The shift from on-premise data centers to the cloud has fundamentally redrawn the security perimeter. The reliance on network-centric defense has been disrupted, forcing security practitioners to mature their approach to Identity and Access Management (IAM). IAM, once a “boring area” focused on compliance hygiene, is now the critical choke point for controlling access and preventing massive exposures in hyperscale cloud environments.
We spoke with Chad Lorenc, Security Practice Manager at AWS Professional Services, about why IAM is the new edge, how to translate technical goals like “least privilege” into compelling business objectives, and the path to achieving a truly “no humans in production” environment.
You can read the complete transcript of the epiosde here >
Why is IAM the New Edge in Cloud Security?
For decades, security professionals relied on a thick perimeter of controls on the network edge. This involved a gigantic stack of firewalls, IPS, web proxies, and URL filtering to create logical choke points where all traffic could be inspected.
The Cloud Disruption
- Network Controls Disappear: When organizations shift to the cloud, many of those network controls disappear or become less relevant. The networking happens “underneath the hood,” and logical choke points are difficult to implement.
- Shifted Burden: The burden of controls shifts from being network-centric to being IAM-centric.
- Increased Consequence: IAM mistakes made on-premise (e.g., an exposed database or open file share) translated into catastrophic failures in the cloud because an exposed resource is often accessible to the entire world instead of just the entire organization.
This reality has forced security to make the mental transition: “my network provides some insights and inspection points, but my IAM is actually my edge”. Just as practitioners used to walk firewall rules, they now must walk IAM rules to understand exposures and how attackers can pivot across IAM controls.
Why is IAM Still Not Solved, and What is the Emerging Threat?
Despite being an early cloud service, IAM is a focus area for CISOs because the exposure consequences are greater and attackers are becoming more sophisticated.
- Insider Trading Example: Chad shared an on-premise example where a beautiful, least-privilege-configured SOX-compliant application was compromised by an exposed database that was pulling highly confidential financial documents from an open file share. These on-prem weaknesses burn organizations when moved to the cloud.
- Sophisticated Attacks: The industry is moving beyond simple exposures (e.g., “oops, I let everybody into my bucket”) to more sophisticated attacks on the IAM infrastructure itself. Attackers are seeking the weakest permission (e.g., exposed permissions in a directory or single sign-on provider) and then pivoting through the permissions model.
IAM spending is expected to be the number one spending item for CISOs in the coming year, driving the need for a detection service around IAM.
How Can Leaders Sell “Least Privilege” to the Business?
“Least privilege” is the Achilles heel of IAM strategy. It is an expensive goal that has no direct business value or outcome, making it sound like “flush your money down a black hole” when pitched to management.
Leaders must translate the goal into high-value business outcomes:
Drive Down Audit Costs
- Strategy: Tie IAM strategy to audit programs to save time, money, and energy on labor-intensive, high-expertise audit processes.
- Positioning: Auditability is a key goal of least privilege
Drive Business Innovation
- Strategy: Pitch the ability to onboard developers instantaneously (instead of two weeks). This is key to driving innovation and achieving business outcomes faster.
- Positioning: Productivity and speed for CIOs and CTOs.
Drive Down Risk
- Strategy: Tie IAM strategies to threat detection and incident response metrics (TDIR), such as mean time to detection (MTTD) and mean time to remediation (MTTR).
- Positioning: Risk mitigation for the CISO.
To secure continuous investment, leaders must first baseline the current metrics and pain points before deploying a new tool. They can then track progress against these North Stars (e.g., “before the tool: two weeks to onboard a developer; after the tool: instantaneous”).
How Can Organizations Achieve “No Humans in Production”?
Achieving the golden rule of “no humans in production cloud accounts” requires high maturity and is at the top of the security ladder.
Prerequisites for Success
- Automated Deployment (Pipelines): You must figure out how to deploy without “click ops” by using a fully managed Infrastructure as Code (IaC) pipeline. Pipelines are the automated, expedited version of change management.
- Full Development Life Cycle (Mindset Shift): You must have the mindset shift to cost-justify and implement the full development life cycle (sandbox, test, dev, UAT, production). In the cloud, this is easy to cost-justify because you only pay for what you use, avoiding the tech debt and sunk costs that prohibited this on-premise.
- Governance: You need the governance (people, process, technology) around to drive discipline.
The UAT Discipline
The breakthrough comes when an organization builds out the discipline in the User Acceptance Testing (UAT) environment and forces a no humans policy there first. This process builds the necessary muscle before rolling the no-human policy into the production environment.
- Instantaneous Detection: When there are no humans in the account, detection is instantaneous. Anytime a human pivots, it becomes an incident to investigate (or a documented break-glass exception). This catches sophisticated, outside-of-control compromises immediately.
What are the Top IAM and Cloud Hygiene Practices?
IAM Checklist
- Do not use root users (huge risk mitigation for little effort).
- MFA everything you can.
- Enable Single Sign-On (SSO) for centralized de-provisioning.
- Use Organizational Structures (AWS Organizations) to put broader IAM guardrails and simple, easy boundaries in place.
- Start breaking out accounts early (avoiding costly IAM nightmares in single, fast-growing accounts).
Cloud Hygiene
- Post-Migration Operationalization: Quickly transition from the Cloud Center of Excellence (CCoE) to operationalizing security (logging, incident response) as part of your mainstream Security Operations Center (SOC).
- Cloud Posture Management: Use a tool (like AWS Security Hub) to check posture against standards (CIS, AWS Foundational Best Practices). This is a new vulnerability management component that doesn’t exist on-site.
- Visibility & TDIR: Collect logs into the SOC, use tools like GuardDuty for IDS/IPS visibility, and integrate with TDIR/forensics teams.
- Automation: Use Golden Image Automation to automatically scan, update, and roll out new machine images, simplifying vulnerability management.
- Reference Models: Use architecture and governance models like the Security Reference Architecture (SRA) and the Cloud Foundations model.
What is the Next Complex Area of Cloud Security?
The next major wave for security will be driven by data gravity and the need to govern it.
- Privacy: Organizations will need to truly learn and understand privacy models. AWS’s privacy team, for instance, released a Privacy Reference Architecture to overlay the Security Reference Architecture.
- Data Sovereignty and Governance: As large amounts of data move to the cloud (data gravity), security must figure out how to honor data governance, data sovereignty, and compliance laws that require specific data to stay in specific locations.
Rating Security Practices: Architecture and Hygiene
- Lock computers when you leave your desk
- Rating: 2/5
- Rationale: This is good security hygiene, but on its own, it’s a false sense of security and is not a significant control unless layered with MFA and disk encryption. A physical theft (or finding a password sticky note) renders the lock meaningless.
- DevOps practices needed; Security is not the most important right now
- Rating: 1/5
- Rationale: Retrofitting security is always a compromise and is never as secure as building it in from scratch. This creates multiple-year roadmaps for rework and an ongoing exposure for the business. Investing in developer security training early on leads to better outcomes and is more effective than bolting on WAFs later.
- Continuous Integration is a must; Security architecture review should be part of the integration
- Rating: 3/5
- Rationale: CI is a must, but security practitioners must be careful not to break the pipeline by pushing reviews back and forth. Security should apply the 80/20 rule: automate 80% of security checks dynamically and address the final 20% in later testing stages, rather than slowing down the true continuous integration process.
Conclusion: The Path to Security Maturity
Chad Lorenc’s experience highlights that the path to security maturity is defined by acknowledging the IAM-centric nature of the cloud and translating technical goals into business value (audit cost reduction, speed of innovation). The ultimate objective is achieving no humans in production, a state that requires foundational discipline, fully automated IaC pipelines, and a complete shift from a network-centric past. By operationalizing cloud security through posture management and integrating data into the SOC, organizations can finally scale their security with the growth of their business.
