Rapid7, Inc. announced the availability of its Cloud Identity and Access Management (IAM) Governance module for DivvyCloud to help customers identify and reduce cloud identity risk. With this new module, customers gain deeper visibility into their cloud resources to assess, prioritize, and remediate improper permission combinations that could grant unintended or overly permissive access.   

The dynamic and ephemeral nature of cloud environments makes traditional security perimeter approaches insufficient for managing risk. To reduce risk, companies must view identity as the new perimeter. Unfortunately, the complexity of cloud environments and cloud service provider IAM tools often lead developers and engineers to grant unintended or overly permissive access. For security teams, this same complexity makes it difficult, if not impossible, to determine who-or what-has access to a cloud resource. The result is unmanaged cloud risk that overwhelms security teams.   

"Despite the fact that cloud-based services and tools have been a staple in most companies' operations for many years, IAM remains a persistent problem because traditional IAM solutions don't solve today's challenges," said Brian Johnson, senior vice president of cloud security at Rapid7. "Rapid7's new Cloud IAM Governance module for DivvyCloud allows our customers to gain full control and visibility over their entire cloud environment, no matter how many different cloud providers, users, or resources they have in play. Once they have this insight, companies can start to implement least privilege access to reduce the risk of data breaches and enhance security."  

This solution is now generally available to DivvyCloud customers as an additional module. Specifically, the Cloud IAM Governance module allows customers to: 

1. Gain visibility of the full cloud IAM picture to assess, prioritize, and remediate improper permission combinations that grant unintended or overly permissive access 
2. Explore effective access by principal user, resource, or application 
3. Understand true access to complex IAM combinations 
4. Establish and maintain least privilege  
5. Limit and understand the cloud security blast radius 

"This solution is designed to solve a critical pain point for enterprises today," said Chris DeRamus, vice president of technology at Rapid7. "Our IAM Governance Module analyzes and maps customers' cloud environments and bridges the gaps between cloud provider IAM policies and enterprise directories (e.g. Active Directory, LDAP, Okta, Ping, etc.). Enterprises can now identify exactly what resource, application, user, and role is accessing a specific cloud asset and the potential impact of that access." 
 
"The surge in remote work caused by the pandemic has been accompanied by an increased reliance on cloud applications and services," said Doug Cahill, vice president and group director of cybersecurity, ESG Global. "This means companies have had to act quickly to ensure proper support and secure access to cloud resources, and, according to a recent study conducted by ESG, developing and adjusting security policies is the top security challenge associated with remote work. Companies need a solution that supports this increase in direct-to-cloud access by offering identity and access management options that recognize there's a new perimeter and ensures security."