Don't Ask for Forgiveness, Ask for Permission

All companies can relate to the amount of time and resources it takes to situate employees into new roles, onboard new hires, and especially go through the process of recertification. What tends to come out of recertification is the unfortunate entitlement or access creep that enables that extra access stemming from the habit of clicking yes to all seemingly relevant access selected. While these decisions are stuck in the moment they are decided and do not update until the next cycle, runtime authorization policy checks happen in the exact second access is requested. Removing the static manager decision process and allowing for just-in-time context attributes delivers the right access to the right resource at the right time. Decisions on privilege should be based on real-time policies and consistent data governance that speak more to our continuously evolving business landscape. David Brossard will cover the specifics of policy-based access control and explore whether recertification can be reframed as we move forward with these policies that are already key to the future of IAM & Cybersecurity.

1. Don’t Ask for Forgiveness, Ask for Permission! David Brossard, CTO, Axiomatics

2. IAM and OWASP in the Cybersecurity Landscape CTO, Axiomatics David Brossard OpenID AuthZEN Co-Chair

3. They’re everywhere…

4. They’re out to get you

5. They look innocent

6. They’ll drain your bank account

7. They’ll gobble every cookie…

8. And they won’t (always) even ask for permission

9. Dad, can I eat all the 🍦?

10. Authorization Models

11. Runtime ABAC, Graph, MAC Attributes, Policies, P*P AuthZEN, ALFA, OPA Admin-time ACLs, RBAC, DAC Roles, Groups, Entitlements NIST RBAC Event-time Event-driven framework Shared Signals, Listeners… CAEP, Shared Signals

12. Assign users the roles and entitlements they need Requires a mature joiner-mover-leaver process to keep configuration up-to-date Requires Identity & Access Governance (IAG) to run regular audits and verify that no one has rights they shouldn’t have OWASP A01:2021 – Broken Access Control Violation of the principle of least privilege or deny by default, where access should only be granted for particular capabilities, roles, or users, but is available to anyone. Admin-time Auth orization

13. If you give a mouse a cookie OAuth Token

14. Access Creep & Token Bloat

15. New times require new techniques Zero Trust P rinciple of Least Privilege Continuous Access Requirements from the Government DevSecOps Continuous Authorization Implementation Guide Department of Defense (DoD) Cybersecurity Reference Architecture Department of Defense (DoD) Zero Trust Reference Architecture CISA's Zero Trust Maturity Model Version 2.0 NIST SP 800-207 - Zero Trust Architecture

16. Runtime Authorization Check for access at runtime ABAC, PBAC, Graph all enable runtime access OpenID AuthZEN standard for PEP-PDP ALFA for policies

17. Different authorization implementations (graph, ABAC…) do not all use the same interface Most are 90% the same Within the OpenID AuthZEN Working Group, we decided to standardize across all solutions Step 1 Simple Permit/Deny request/response protocol Step 2 Multiple decision approach: bundle multiple requests into a single one and receive multiple decisions back Other WIP Design patterns (integration with OAuth-style approaches) Support obligations in responses ‘Search’ API Do you want to take part? OpenID AuthZEN Grab a DeLorean and join us at the Identiverse AuthZEN Interop on 5/28 in Vegas. Try the Axiomatics AuthZEN PDP at https://pdp.alfa.guide and using the Postman Collection OpenID AuthZEN: Providing Interoperability between approaches

18. A Policy-Driven Approach to Authorization Managers can view their customers’ bank accounts A customer can view their own bank account A customer can close their bank account A customer can view the account for a dependent (minor, senior citizen) API App Code GET /accounts/ 123

19. A Policy-Driven Approach: ALFA policyset accounts{ target clause attributes.objectType == "account" apply firstApplicable policyset viewAccounts{ target clause Attributes.actionId == "view" apply firstApplicable managers customers } policy closeAccounts{ target clause user.role== "customer" and Attributes.actionId == "close" apply firstApplicable // A customer can close their bank account viewAccounts.customers.ownAccount } }

20. ABAC Policies Examples default allow := false allow if user_is_owner allow if { user_is_employee action_is_read } allow if { user_is_employee user_is_senior action_is_update } allow if { user_is_customer action_is_read not pet_is_adopted } policyset records{ target clause objectType== "record" apply firstApplicable policy viewRecords{ target clause actionId== "view" apply firstApplicable rule managers{ target clause user.role == "manager" permit } rule owner{ permit condition record.owner==user.employeeId } }} permit ( principal == PhotoApp::User::"alice", action == PhotoApp::Action::"viewPhoto", resource == PhotoApp::Photo::"vacationPhoto.jpg" ); permit ( principal == PhotoApp::User::"stacey", action == PhotoApp::Action::"viewPhoto", resource ) when { resource in PhotoApp::Account::"stacey" }; Rego (OPA) ALFA AWS Cedar

21. ALFA Policies can be visualized as Graphs Attorney View Court Reporter Transcript DO ▼ - - - - Permit if the attorney is assigned to the case. Permit if the attorney is in good standing. Permit if the attorney is licensed. Permit if the attorney checks are all good. - - - - - - - - The attorney must be assigned to the case. The attorney must be in good standing. The attorney must be licensed to practice in court. The attorney must be cleared. ✔ ✔ ✔ ✔ DuP ▼ DuP ▼ DuP ▼ DuP ▼

22. Putting a 🩹 on existing applications Acknowledge sessions and tokens are pervasive Adapt apps so that tokens can be augmented/reduced The goal of the SSF Working Group is to enable the sharing of security events, state changes, and other signals between related and/or dependent systems Event-time Authorization

23. Authorization Lifecycle Define the use case Gather AuthZ Reqs Identify attributes Author policies Test the policies Deploy architecture Deploy the policies Run Access Reviews

24. The Ten Commandments of Authorization Declarative (policy-based) Dynamic (runtime decision) ABAC (attributes) Decoupled (from the app) ReBAC (relationships) Feature-driven (business rules) Transparent (audit & review) Scalable (protect 1…∞) Agnostic (APIs, data…) Future-proof (APIs, data…)

25. Can we all adapt to a P*P architecture? IIW37_S7I_PDP & PEP vs. AS/RS Smackdown (How to map them properly?)

26. Authorization Pyramid Runtime 02 Event-time 03 01 Admin Time

27. Further Reading Authorization Models Role Based Access Control RBAC (NIST) Attribute Based Access Control ABAC (NIST) A Taxonomy of Modern Authorization Models - IDPro ReBAC: Access Control Requirements for Web 2.0 Security and Privacy ( Carrie Gates ) Standards Work OpenID AuthZEN WG OpenID Shared Signals WG ALFA - the Abbreviated Language for Authorization https://alfa.guide and https://authzen.guide Podcasts, newsletters, and more Authorize Clipping Service Dynamically Speaking: The Axiomatics Podcast - YouTube