Access Enforcement
Description
Enforce approved authorizations for access to information and systems using RBAC.
⚠️ Risk Impact
Without access enforcement, authorization policies are meaningless.
🔧 Remediation
Implement RBAC with least privilege. EchelonGraph scans IAM policies for enforcement.
💀 Real-World Attack Scenario
A federal agency had an access control policy but no technical enforcement. IAM policies granted 'AdministratorAccess' to 47 users including contractors who only needed read access. A compromised contractor account was used to modify security group rules, disable GuardDuty, and exfiltrate sensitive PII.
💰 Cost of Non-Compliance
FISMA audit finding for AC-3: Plan of Action and Milestones (POA&M) required. Unresolved POA&Ms can result in loss of ATO. Average POA&M remediation: $500K-$2M.
📋 Audit Questions
- 1.How are IAM policies tested for correct enforcement?
- 2.Show RBAC role definitions and their mapped permissions.
- 3.Are there any users with permissions exceeding their documented role?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Access policies documented but not translated into technical IAM controls
- ⛔Using broad managed policies instead of custom least-privilege policies
- ⛔Not testing that IAM policies actually deny unauthorized actions
📈 Business Value
AC-3 enforcement transforms paper policies into actual security. It's the bridge between governance documentation and real-world protection.
⏱️ Effort Estimate
16-40 hours for IAM policy audit and remediation
EchelonGraph scans IAM policies and identifies overly permissive configurations
🔗 Cross-Framework References
Automate NIST 800-53 AC-3 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →