PALO ALTO, Calif. & TEL AVIV, Israel--(BUSINESS WIRE)--Ermetic, the cloud identity and access governance company, today announced the market’s first platform that provides full stack visibility and control over multi-cloud infrastructure entitlements. By analyzing identity and access management (IAM) policies as well as the configuration of network, storage and secrets assets, Ermetic eliminates attack surface blind spots and enables organizations to enforce least privilege across their entire cloud infrastructure.
“One of the biggest risks in public cloud security is access abuse, specifically excessive permissions and compromised identities having access to data and resources. The challenge is that enforcing least privilege is much more difficult in the public cloud than on-premises,”1 said Garrett Bekker, Principal Security Analyst at 451 Research, a part of S&P Global Market Intelligence. “Many customers are looking to add additional security controls and services themselves, and there's increased interest in addressing user roles and permissions.”2
Full Stack Visibility of Risks
To help security and cloud operations teams reduce their attack surface, Ermetic combines a holistic view of both network access and IAM policy entitlements to comprehensively assess risks. By monitoring and visualizing both network configurations and identity access policies Ermetic provides the context needed to correctly assess the risk of over privileged and risky entitlements.
For example, a machine with elevated privileges that is exposed to the internet would pose a greater security risk than one with a similar IAM configuration without internet access. This unified visibility is unique to Ermetic and is essential for accurately assessing the “effective access” assigned to a machine or data resource.
“While it’s virtually impossible to determine entitlement risks for users and machines using tools offered by cloud platform providers, third party tools that rely exclusively on identity and access policies without also analyzing network access do not provide a true and accurate view of risks,” said Shai Morag, CEO and Co-Founder of Ermetic. “Ermetic is the first solution to provide full stack visibility into both identity entitlements and network access configurations, which enables customers to comprehensively assess and govern the risks associated with complex scenarios of users, machines, and resources.”
Shift Left with Advanced Policy Automation
To enable organizations to “shift left” and integrate cloud infrastructure entitlements management (CIEM) into their existing workflows and processes, Ermetic has introduced a policy wizard that automates policy administration and risk remediation. These new capabilities enable Dev, DevOps and Security teams to review and authorize policy changes in a few short steps, and implement them via cloud provider APIs with the push of a button. Meanwhile, new infrastructure as code (IaC) templates for Terraform (Hashicorp) and Cloud Formation enable policy changes to be made through existing CI/CD pipelines. In addition, a RestAPI enables the sharing of policies and data from Ermetic with enterprise platforms including ticketing systems, SIEM, and more.
Managing Third Party Identities
Governing third party access by contractors, service providers and applications to public cloud environments is both a security and compliance imperative. While it is easy to grant access to third parties, it is difficult to discover and assess their entitlements, as well as re-certify and/or remove them. To address these risks Ermetic can audit third party users including SaaS applications and APIs, correctly assess their risk, delete inactive accounts, and remove excessive permissions.
Governing Federated Users
Many organizations provide federated access (SSO) to their cloud resources using external identity providers such as Okta or Azure AD. This creates a blindspot that makes it virtually impossible to manage and control entitlements of federated and external users. To enable the enforcement of granular access policies on federated identities, Ermetic provides comprehensive visibility into the privileges assigned, needed and in use by each user.
Availability
The latest version of the Ermetic platform is available immediately from Ermetic and its business partners worldwide.
About Ermetic
Ermetic enables enterprises to protect cloud infrastructures (IaaS/PaaS) by governing identities, access entitlements and enforcing least privilege at scale. Through the continuous analysis of entitlements and activity, Ermetic provides full-stack visibility into the effectiveness and risks of policies attached to human and machine identities for accessing compute resources, data stores and the network. The company is led by proven cyber security veterans whose previous companies were acquired by Microsoft, Palo Alto Networks and others. Ermetic is funded by Accel, Glilot Capital Partners, Norwest Venture Partners and Target Global. Visit us at https://ermetic.com/ and follow us on LinkedIn, Twitter and Facebook.
1 451 Research, part of S&P Global Market Intelligence, Ermetic joins growing list of vendors tackling excessive access permissions in public cloud, 29 June 2020
2451 Research, part of S&P Global Market Intelligence, Voice of the Enterprise: Information Security, Budgets and Outlook, 2019
