The Separation of Duties control is all about making sure the right people have the right level of access to systems and data. It's a key principle in information security that helps prevent unauthorized access and minimize the risk of malicious activity. By employing separation of duties, organizations can ensure that no single individual has too much power or control over critical systems.

Where did this come from?

This control comes from the CSA Cloud Controls Matrix v4.0.10 - 2023-09-26. You can download the full matrix here. The CSA CCM provides a comprehensive set of security controls specifically designed for cloud computing environments. For more background, check out the IAM documentation from AWS which discusses identity and access management best practices.

Who should care?

This control is relevant for:

• System administrators responsible for managing access to production, testing, and development environments
• Application owners who need to ensure appropriate access controls for their systems
• Compliance officers tasked with ensuring adherence to security best practices and regulations
• Security analysts investigating potential insider threats or unauthorized access attempts

What is the risk?

Without proper separation of duties, a malicious insider or compromised account could gain excessive privileges to manipulate data, alter system configurations, or steal sensitive information. This could lead to data breaches, system outages, financial losses, and reputational damage.

Implementing this control helps prevent:

• Unauthorized changes to production systems
• Disclosure of sensitive data during testing/development
• Insider fraud and data tampering
• Propagation of malware across interconnected environments

What's the care factor?

Separation of duties should be a high priority for any organization dealing with sensitive data or critical systems. The consequences of not properly segregating duties can be severe - imagine an insider at a bank who can both initiate and approve high-value transfers with no oversight. Or a compromised dev account that can push untested, malicious code directly to production.

While perfect segregation may not always be practical for smaller teams, the control can usually be adapted to fit the organization. The key is ensuring that no individual accumulates excessive, unchecked privileges.

When is it relevant?

Separation of duties is most relevant when:

• Multiple environments (prod, test, dev) with different sensitivity levels exist
• Privileged access to critical systems/data is required
• Regulatory compliance (e.g. SOX, PCI-DSS) mandates strict access controls
• The organization has a large attack surface with many potential insider threats

It may be less critical for:

• Small teams where cross-functionality is required
• Low-risk environments with little sensitive data
• Fully automated processes with no manual interventions
• Systems already employing robust compensating controls

What are the trade offs?

Implementing strict separation of duties can sometimes:

• Slow down development velocity due to restricted access
• Require more personnel to fully segregate responsibilities
• Add complexity to access provisioning and management processes
• Frustrate users who feel the controls impede their productivity

Organizations must strike a balance between security and usability. Conducting a thorough risk assessment can help prioritize where strict separation is truly necessary.

How to make it happen?

1. Define distinct prod, test and dev environments, each with its own access policies
2. Determine which responsibilities must be segregated (e.g. development vs approval)
3. Design roles that align with separation needs (e.g. devs can deploy to test, but not prod)
4. Implement technical controls to enforce role-based access:
   • Set up AD/LDAP groups corresponding to roles
   • Configure AWS IAM policies to restrict access by role
   • Use AWS Organizations to isolate prod/non-prod accounts
   • Require MFA for sensitive operations
5. Establish approval workflows requiring multiple sign-offs for prod changes
6. Log and monitor all privileged access for anomalies
7. Perform regular access reviews to identify excess permissions
8. Train personnel on their specific responsibilities under the segregation policy

What are some gotchas?

• Segregating AWS accounts requires robust cross-account IAM role setup. Admins will need iam:CreateRole, iam:PassRole et al. See the docs.
• Separating environments is not always clear cut, e.g. if test data needs to mirror prod. May require additional data obfuscation steps.
• Granular IAM policies can quickly become complex to manage. Use of policy aggregation and permission boundaries is recommended.
• Admins may resist giving up "god mode" access. A strong tone from the top on segregation policies may be necessary.

What are the alternatives?

• Robust logging, monitoring & alerting can provide detective controls where preventative separation is not possible. For example, CloudTrail can flag unusual API access patterns.
• Automated deployment pipelines with human approvals can enforce separation of code promotion vs deployment.
• Advanced AI/ML-based anomaly detection tools may be able to spot malicious insider behavior more effectively than rigid role separations.
• Very granular object-level permissions and zero trust methodologies can sometimes be an alternative to coarse-grained account segregation.

Explore Further

• For more technical details on AWS IAM best practices, see the AWS IAM Security Best Practices Guide
• The CIS AWS Foundation Benchmark controls 1.5 - 1.17 cover various best practices for user accounts and IAM policies: https://www.cisecurity.org/benchmark/amazon_web_services
• NIST SP 800-53 control AC-5 covers separation of duties for federal systems: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/control?version=4.0&number=AC-5
• The MITRE ATT&CK Cloud Matrix has several techniques involving exploitation of poor separation of duties: https://attack.mitre.org/matrices/enterprise/cloud/

I hope this comprehensive article on the Separation of Duties control is helpful for your team! Let me know if you need any other details.

‍