Defining identity as the security perimeter
In Chapter 2, Describing Security Methodologies, we covered the defense in depth strategy and shared responsibility within the cloud. We identified that when utilizing a cloud provider for infrastructure, we no longer are responsible for the first layer of defense in depth, the physical defenses. Therefore, identity and access become the first layer of defense that we are responsible for in a cloud architecture. This is where the identity is the new perimeter statement comes from.
As consumers, we are consuming cloud services every day and our identities are being used with multiple companies. It is our responsibility to protect those identities as consumers. As a company, when we make a decision to utilize a cloud provider for services such as Microsoft 365 or Azure, we also need to make sure that we are putting proper controls in place to protect the identity of our users. The following sections will define what identity and access management...