Application access / permissions trends and best practices

[ShimKwan]

Hi,

Have a question around trends/best practices and application access.

Back in the "old" days application access was controlled from within the app, whereby roles may have been defined within the application, individual accounts were created within the app, and people could use the app accordingly.

Then came Directory Services, and if the application was, for example, AD integrated, then that is how access to the app was controlled - use AD accounts /  AD Groups.

Now we have the Cloud.

So is the new trend to use, for example, Azure Groups to control access to "modern" apps - with all the benefits of Azure Groups (e.g. dynamic membership, centralized admin, easier auditing, etc etc etc).

While writing this question out, I think I have answered myself (somewhat) - but keen to hear people views on the matter.

Thank you,

SK

[#2]

Old era connectivity through the internet is limited. Networking among People, Process and Technology is very much limited within a contained area. Considering the threat vectors for identities are very much narrowed in scope. With the advancement of internet era, all the AAA services including Authentication, Authorization and Accounting flip to a different level. As an example Kerberos cannot meet the requirements on the authentication anymore. Password considered as no longer safe and moved to multi-factor authentication mechanisms such as human bio metrics, RFID and PINs.
Considering the hot topic on Zero Trust Architecture all elements should be treated as un trusted.

[#3]

Thanks for the reply, doesn't really answer the question though.