, taking a much more abstract and out-of-the-box approach to evaluate the needs of modern enterprises.

Check it out in the link below.

 

Munich, Germany & Online – September 13-16, 2021 – EmpowerID, a proven leader in helping organizations get identity and access management (IAM) right, with its global partner Avanade, are happy to announce that their long-standing customer, Siemens, a German multinational conglomerate and the largest industrial manufacturing company in Europe, was recognized by industry-leading analyst firm, KuppingerCole, as the winner in the "IAM at Scale" category at this year's European Identity and Cloud Conference (EIC).

Siemens received the prestigious award for using the EmpowerID platform to manage one of the world's largest Azure AD installations. The client managed to protect vital assets while keeping the business running, which dramatically reduced IT response time and provided a vastly improved user experience for about 300,000 users.

EmpowerID automatically inventories, monitors, and automates the management of the following in the Siemens' environment:

• 3,000 Azure license requests per month
• 30,000,000 automated Azure License Service Assignments
• 2,000,000 accounts, including AD and Azure AD
• 2,000,000 Groups, including AD and Azure AD
• 50,000,000 Group memberships
• 900,000 Nested Group Memberships

The EmpowerID architecture and solution delivery always anticipate the growth and size of its customers, delivering a global solution for Siemens that simplified managing identities for hundreds of thousands of users and millions of accounts further.

EmpowerID's powerful policy engine automates the assignment of the appropriate M365 licenses to users joining the Siemens organization based upon their roles and attributes coming from authoritative upstream systems. This automation ensures that users are licensed appropriately and can be productive from Day One. The ongoing lifecycle management functionality monitors for user position changes and readjusts the user's license to the most appropriate at all times to meet their job requirements. Most importantly, EmpowerID will reclaim the license to optimize the license expenditure when a user leaves the organization. To enhance governance and enable 24/7 self-service, the EmpowerID IT Shop allows users to request optional licenses for which they are eligible. These requests can then be routed to the appropriate individuals for approval.

To deliver greater security and convenience to its users, Siemens is also rolling out Azure application onboarding using EmpowerID's user-friendly IT Shop interface. A Zero Trust approach empowers application owners to onboard applications in Azure without having direct access to the Azure portal or being granted high-risk privileged access. As a result, security at Siemens is considerably improved by having a reduced attack surface for their Azure infrastructure, all combined with a superior user experience.

About Siemens

Siemens AG (Berlin and Munich) is a technology company focused on industry, infrastructure, transport, and healthcare. From more resource-efficient factories, resilient supply chains, and smarter buildings and grids, to cleaner and more comfortable transportation as well as advanced healthcare, the company creates technology with the purpose of adding real value for customers. By combining the real and the digital worlds, Siemens empowers its customers to transform their industries and markets, helping them to transform every day for billions of people. Siemens also owns a majority stake in the publicly listed company Siemens Healthineers, a globally leading medical technology provider shaping the future of healthcare. In addition, Siemens holds a minority stake in Siemens Energy, a global leader in the transmission and generation of electrical power.

In fiscal 2021, which ended on September 30, 2021, the Siemens Group generated revenue of €62.3 billion and net income of €6.7 billion. As of September 30, 2021, the company had around 303,000 employees worldwide. Further information is available on the Internet at www.siemens.com.

About EmpowerID

EmpowerID is the award-winning all-in-one Identity Management and Cloud Security platform designed for people. With over two decades in the industry, EmpowerID today manages millions of identities for large enterprises from all verticals across the globe. The platform is deployable on-premise and in the Cloud and offers comprehensive provisioning, single sign-on, access governance, the deepest integration capabilities with on-premise and Cloud systems, including ServiceNow, Azure AD, and SAP, on the market, and all of this coupled with an industry-leading user experience that drives adoption.

Built on a single microservice identity fabric architecture for manageability and scalability, EmpowerID ships with a powerful API, a visual workflow designer, and over 1,000 ready-to-use workflows for rapid deployment. For more information, visit http://www.empowerid.com.

 

Do you have any questions? Reach out to Alexandre Spoerri

Alexandre Spoerri
Sales Director
Alexandre.Spoerri@empowerID.com
+1 614 956 9008
Or feel free to book a slot to chat: https://calendly.com/alexandre-spoerri

 

North America

T 877 996 4276 or +1 (614) 652-6825
E info@empowerID.com

Europe

T +49 69 667741 – 157 or +41 44 585 10 82
E Info_D@empowerID.com or Info_CH@empowerID.com