Under the hood: The security analytics that drive IAM recommendations on Google Cloud

This is a repost of the blog I wrote on Google’s Cloud Blog site IAM Recommender helps security professionals enforce the principle of least privilege by identifying and removing unwanted access to Google Cloud Platform (GCP) resources. In our previous blog, we described some best practices for achieving least privilege with less effort using IAM Recommender—which uses machine learning

Continue reading

Achieve least privilege with less effort

This is a repost of the blog I published earlier on Google Cloud’s site. As cloud adoption grows, we’re seeing exponential growth in cloud resources. With this we’re also seeing growth in permissions, granted to humans and workloads, to access and change those resources. This introduces potential risks, including the misuse of privileges, that can

Continue reading

Exploring the machine learning models behind Cloud IAM Recommender

This is a repost of a blog I wrote on Google Cloud’s site To help you fine-tune your Google Cloud environment, we offer a family of ‘recommenders’ that suggest ways to optimize how you configure your infrastructure and security settings. But unlike many other recommendation engines, which use policy-based rules, some Google Cloud recommenders use

Continue reading

PIM, PAM, or Perish?

  OneWorld Identity‘s Cameron D’Ambrosi sat down with Shawn Keve and me to discuss the unique challenges of Privileged Identity Management as compared to traditional IAM, aired in the August edition of his “The State of Identity” podcast. Listen to a recording here: Privileged identities come in various forms: they can be elevated accounts on your

Continue reading

The Next Generation IDaaS Solutions

In my previous articles, I discussed the 5 growing expectations businesses now have that are driving transformation in the Identity as a Service (IDaaS) industry – what I’ve called “next-generation IDaaS.” In this, my third and final post in the series, I get to toot our own horn a bit and explain how vendors are

Continue reading

Managed Identity Services: the next generation of IDaaS

In my last post, I discussed how the “Service” part of “Identity as a Service” (IDaaS) can mean very different things to different IDaaS companies. To us, the “Service” part means “full service.” This stands in contrast to most other IDaaS firms where the “Service” part means only that they host and maintain the Identity

Continue reading