Back to Index

“Every identity is a potential attacker.”

IAM — Identity and Access Management — is one of the most under-audited and over-privileged parts of any system. Whether it’s cloud roles, SSH keys, service accounts, or OAuth scopes, the IAM layer quietly controls the blast radius of almost every breach.

IAM ASR is the practice of ruthlessly trimming, isolating, and simplifying identity and permission structures to reduce your exposure.

1. Principle of Least Privilege

• Start with zero access, not “read-only by default.”
• Grant access by use case, not by team name or job title.
• Use explicit allowlists, not role inheritance.

2. Human Account Hygiene

• Deactivate stale accounts aggressively — interns, contractors, offboarded employees.
• Eliminate shared logins. If multiple people use the same credentials, you’ve already lost attribution and accountability.
• Use Just-in-Time access where possible.

3. Service Identity Discipline

• Every bot, script, CI job, and microservice should have its own identity.
• Scope access to exactly what’s needed.
• Prefer short-lived credentials over static access keys.

4. Shadow Access Discovery

• Use tools or scripts to find:
  • Unused IAM roles
  • CLI profiles on dev machines
  • Credentials in .env files, repos, or CI logs
• Audit and rotate secrets regularly.

5. Role Explosion Control

• Avoid creating a new role for every workflow without consolidation.
• Use naming conventions that track purpose, not teams.

6. Federated Identity Risks

• Audit all SSO providers and SaaS integrations.
• Check token lifespans — many OAuth tokens don’t expire.
• Enforce 2FA/MFA even through federated systems.
• Disable unnecessary SCIM or provisioning APIs.

7. Secret Lifecycle ASR

• Rotate, scope, and expire secrets.
• Don’t keep secrets in repos.
• Avoid secrets in CI/CD environments unless ephemeral.

8. SaaS and Vendor Identity Exposure

Every SaaS integration is a new surface that can impersonate, access, or misconfigure your internal systems.

• Review all OAuth applications connected to your GitHub, Google Workspace, or IAM providers.
• Revoke stale or unused tokens.
• Audit scopes: most apps request far more than needed (e.g., full repo access instead of read-only).
• Prefer integrations that support scoped tokens, time-limited access, and logging.

SCIM, SAML, and auto-provisioning tools often create shadow users and ghost access paths.

• Disable automatic provisioning when not needed.
• Monitor what SaaS systems are spinning up in your directory.

9. Guidelines for IAM ASR

10. Final Thought

IAM is your real perimeter. Everything else is an illusion.

By practicing IAM ASR, you don’t just prevent breaches — you limit their scale, accelerate incident response, and build defensible systems that survive human mistakes.

Make it a habit:

• Audit
• Remove
• Reduce
• Rotate

And above all, treat access as radioactive — safe only when sealed, dangerous when ignored.