2021 State ofCloud Permissions
Risks ReportState of Cloud Permissions Risks Report

03 /Executive Introduction

04 /Closing the Permissions Gap with Cloud
Infrastructure Entitlements Management (CIEM)

05 /Risk Findings Across Cloud Infrastructures

06 /Unique Key Findings

09 /Recommendations for Multi-Cloud
Permissions Management

10 /Executive Conclusion

2

State of Cloud Permissions Risks Report

Executive Introduction

The permissions gap is a contributing factor
to the rise of both accidental and malicious
insider threats, which can allow attackers
to exploit an identity with misconfigured
permissions and access critical cloudinfrastructure. This gap can be reduced
through implementing least privilege
access policies and working towards a
Zero Trust security model, thus protecting
cloud environments. However, this is nearly
impossible to do manually and at cloud scale.

As organizations modernize IT and adopt
multi-cloud infrastructures to support
evolving business processes involving
user and workload identities (e.g., virtualmachines, web apps, containers, scripts, etc.),
it’s increasingly difficult to know who hasaccess to what data across which platforms.
This lack of visibility leads to excessive
permissions and higher security risks
exposing identities and resources.

Today, over 40,000 permissions can be
granted to identities across the key cloudinfrastructure platforms and nearly 50% of
these permissions can be classified as highrisk, meaning they can cause catastrophic
security and business damage - service
disruption, service degradation or data
exfiltration - if used improperly.

Regardless of where an organization is in
their cloud migration process, it’s important
to implement robust cloud infrastructure
security. Without it, their cloud environmentis left vulnerable to attacks and accidents.
Microsoft collected data from risk
assessments performed with over 150
organizations worldwide and discoveredthat more than 90% of identities are using
less than 5% of permissions granted. Thisgap between permissions granted and thoseused is what we call the permissions gap.

In this report, we share detailed
findings about the most common cloudpermissions risks we observed and share
recommendations to ensure least privilege
access and achieve Zero Trust security acrossyour entire digital estate.

Cloud Infrastructure Security Trends

7x Growth of identities
accessing cloud services

95% of permissions are unused
But20K+ High-riskpermissions

387% want Zero Trust Compliance

However, organizations
need to first fix thepermissions gap to achieve
Zero Trust ComplianceState of Cloud Permissions Risks Report

Closing the Permissions
Gap with Cloud
Infrastructure Entitlements
Management
The principle of least privilege access is
nothing new – it’s one of the foundational
concepts of Zero Trust:• Never trust, always verify• Assume breach• Enforce least privilege accessHowever, with the rising complexity ofmulti-cloud environments, it has becomeincreasingly difficult to implement leastprivilege access consistently across clouds.
Without it, organizations are left susceptible
to severe consequences.
In the past, organizations had fewer
identities to manage, typically only including
employees, partners, or customers. As theworld has become increasingly more digital,
these identities have expanded to include
developers, third-party contractors, a hostof workload identities like web apps, virtual
machines, containers, or scripts, and a varietyof compute types like EC2 instances andserverless functions. These workload identities
can have the same high-risk permissions andaccess to sensitive resources that users do.

In order to lay out a framework fororganizations to approach identity, accessand permissions management in theirmulti-cloud environments, Gartner recently
created the category Cloud Infrastructure
Entitlement Management (CIEM). CIEM isa next-generation solution for managing
permissions consistently across all cloudinfrastructures and ensuring least privilege
access for all identities and resources,
helping to reduce the permissions gap
and getting one step closer to a Zero Trust
security framework.

4State of Cloud Permissions Risks Report

Key Risk Findings Across Cloud Infrastructures
Some of the risks contributing to the permissions gap span across the three main
cloud providers— Microsoft Azure, Amazon Web Services (AWS), and Google Cloud
Platform (GCP)—while others are unique to each provider.
The most common risks we found in all three main cloud providers include:
High-risk permissions

Implication:

Best practice:

are continuing to

Excessively permissioned

Right-size permissions

rise, with more thanactive identities arebased on the past activities

90% of identities

exposed to credentialof these identities and grantusing less than 5% oftheft risks

additional permissions on
an on-demand basis

permissions granted

Cross-accountImplication:

Best practice:access is

Cross-account access enables

Right-size scope of roles/

frequently

identities to access all resources

policies to access limited

granted toin target accounts, leading

resources and limit access toexternal identities

to data leakage or malicious

specific identities inservice disruption

other accounts

Lack of separation

Implication:

Best practice:of duties: Users with

Leveraging the same roles/policies

Right-size permissions inexcessive roles/policies

and permissions in development anddevelopment environments andin both development

production environments exposesclone permissions into production

and production

your infrastructure to insider threats

only as a starting point, then right-

subscriptions/accounts

and malicious external threats

size permissions to tighten controls

Workload

Implication:

Best practice:identities are over-Inactive identities leave

Remove inactive roles/

permissioned andorganizations open to credential

policies and identities togreater than 40% of

misuse or exploitation foravoid unauthorized accessthem are inactive

malicious activities

to resources5

State of Cloud Permissions Risks Report

Unique Key Findings:
Two thirds of all

Implication:

Best practice:organizations have

Attackers can leverage

Restrict broad access

EC2 instances withcompromised EC2 instances

to all resources foraccess to all S3 buckets

to access sensitive data storesapplications on EC2

leading to data breaches

instances

More than 50% ofImplication:

Best practice:enterprises haveIdentities with hidden

Regularly review all

identities withprivilege escalation

identity policies for any

privilege escalation

ability can self-elevate toprivilege escalation

ability to elevate toadmin privileges and gain

possibilities

super admin role

unauthorized access

Misconfigured

Implication:

Best practice:

security groups withOpen security groups

No security groups should

inbound Secure Shell

allow network-based

allow unrestricted ingress(SSH) port open

attacks to gain access toaccess to any ports

and attached to EC2EC2 instances

instances

Admins typically don’t

Implication:

Best practice:

have Multi-factor

Admins without MFA enabled

Enable MFA for all users

Authentication (MFA)

login or non-rotated accesswith console access andenabled and accesskeys increase the risk ofrotate access keys every

keys not rotated for atcompromised credentials

90 daysleast 6 months

6

State of Cloud Permissions Risks Report

Unique Key Findings:
65% of enterprises

Implication:

Best practice:

have anonymous public

Confidential data in

Provide controlled just-in-read access enabledpublic storage accounts

time access to blob containers

for blob containers

is exposed to anonymous

to prevent anonymous/in production

unauthorized identities

unauthorized access

Users assign

Implication:

Best practice:permissions andUnknown permissions

Allow access through approval-

access outside ofassignments create a significant

based permissions on-demand

security and audit

blind spot and unwanted risks

to track for identity governanceprocesses

for the organizationand compliance

Remote Desktop Protocol

Implication:

Best practice:(RDP), SSH access from

Attackers can use various

Disable RDP/SSH access on

the internet is enabledbrute force techniques

network security groups

for network security

to gain access to Azure

from the internet

groups in production

virtual machinesenvironments

environments

More than 70% ofImplication:

Best practice:subscriptions haveIdentities with contributor

Replace high-riskidentities (users androles significantly increase risks

contributor roles withworkloads) with

due to their ability to delete

lower-risk right-sized roles

over-permissive

business-critical resources

based on past activities

More than 85% of

Implication:

Best practice:organizations have

Inactive identities leave

Remove all inactive users andover-permissive usersorganizations open to credential

service principals automaticallyand service principals

misuse or exploitation for

to avoid unauthorized accessleft orphaned after

malicious activitiesto resources

contributor roles

project completion

7

State of Cloud Permissions Risks Report

Unique Key Findings:
More than 80% of

Implication:

Best practice:projects have Service

Service accounts with

Replace high-risk

accounts with over-

Owner/Editor permissions

owner/editor roles withpermissive Owner/significantly increase

lower risk roles based on

Editor roles either

security risk due to theirpast activities and right-

directly attached orability to delete business-size all service accounts

inherited from folder or

critical resources

organization

More than 85% of

Implication:

Best practice:organizations have

Rotating service account keys

Service account keys shoulduser-managed keys

reduces malicious usage risks

be rotated every 90 days

for service accountsof access keys associatedto ensure data can’t bethat are not rotatedwith a compromised oraccessed with old keys thatterminated accountmay be compromised

More than 50% ofImplication:

Best practice:organizations have

Project-wide SSH keys can be used

Use instance specific SSH

project wide SSH Keys

to login into all the instances withinkeys that limit the attack

enabled for virtuala project. When compromised,surface in the case the SSH

machine instances

they pose significant security risks

keys are compromisedthat can impact all the instances

More thanImplication:

Best practice:

75% ofIdentities with high-risk

Persistently monitor theorganizations

permissions expand thePermissions Creep Index, a metrichave identity

attack surface due to theirthat is the function of the number

permissions

ability to delete business-of unused high-risk permissions

creep ranging

critical resources

and the total number of resourcesfrom Viewer toOwner

that an identity can access, for allidentities and right-size permissions
to maintain security posture8

State of Cloud Permissions Risks Report

Recommendations for Multi-Cloud
Permissions Management•

Remove or scope down permissions automatically for overpermissioned users, workloads, and groups verify

Right-size permissions
based on past activity•

Grant high-risk permissions only on-demand with just-in-time accessusing an integrated approval workflow•

Restrict broad access to critical cloud infrastructure resources•

Remove inactive identities to avoid unauthorized access to resources•

Migrate from static, assumption-based permission grant process tocontinuous, activity-based permission management

Assess, manage, andmonitor identities andaccess continuously•

Monitor, receive alerts, and remediate anomalous identity behavior,
unauthorized identities, and roles/policies•

Monitor, receive alerts, and remediate permissions for privilege
escalation scenarios and inactive identitiesRemove inactive identities
to avoid unauthorized access to resources•

Implement
automated
continuous identity
governance andreporting

NIST 800-53, CIS Benchmarks, and AWS Well-Architected reporting
and built-in remediation to drive toward better compliance•

Restrict inbound access to virtual machines by removing inbound
SSH/RDP access in security groups•

Enable Multi-Factor Authentication for all identities withconsole access•

Rotate keys regularly to reduce risk due to compromised credentials•

Automate and schedule custom risk reports across all accounts

9State of Cloud Permissions Risks Report

Executive Conclusion
These key findings highlight areas whereorganizations should increase theircloud infrastructure security throughimplementing least privilege accesspolicies. Left unmanaged, the permissions
gap can leave organizations vulnerable toattacks that can lead to catastrophic losses.
Key recommendations:• Assess your permissions risks and identify
which identity has been doing what,
where, and when
• Grant permissions on-demand for atime-limited period or an as-neededbasis to ensure least privilege access• Continuously monitor permissions usage
across clouds

10

About CloudKnox
Permissions Management
CloudKnox Permissions Management
is a cloud infrastructure entitlement
management (CIEM) solution that provides
complete visibility into permissions for all
identities (user and workload) across allmajor public cloud platforms (AWS, Azure,GCP) from a unified interface. It helps
organizations understand what permissions
identities have and what resources
they’re accessing. CloudKnox Permissions
Management automatically detects whichpermissions are unused and pose risks andallows Security and Identity teams to rightsize permissions in just a few clicks. Thanks tohigh-precision ML-based anomaly detection
capabilities, CloudKnox Permissions
Management streamlines threat detection
and response and allows organizations tomaintain a strong security posture.

Try CloudKnox Permissions Management nowCloudKnox Permissions Management is now available for Public
Preview! If you have any questions or are interested in joining Public
Preview, please fill out the form at aka.ms/CloudKnoxPublicPreview.
For more information about CloudKnox Permissions Management,
visit aka.ms/CloudKnox.

©2021 Microsoft Corporation. All rights reserved. This document is provided“as-is.” Information and views expressed in this document, including URL and otherInternet website references, may change without notice. You bear the risk of using
it. This document does not provide you with any legal rights to any intellectual
property in any Microsoft product. You may copy and use this document for yourinternal, reference purposes.