Article Per Year (5 Year)
p-Index From 2021 - 2026
0.23
P-Index
This Author published in this journals
All Journal The Eastasouth Journal of Information System and Computer Science
Kedar Pradhan
Solutions Architect, Amazon Web Services, Austin, USA
Computer Science & IT

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

 1 
Policy-Evolving IAM Architecture for Just-in-Time Privilege Control in Multi-Account Cloud Enterprises Kedar Pradhan
The Eastasouth Journal of Information System and Computer Science Vol. 2 No. 02 (2024): The Eastasouth Journal of Information System and Computer Science (ESISCS)
Publisher : Eastasouth Institute

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.58812/esiscs.v2i02.1303

Abstract

Multi-account cloud enterprises spread workloads across multiple accounts, each of which is managed separately, but privileged access is often given to users within these accounts as default and is built up over time increasing the attack surface. This systematic review combines 23 studies and standards into a policy-evolving identity and access management (IAM) architecture for the following: risk-based access control, formal policy verification, identity federation, just-in-time (JIT) elevation, role and attribute mining, multi-tenancy authorization, and zero trust architecture. The proposed design is to perform risk-scoring on each elevation request, validate it with a trust-safety property using satisfiability modulo theories (SMT) reasoning and issue a per-session credential that only lasts long enough for a specific session; and record the credential in a log for log-driven policy mining, followed by regression tests to test the candidates before promotion. A formal check of the results shows that the tests are sufficiently quick to be used in an inline mode, with 99% of the production policy questions answered within 160 milliseconds; in addition, the tests are able to handle a task that the other algorithms were not able to handle within 24 hours, while the attribute based miners scored an area under the curve of 0.9973, compared to 0.9269 for the role based miners. The use of a modeled scenario further suggests that four two-hour JIT sessions a week provide 95.3% less privilege exposure than standing access, over the course of the year. Approval fatigue, proportionality monitoring, scalability of mining, and continuity of break glass are mentioned as the major challenges to adoption.
Co-Authors