Name: CIEM Crash Course
Uploaded: 2025-02-06T17:50:07.206Z
Duration: 23 min 12 s
Description: CIEM Crash Course

Transcript for "CIEM Crash Course": Let's see. Hello, everyone. Good morning, good afternoon, good evening from wherever you're joining us from. We will get started in just a second, so stay tuned. Alright, everyone. Hello. Again, good morning, good afternoon, good evening. I know we have a pretty international audience joining us today. We will get started here in just a minute or two whilst the float folks, oh, folks, flow in. In the meantime, let us know where you're joining us from. If it's lunchtime, you got your coffee, afterward beer, we're happy to have you here. Is there snow in Houston right now? I know the whole world the whole US. I'm in Seattle, and we have, like, a weird amount of snow, and no one knows what to do with it here. New York definitely has snow. It's gotta be cold there. I said I used to say I have a I have a husky who is a broken husky because he doesn't know what to do in the snow in Seattle. It's like he'd never seen it before. Alright. Let's give folks one more minute. No snow yet in Virginia. Oh, that's surprising. Hopefully, India does not have snow. I don't know that. Germany should be Germany, you guys should be on top of it there. You're probably frolicking in your socks and sandals. Oh, okay. See, your husky is not broken. Your husky knows how to do snow. Alright. Well, let's get started here. Hello, everyone, and welcome to today's fifteen minute live cloud infrastructure entitlement management crash course with Wiz. My name is Laura. I'm part of the marketing team here at Wiz. We are so excited to have you join us today, and we appreciate you taking time from your busy schedule. Today's webinar is being recorded, and you'll get the on demand recording in your inbox probably tomorrow morning, definitely by the end of the week. If you are interested in learning any more about Wiz mentioned in the chat, we'll connect you with a wizard after the event. There are a couple of ways you could engage with us during today's webinar. If you have any questions, you can type them into the chat or q and a on the right side of your screen. We also have some related docs and resources in this section labeled docs. Check out those links to learn more about Kim, Wiz, and to sign up for the next segment of this demo series all about data security posture management, otherwise known as DSPM. With that, housekeeping is over, and we're gonna keep this short and sweet. I wanna introduce our presenters today. Shaqed is a product marketing manager here at Wiz, and Yariv is a product mark product manager. And I'm going to let them take it away. Hello, everyone. Thank you for joining us for this webinar. And today, we're going to talk about Kyme, cloud infrastructure entitlements management management. And we'll start off with a few slides talking about with Kyme's capabilities, and then we'll do a live live demo where we'll have Yariv, our product manager for Kim, showing you what it looks like in the WIS portal. So let's get started. So let's start about securing identities in the cloud. So first of all, why is it so important to secure identities and entitlements? So identities pose one of the largest attack surface into cloud environments. So different identity risks like misconfigurations, excessive permissions can lead attackers to your cloud environment and can also lead to different lateral movement pops in the cloud as well as privilege escalation. So, of course, we want to protect our identities and make sure that we're removing identity risk and reducing our attack surface. So what are our goals when we look at protecting our identities in the cloud? Let's, like, take a look at them. So first things first, we want to make sure that we're removing immediate risk. So we want to focus on the most critical identity risk that pose the greatest kind of business risk to our environment. So here we want to answer what identities pose the most risk to my environment and what action do I need to take to drive the most impact. So essentially, how do I reduce my attack surface by removing identity risk and making sure that my environment stays protected. So once I focus on those kind of most critical risks and attack paths in my environment, Then I can move on to focusing on minimizing the attack surface and focusing more on the specific identity risk like making sure that I'm following least privilege, so removing excessive permissions, making sure I'm removing any unused permissions or, different misconfigurations like no MFA for my identities and users and so on. And then, once I remove the most critical risk and I minimize the attack surface specific to my identities, I need to make sure that I have continuous governance. So I want to understand what can my identities access in my cloud, and I want to be able to manage my identities whether they're human or nonhuman identities. So I want to understand exactly what are their permissions, so effective permissions in a cloud, and even in other SaaS solutions like Snowflake, for example. So let's take a look at examples of what it looks like in Wiz before we dive into the live demo. So the first step for removing immediate risk. So here, we want to focus on risk based prioritization. So with Wiz, what this is, it's is what we call Wiz issue. So we take all the information we find your find about your entitlements and identities and any risks related to them, and we correlate them to rest of, the cloud context that Wiz has, so cloud and workload context. So this allows us to understand how can an identity risk, lead to an attack path that could eventually lead your the an attacker, to example for to your crown jewels in your cloud. So like the example here, you see the WIS security graph. So here you can see that WIS found an admin service account that has excessive access, And not only that, but we've also correlated that information to, to the virtual machine that is attached to that role. We can see that there is vulnerability findings of that machine. We can see that the machine is exposed to the Internet, and it can access sensitive data. So here we found the very critical attack path that could some lead an attacker to a sensitive data, and these are the type of identity risk that we want to focus on first because they pose the greatest, risks to our environment. Next up, we also want to be able to understand cross platforms context. So whether it's different clouds or also understand how, secrets that exist in my code repositories could lead an attacker from my code repository to my cloud environment. So it's important to understand that cross platform paths as well. So let's talk about minimizing the attack surface. So now we want to focus on those identity specific risks and misconfigurations. So with Wiz, we do effective permissions analysis to help you understand exactly what your users can access in the cloud. And with that, we're able to, surface different findings and risks related to identity. So for example, users that have excessive access or admin users or users with high privileges as well as, different risk configurations that exist within your users and roles in your environment. Then you also want to be able to remove lateral movement paths. So, for example, like we can see here, someone could move laterally between your Azure between your code repositories to AWS environment to Azure environment using different secret keys that they find in the different, cloud providers or within the code repositories. So we want to make sure that we're minimizing the attack surface by identifying these attack these lateral movement paths and removing lateral movement paths to reduce blast radius. So next up for governance, within Wiz, you could see your cloud identity's inventory on the cloud identity's page where you'll see every single identity and understand, what it can access for roles and gain security insights specific to that identity to understand whether it's following security best practices. And you could see all these different security risks that are associated with that identity in this consolidated view. Last but not least, the cloud entitlements explorer makes it very easy for you to understand what a specific user can access in your cloud. So it allows you to query for a specific user and access type without having to know the exact I'm kind of terminology. You could just, for example, ask, which Okta users can access sensitive data in my cloud environment and then very easily gain that visibility without, again, having to, like, really know how to write that, using a specific, I'm query. So this provides you with that centralized visibility that allows you to see who can access what what very easily. And with that, now we'll see all of this in the WIS environment where we will show us a live demo. Awesome. Thank you, Shkad. So let me jump into the Wiz portal and give here an overview of of these capabilities within the portal. And I'll try and stick to the framework which Shaked pointed out of starting from risk, moving to reducing the attack surface, and lastly, the governance capabilities Wiz also provides. When it comes to removing risk, since there are so many identities in the Cloud, Wiz takes the same risk based approach in identities as well. That means that we create issues out of all the different detections which we detect. Wiz provides you one, an overview of all the identity related issues that you have, and it also provides you two different groupings which are important for identity teams. The first one, which issues do I actually see the most within my environment? The second one, which is the one I'm going to enter in a second, but is actually pointing out into which identities actually need the most attention since they have the most issues associated with them. That can actually help me choose a specific identity when I'm starting to remediate issues. For example, if I look into this EC2 Lambda full admin, I can see all the different issues associated with them. If I take an example issue, for example, here I'll look at a publicly exposed service account that allows access to sensitive data which should have a data perimeter. We get a breakdown of the subscription, the severity, the different projects, and risks associated with this issue. If I go into the attack path, we actually visualize for you, how can this attack path be exploited. We can see this from the Internet. All users can actually access this IAM role. We see the evidence of how exactly it is exposed through an IAM assume role policy, and we provide you the effective access of the Lambda function and which sensitive data exactly it contains. In this example, we can actually understand that we can restrict some of this publicly exposed IAM rule or we can deal with the sensitive data related to that. But both of them really important evidence to make sure we understand where should we get started in remediating this issue. This was about reducing the risk. What we recommend is actually working through the critical and high risks first before moving into restricting external exposure in identities. In this section, when we're talking about reducing the attack surface, Wiz provides here quite a few interesting insights. I want to start from these two. The first one, indicating unused admin permissions, and the second one, about authentication, whether it's MFA or access keys. When we're talking about unused admin permissions, Wiz provides you two different breakdowns. One, it would be if these admins are actually fully inactive, meaning they're laying in my environment but they're just not being used, whether they're users or whether they're service accounts. These two different breakdowns, which are really good and simpler position to get started with, when trying to reduce admin privileges. The second step, which I'm actually going to explore in a second, is about active users or groups, which are actually not using all of their admin permissions. So essentially providing us the ability to understand an active user who is not using his admin privileges. So something I can restrict from them. If I click on any of these clickable widgets, we get here the full breakdown of all the users and all the different findings associated with them. I'll open a specific finding just to give you a sense of how Wiz provides this information within the security graph. We see here an AWS excessive access for group JD EKS group. The group JDKS currently has the policy IAM full access attached, but it handles one unused service in a 80 unused permission. This policy can therefore be replaced by a custom policy. Skipping to the remediation part, we provide you the CLI steps in order to remove these excessive permissions. And of course, that at the end, we provide you actually the breakdown of what permissions is are currently assigned and which ones are actually being used. So in this example, we can restrict almost all of the permissions except one for this specific group, which would alleviate a lot of this attack surface when we're speaking in the the world of identity. Of course, this is all supported for Azure and GCP as well. The second part, which I want to show you, is about authentication, as we said, about MFA and access keys. And here again, Wiz provides you in the first two rows, admin principles without MFA and privilege principles without MFA. So when we start talking about enforcing MFA, these are the users we should get started with first. The second two are actually indicating about one, whether, a privileged principle may have an exposed key. So Wiz actually has detected a clear text key within the environment of a privileged principle, which again is part of my attack surface which I would like to reduce first. And lastly, about unrotated keys. Again, indicating if a privileged principle has a key which has not been rotated over ninety days. So Wiz would highlight you how many of these users there are, and by clicking on any of these, you'll actually get the full list of who exactly are these users and their keys. The last part, which I want to highlight for you when it comes to reducing the attack surface, is about our third party access insights. We provide here a breakdown of quite a few different directions to understand what is happening for when it comes to third parties within my environment. The first one is detecting inactive third party service accounts within the environment. Meaning that a certain third party actually has a role, but they're not use utilizing the access that I have granted them. Something that I should really restrict. Second one, overprivileged third parties. So, again, a certain third party could request a set of permissions, but only some of them are being used. So, again, this is something I would like to understand to make sure that I restrict them to only the permission this third party is utilizing in my environment. Thirdly, is giving you an overview of are there third parties who have high permissions within my environment. And lastly, can they access my sensitive data? So if certain PII, customer data, is within my environment and a third party can actually access it, really interesting and important to get that visibility when it comes to third party access. The Cloud Identities dashboards has a lot more information. We do recommend getting started from these, the first boxes that I went through, but I do recommend going over them and looking at quite a few different insights or inventory that we provide here. The last part I want to touch on is about governance. And Wiz here provides two important pages to provide you that visibility. The first one is about the identities inventory. What Wiz does, it actually has a full inventory of all the identities that I have within the cloud. For example, I get here an aggregation of I wanna look specifically at someone who has access to Snowflake, but I wanna understand what are all the platforms they can access. On top of that, for each one, we provide you a breakdown of exactly what are those users, their email, do they have any insights such as a missing MFA in any of their accounts, and if they have admin privileges in the different Clouds. In this example, we can see Lior is actually in a domain of four different accounts. Lastly, we provide you a breakdown of all the issues associated with a certain identity. So I can understand if a certain identity within the cloud has a lot of issues associated with them with the identity context of missing MFA, inactivity, or admin privileges. Additionally, we provide customers the ability to search for any type of Cloud access. What does that mean? In our Cloud entitlements explorer, we allow customers in the first row to select a certain identity, such as an IAM role. We can select the access type, which it has. For example, maybe I want to look at data access and I can choose a certain resource. In this example, I'll choose an S3 bucket. And Wiz provides you here a full breakdown of one, what is all the access a certain role has? Which bucket exactly it can access, which policies grant it permissions, policies or roles. And as always, we provide you the effective analysis of what are all the permissions that this role can access to this bucket. If we want, we can actually see this in a graph view as well, where we can see here the 10 different roles can access a certain bucket. On top of that, we have a lot of different filtering, such as looking for inactive IAM roles or specifically buckets which has sensitive data. Perfect. That's the demo. Amazing. Thank you, Yariv. I'll pass it on back to Laura. Alright. All right. Big thank you to Yareev and Shekhed for such a super quick, great walk through. Before we move on to Q and A, we've got two minutes or so for Q and A. I am going to launch a quick short survey for those of you in the audience. It's only five questions. And as a thank you for your feedback, we'll send you a $25 Starbucks gift card. In the meantime, we're gonna move into q and a. We've got about two minutes or so and a handful of questions. So I will bring Shaqed up to up to the floor with me. Alright. A whole bunch of questions coming through. Let's start with some Oh, sorry about that. Oh, I'm a little sorry. All good. Let's just start from the end. I'm gonna say from Curtis. Reactive remediation is great based upon finding an issues, but I'm curious as to the proactive approach to stop the issue in the first place. So as I mentioned in the response, we have different capabilities to scan whether it's code or IC templates in code repositories or in c I CICD pipelines. And with the code scanning, you can detect things across the board. So, like, sensitive data vulnerabilities, but also specifically to Kim, you can see any I'm misconfigurations so we can extend, kind of the cloud configuration rules to your CICD pipelines and code repositories. And you can also find exposed secrets, within those code and then make sure that any of those risks never reach the cloud from the first place. And there is a findings. Curtis followed up and asked if there's a findings dictionary. We can get a comprehensive list for nonhuman identities. And Chuck had mentioned this in the chat is yes. You can filter by resource type, access key, secret secret secret service account, and then view all the policies. And, yes, there will be a recording of the session that will come up. We'll go do Shaka, is there one more here that you wanna throw in? I saw there's a question about unused permissions for, non admin IT roles. So we provide all the permissions, recommendations, and, like, rightsizing for all sorts of roles in the environment. I'll also answer the question from Ashley. Does Wiz King provides a repository of common attack vectors that can be leveraged to improve security measures before an exploit occurs? So there's, yes. So we have the WIS, issues and controls, and those are common attack paths that we're seeing in the cloud that correlates key information to other cloud, context and risks like vulnerabilities, misconfigurations, etcetera. And we also have the threat center where you'll find any, like, sort of new emerging threats that are out there that are hunted by our research team. And as soon as there's any type of emerging threat, we add it to the threat center within a few hours to twenty four hours, and then we show you if you have detection for those threats in the environment. Awesome. That is, unfortunately, all of the time we have today, but we will follow-up if you ask the question and make sure that you get an answer for that. I am going to launch that survey now. Again, it really helps us just kinda figure out this series, if it's helpful, what you wanna hear about, and you will get a 25 gift card to Starbucks, if you fill that out. So I will launch that now. Thank you all for joining us, and have a great rest of your day. Day.