The Importance of IGA and CIEM in Securing and Governing Identities

Identity Governance and Administration (IGA) tools track and control user access in on-prem and cloud-based systems. Cloud Identity Entitlement Management (CIEM) solutions provide fine-grained, multicloud visibility and dynamic context for identity governance in the cloud. 

Continue reading below or download the solution brief here.

The Role and Scope of IGA 

IGA tools are front and center in IT operations, integrating with identity providers and HR systems to secure and be the authoritative source for digital identities for users, applications and data. IGA tooling gives visibility and context into the enterprise workforce, onsite and remote, ensuring that every user has the right access to do their job. IGA use cases include identity lifecycle (joiner, mover, leaver) management, broad entitlements visibility, and access requests and certification.  

Why CIEM If You Have IGA?

According to Gartner, Inc., IGA tools cannot easily cover issues related to multicloud identity and entitlement management – CIEM capabilities serve to fill this gap. While highly effective in broadly governing access for human users, IGA tools lack visibility, granularity and context for securing access to cloud infrastructure. As a result, IGA tools cannot detect, for example, unused permissions, privilege escalation or toxic scenarios - risks that can create cloud security breaches. More significantly, IGA tools do not track machine identities, which Microsoft and others estimate outnumber human identities in cloud infrastructure tenfold. IGA tools are therefore not covering a huge part of the identity piece.

With cloud use focused on agility and enabling developers, cloud entitlements are almost always overprovisioned. Only continuous analysis of all identities, permissions, resources and other correlating factors gives a full view into cloud access rights and risk. CIEM solutions provide such analysis, detecting and prioritizing entitlement risk. Importantly, they use this fine-grained insight to generate optimized permissions configurations  that mitigate risk and enforce least privilege. 

Together, CIEM and IGA are essential, complementary solutions for controlling identity risk and compliance in the cloud. 

What Use Cases Do CIEM Solutions Cover? 

CIEM covers identity risk use cases complementary to IGA tools including:

• Identity governance for cloud infrastructure
• Visibility into all cloud entitlements and access paths
• Standards compliance and audit reports for cloud entitlements
• Auto-assessment of your compliance posture against industry frameworks including CIS, AWS Well Architected, GDPR, HIPAA, ISO, NIST, PCI, SOC2 and more, and  custom policies
• Toxic combinations such as public exposed machines with high cloud privileges 
• Anomalous activity by human and service identities
• Automated least-privilege recommendations for cloud entitlements
• Ongoing risk analysis of access-related changes 

IGA platforms serve to manage organization-wide IGA processes. CIEM is a necessity for expanding your identity governance processes to cloud infrastructure — and enforcing your organization’s identity management compliance in the public cloud. 

What Ermetic CIEM Can Do for You

Ermetic, a leader in CIEM, provides fine-grained, correlated analysis of identity risk in the cloud, offering insights that enable fast action: 

• Deep visibility: Visualize all identities (including federated and 3rd party), resources, entitlements and configurations in your single cloud or multicloud environment
• Cloud identity governance: Govern entitlements, automate right-sized IAM policies and drive least privilege including via Just in Time JIT) access management
• Fix what matters most: Use accurate prioritization to focus on permission and IAM policy risks of greatest impact including toxic combinations exposing sensitive data
• Communicate easily with developers and devops: Provide specific, accurate mitgation recommendations integrated in existing tools (built-in, API, Webhooks, Terraform,...)
• Anomaly detection: Leverage continuous behavioral analysis to easily map out and investigate anomalous activity

• Audit compliance - Simplify compliance and reporting with an identity-first cloud native application protection platform scanning configurations and resources across clouds 

Tough Cloud Questions You Can Answer with Ermetic

Many identity tools can help show user access without answering why - such as why do they have access and does the access violate your IGA rules? In the cloud, for compliance and other needs, you must be able to answer critical questions about what identities can access and why. If you are trying to tackle cloud IAM using cloud-provider or in-house developed tools, ask yourself if you can answer these questions.

Using Ermetic, you can answer these and many other questions:

• Who has access or permissions to my critical cloud assets?
• Which identities have permissions allowing them to escalate their privileges?
• Which identities did not use their permissions in a given timeframe (e.g. 90, 180 days)?  
• Which actions did a given identity perform during a specific period?
• Which permissions can be safely revoked without affecting existing business operations?
• Which identities have risky or destructive permissions? 
• Are there any segregation of duties failures (for example, dev-prod, us-eu, administration-customer data)?
• Which federated identities have access to certain sensitive resources?

The Ermetic Platform

Ermetic offers leading CIEM and much more. It reveals, and prioritizes security gaps in AWS, Azure and GCP and helps organizations remediate them immediately. It unifies and automates full asset discovery, deep risk analysis, runtime threat detection and compliance, and empowers stakeholders with pinpoint visualization, guided recommendations and collaboration. Ermetic is an identity-first, cloud native application protection platform (CNAPP) spanning cloud security posture management (CSPM), cloud infrastructure entitlement management (CIEM), cloud workload protection (CWP), Kubernetes security posture management (KSPM) and infrastructure as code (IaC) security.

Download the solution brief here.