Arkansas Blue Cross Blue Shield

Devin Shirley

Access Governance Champion

Bio: Devin has a 28-year career in information technology, security, and leadership. After graduating from the United States Military Academy in 1996, he served five years in the U.S. Army, where he was responsible for implementing and maintaining information security and technology capabilities and assets. While in service, Devin earned a Master of Science degree in Telecommunications Management from Oklahoma State University. Since leaving the Army, he has worked in numerous technical leadership roles in various industries, including semiconductor healthcare and telecommunications. He has been in his current role at Arkansas Blue Cross Blue Shield as the Chief Security Officer for eight years and is responsible for cyber and physical security. In his spare time, Devin trains in and teaches Krav Maga, an Israeli self-defense system in which he currently holds the rank of third-degree black belt. He is also the author of Krav Maga: Principles and Techniques.

Identity and access management (IAM) has been a major component of security defense-in-depth strategies for years. Over time, the early methods have proven unreliable as malicious actors’ capabilities evolved, forcing organizations to change processes and increase capabilities. Compromised credentials remain a primary threat vector as multiple industries have seen an increase in access-related attacks such as credential stuffing and brute force attacks. To aid organizations in their efforts to prevent these attacks and reduce their impact, frameworks like Zero Trust and capabilities such as multi-factor authentication (MFA) have emerged. And with regulatory requirements quickly adapting, understanding basic IAM concepts and relaying them to others in the organization can be difficult. What I would like to present in this article is a simple way of thinking security teams can use to build their IAM program and communicate the strategic roadmap to those outside the security organization. The model consists of three main components: Identity Governance, Access Management, and Privileged Access Management.

Identity Governance

In this component, we establish governance over the IAM program as we do with other programs, but more specifically, we need to govern how user identities and accounts are managed and the processes used to continually validate access. The first element we need to consider is account lifecycle management, which includes the provisioning or creation of an account and maintaining and terminating it. This includes developing the roles and entitlements for users and establishing the workflow and processes used to assign them to accounts. Different approaches exist to accomplish this, such as basing the entitlements on the specific role of a user within the organization or their attributes or characteristics. The role-based or attribute-based entitlements, once assigned, can then be enforced via policies in the access control mechanism.

“We need to understand that newer technologies and increasing regulatory requirements may require a more in-depth review and implementation of the IAM program.”

Access certification is another key element of identity governance, providing a mechanism by which security teams can perform validation that users have the appropriate access to resources. This is crucial to protect against granting of too much access to individuals or groups within the organization and to ensure the principle of least privilege remains enforced. While this can be accomplished through various technologies and capabilities, the continual audit mechanism helps to ensure IAM policies and controls remain effective.

Access Management

The second component is access management, where we typically find the elements associated with access controls. User authentication, for example, validates a user’s identity to ensure they are who they claim to be via the use of supplied credentials from the user and the capability to evaluate those credentials. Another element found in the access management component is authorization, which means looking at the authenticated user and validating they have the appropriate rights to perform functions based on their entitlements. Here is where we leverage the role-based and attribute-based entitlements established in the Identity Governance layer and apply them against access policies in the authorization process.

Privileged Access Management

This third component considers elevated access privileges and the processes and capabilities that enable them. In this component, we identify anyone requiring privileged access to systems and establish a method to ensure appropriate granting and tracking of privileged accounts occur. Control measures include determining who can use privileged accounts and the entitlements provided to them. Additionally, we need to monitor the assignment of privileged accounts to track their usage and what asset it was used for. At this layer we can leverage a privileged access management (PAM) technical capability to implement the policies and controls around the use of these entitlements and provide visibility and alerting of activities performed by anyone leveraging the capabilities.

To summarize, there are three foundational elements that many IAM capabilities and processes can be built on: Identity Governance, Access Management, and Privileged Access Management. From these elements, we can evolve our IAM program as we continue to enhance the capabilities required to protect our users and environments. Admittedly, there are significantly more facets to IAM than what I have discussed, especially for complex environments. Additionally, we need to understand that newer technologies and increasing regulatory requirements may require a more in-depth review and implementation of the IAM program. While the IAM program will be more complex and consist of many layers and elements, this model provides a simple, organized perspective for those who may be early in their IAM journey or desire to communicate the IAM program and strategy to others in the organization. It can serve as the foundation, but the IAM journey, just like the security journey, is continuous and changing. Building a solid foundation will enable an organization to start on the right path.