Find Interview Questions for Presidio

An access review is a process where an organization evaluates and verifies user access rights to systems and data to ensure that permissions are appropriate and comply with security policies. It should typically be performed at least annually, but more frequent reviews (e.g., quarterly or biannually) may be necessary depending on the organization's risk profile and regulatory requirements.

To implement least privilege in a large organization, follow these steps:

1. **Role-Based Access Control (RBAC)**: Define roles with specific permissions based on job functions.
2. **Access Reviews**: Regularly review and audit user access rights to ensure they align with current job responsibilities.
3. **Just-in-Time Access**: Provide temporary access to sensitive resources only when needed.
4. **Segregation of Duties**: Separate critical tasks among different users to reduce risk.
5. **User Training**: Educate employees on the importance of least privilege and secure access practices.
6. **Automated Provisioning**: Use automated tools to manage and provision access rights based on predefined policies.
7. **Monitoring and Logging**: Continuously monitor access and log activities to detect and respond to unauthorized access attempts.

Identity-based policies are attached to users, groups, or roles and define what actions those identities can perform on resources. Resource-based policies are attached directly to resources (like S3 buckets or IAM roles) and specify who can access the resource and what actions they can perform on it.

To secure machine-to-machine communication using IAM, implement the following measures:

1. **Use OAuth 2.0** for authorization, allowing machines to obtain access tokens securely.
2. **Implement mutual TLS (mTLS)** to authenticate both parties in the communication.
3. **Utilize API gateways** to manage and secure API traffic between machines.
4. **Enforce least privilege access** by granting minimal permissions necessary for machines to perform their tasks.
5. **Regularly rotate credentials** and tokens to reduce the risk of compromise.
6. **Monitor and log all communications** for auditing and anomaly detection.

The principle of least privilege means giving users and systems only the access they need to perform their tasks, minimizing potential risks. Zero trust is a security model that assumes no user or device is trustworthy by default, requiring verification for every access request, regardless of whether it originates from inside or outside the network.