Identity-Centric Security For Cloud Workloads: A Modern Approach

Anvesh Gunuganti, Information Security Engineer, Optum Technologies.

In 2024, nearly half of organizations reported suffering a cloud data breach in the previous year, highlighting the urgent need for robust security measures.

Having worked extensively in cloud security, I’ve found that many companies don’t realize that legacy, perimeter-based security frameworks fall short in cloud environments, where workloads are decentralized and access control must be adaptable to the dynamic nature of the cloud.

Organizations must reframe their security strategies, prioritizing identity and access management (IAM) and zero trust to protect against breaches. Before I explain how to develop a security based on these two concepts, let’s first look at some of the key challenges organizations need to solve:

1. Decentralized Access Management

Cloud infrastructures generally span multiple regions, making consistent access control enforcement complex. Many security breaches are due to misconfigured cloud settings and identity sprawl, which is where disparate identity providers and policies create security gaps.

2. Credential Management

Modern cyber threats—such as ransomware attacks and API exploits—bypass traditional defenses. Attackers leverage social engineering, compromised credentials and misconfigured cloud services to gain unauthorized control.

In fact, recent Google Cloud research found that almost half of breaches were due to compromised credentials.

3. Regulatory Compliance Requirements

Stringent data protection laws—including GDPR, HIPAA and PCI DSS—mandate strong access controls and audit trails. The dynamic nature of cloud workloads complicates compliance, requiring organizations to implement identity governance solutions that enforce least privilege access and maintain security logs for audit readiness.

4. Scalability And Complexity

Managing identity and access across hybrid and multicloud ecosystems requires automation and fine-grained policy enforcement. A 2022 Strata report found that 66% of organizations face difficulties in managing identity and access across multicloud environments.

Implementing An Identity-Centric Security Model

Solving these challenges will require an overhaul in how companies approach cloud security. A few factors to consider include:

1. Authentication And Identity Management

Managing large volumes of user identities can become complex as your organization scales. Implementing automated identity provisioning and de-provisioning based on the employee life cycle can streamline this process and reduce the risk of orphaned accounts.

Identity and access management (IAM) tools can centralize authentication, making enforcing consistent policies across the organization easier.

With these tools, organizations may initially overlook the need to continuously refine the machine learning models that analyze user behavior. Before getting started, spend time understanding the baseline of user activity to minimize false positives and ensure smooth user experiences without compromising security.

Maintaining a comprehensive identity life cycle strategy is complex. It’s about integrating tools and aligning them with business processes (e.g., HR systems). Make sure to plan for change management, as every new integration could introduce potential gaps or conflicts in access controls.

2. Granular Access Control

With IAM, role-based access control (RBAC) works well for static roles, while attribute-based access control (ABAC) shines in dynamic environments, adjusting permissions based on device type, location and access time.

Implementing ABAC can be complex, especially when dealing with large datasets or environments where user attributes change frequently (e.g., remote-work scenarios). In this case, having a process to keep these attributes updated in real time can strengthen the implementation process.

For access control policies, start small and then refine policies over time. This is a key aspect as there is a potential for over-permissioning when setting up access controls.

3. Continuous Monitoring And Threat Detection

Tools like AWS CloudTrail and Splunk continuously monitor user activity and system interactions. These tools provide powerful logging and real-time anomaly detection capabilities.

Just having logs isn’t enough. You must also collect the proper context (e.g., device information, geographic location, time of day) to make informed decisions. Consider integrating identity data directly with your security information and event management (SIEM) to correlate access events with user profiles.

I’ve found that the challenges of ensuring the quality of alerts and reducing false positives can be immense. It requires continuous tuning to avoid overwhelming security teams with false alarms. Hence, teams should allocate time for refining alert criteria and developing efficient workflows to triage anomalies.

4. Zero-Trust Framework Implementation

A zero-trust framework is essential for IAM, which the NIST defines as eliminating “implicit trust in any one element, component, node or service and instead requires continuous verification of the operational picture via real-time information from multiple sources to determine access and other system responses.”

However, rolling out zero trust is not a one-time configuration, especially in large organizations. Zero trust requires consistent auditing, real-time monitoring and frequent updates. You will also need to consider the operational impacts of implementing granular security controls at every layer.

Balance user convenience with your organization’s security posture by implementing adaptive authentication that evaluates risk and only prompts for additional verification when needed.

Conclusion

As cloud environments continue to grow, businesses that prioritize identity security will achieve stronger compliance, operational efficiency and long-term resilience. Real-time threat detection ensures swift mitigation of security breaches, and automated identity governance streamlines compliance with industry regulations.

By understanding the nuances of IAM, zero trust and modern cloud security, organizations can mitigate data breaches and prevent data loss and downtime.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?