Utilizing Privileged Access Management (PAM) to Combat Multi-Tenant Environment Risks
Multi-tenancy, which involves the sharing of infrastructure, software, and network assets by more than one entity, is the predominant mode of computing in the cloud. There are good reasons for this. A multi-tenant environment is more efficient than alternative approaches like assigning each system its own individual machine. Cloud Service Providers (CSPs) host multiple companies’ IT resources at once, providing each with cost savings compared to self-hosting all resources on-premise.
Having multiple tenants sharing data assets, however, exposes everyone involved to security risks. Eavesdropping, unauthorized data access, lateral moves between assets, and malfeasance are all possible if tenants can access each other’s resources without permission. Privileged Access Management (PAM) naturally emerges as an underlying countermeasure to mitigate these risks.
Multi-tenancy is the sharing of infrastructure, software, and network assets by more than one entity.
Multi-Tenancy and Why It’s Good for IT
Multi-tenancy solves a major problem for IT departments. Prior to its use, each system required its own dedicated hardware and software. If you wanted to run an application on a Windows Server with Microsoft SQL , you would install it on an X86 server and that machine would be yours for the duration. If you used it once a day, it didn’t matter. You still had exclusive use of that machine. As you can imagine, this quickly led to an unsustainable proliferation of physical machines.
The Evolution of Virtualization
Virtualization provided a solution. With a hypervisor, it became possible to run multiple independent systems as Virtual Machines (VMs) on the same hardware. Each system is a “tenant” on the machine, just like a person is a tenant in an apartment building. And, just as apartments share common electrical and plumbing systems, the VMs running on the hypervisor share resources like power, memory, and network connectivity.
Virtualization and multi-tenancy work well in private data centers, where they help with resource utilization. The technology has grown in sophistication in recent years, making it possible for today’s elaborate multi-tenant public cloud services. With a public cloud provider, you’re one of the millions of tenants on a massive collection of shared resources. You might be sharing tenancy on the same machine, the same database, and so forth. This arrangement offers substantial cost savings and gains in flexibility. However, it also introduces some serious security risks.
Security Risks in Multi-Tenant Environments
A system running in a multi-tenant environment is exposed to all the standard security threats like malware and hacking. However, given its location, the tenant must face an added layer of risk. Essentially, there is the possibility that a malicious actor will take advantage of the architecture to gain unauthorized access to your data assets.
Although multi-tenant environments streamline workflow, they have an added layer of risk as hackers can take advantage of the architecture to gain deeper access into organizational systems.
This might mean the hacker penetrates the hypervisor and is then able to manipulate or spy on any VM it hosts if the tenant environments are not well isolated from one another, with insufficient security. The attack could involve an unauthorized database user jumping across data tables shared by multiple tenants and stealing data from your system. Or, the malicious actor could disrupt your operations by switching your system off.
The public cloud actually presents two layers of this kind of risk. The cloud provider itself has multi-tenant security risks at the infrastructure and hardware levels. Customers have multi-tenant risk from other tenants or from attackers who have penetrated the cloud infrastructure. Given the standard two-tier security model of the public cloud, you will undoubtedly find yourself responsible for shielding yourself from multi-tenant risk at the application and storage layers.
Solutions to Multi-Tenant Risk in the Cloud
Multi-tenant environments can attain very robust security postures. Both infrastructure managers and clients have a variety of tools at their disposal to isolate one tenant from another, without relying solely on the CSP for security. These include internal access control systems that prevent a malicious actor from entering your system through a breach elsewhere in the multi-tenant architecture.
However, such countermeasures must adhere to a fundamental principle in order to work: There has to be clarity and certainty about who can administer the tenant assets as well as the ecurity measure itself. Without confidence that such privileged access is under control, the risk level goes up again.
Privileged Access Management and Multi-Tenancy
Types of Privileged Users
A user who has the right to access the administrative back end of a system is known as a “privileged user.” In a multi-tenant context, there are several different kinds of privileged users. The user who can set up and modify the hypervisor or other controls over shared resources is a privileged user. Someone who can set up or manage the underlying network infrastructure is similarly privileged.
At the client or tenant level, a privileged user is a person who can set up or modify the hosted assets. For example, a privileged user for a tenant will be able to administer the servers, databases, and storage that the tenant entity is renting. If security controls are in place, a tenant-level privileged user should not be able to access the assets of another tenant.
Different types of privileged users have access and control over different aspects of the infrastructure depending on their role.
Utilizing a PAM Solution
A well-implemented Privileged Access Management (PAM) system prevents a privileged user (or stolen privileged credentials) from gaining unauthorized administrative access to systems in a multi-tenant ecosystem. PAM combines practices and tools to keep malicious actors away from sensitive administrative backends. Indeed, when a hacker can impersonate a privileged user, he or she can do a lot of damage very quickly—stealing information, tainting the integrity of data, shutting systems down, and more. And, in some cases, the malicious privileged user can erase any evidence that he or she was even there.
A PAM solution operationalizes the control and oversight of all privileged activity. WALLIX, for example, lets super admins grant and revoke access privileges to users. The solution sits between the privileged user and the target system, providing access only to those resources which the user is authorized to see and administrate. That way, if a privileged user leaves the company, changes role, or simply no longer needs privileged access, the access rights can be terminated instantly.
The PAM solution also monitors privileged account sessions. This makes it possible for security analysts to know the answer to the most important questions that arise in a security incident: who did what, when? The WALLIX Bastion solution actually records a video of the privileged account session so it will be clear what a malicious—or negligent—actor did to harm the security of a multi-tenant system. PAM solutions can also issue alerts if there are suspicious activities occurring in a privileged account session. For example, if a privileged user logs in from an unexpected remote location, that could trigger an alert so SecOps people can investigate if there is something improper going on.
PAM provides a countermeasure to secure multi-tenant environments. It gives system owners visibility and control over who has administrative access to the tenant assets as well as to isolation solutions that secure the tenant assets. The cloud provider, too, can and should embrace PAM to make sure that only those with the appropriate authorization can access the admin panels of the cloud infrastructure.
To learn about WALLIX PAM solutions for multi-tenant environments, contact us or request a live demo.
