With hackers busy exploiting topical events to steal access credentials, properly maintaining the access roles and privileges for your AWS, Azure and Google Cloud Platform (GCP) accounts is an essential step in safeguarding the data and workloads you store with these cloud providers.

In this article I’ll walk through how Sophos Cloud Optix, our cloud security posture management tool, helps you secure access to your public cloud accounts.

Multi-factor authentication

Multi-factor authentication (MFA) adds an extra layer of protection on top of a username and password, protecting against password compromise. All user accounts should have MFA enabled. Cloud Optix ensures MFA is enabled for AWS accounts, and the Cloud Optix service itself.

Protecting cloud accounts with MFA

Identity and Access Management (IAM) is the AWS tool that controls access to services within your Amazon cloud account. You should ensure MFA is enabled for all IAM users that have AWS console access.

The Cloud Optix inventory view allows you to identify any IAM users without MFA enabled. This information is provided by an AWS Credentials report, which is updated by AWS every four hours.

Protecting your Cloud Optix account with MFA

You can also use MFA to improve the security of your Cloud Optix console. This means you must use another form of authentication, as well as username and password, when you sign into Cloud Optix. Learn how to enable MFA for Cloud Optix.

Adopt the principle of Least Privileged Access

The services within your Amazon cloud account will include server instances, databases, storage – literally anything you run in Amazon. As best practice you should give users, groups and services only those privileges which are essential to perform their role. This minimizes risk and exposure.

However, keeping track of the actual use of the privileges assigned in IAM for all accounts, groups and roles can be a nearly impossible task without a lot of manual labor.

Avoid internet-facing resources

Accidental or malicious changes to the cloud resource configurations in AWS, Azure or GCP, such as S3 buckets, RDS, and EBS leave your organization exposed to automated hacker searches looking to exploit sensitive data.