Automated Governance and Protection of Non-Human Identities in Cloud IAM
Keywords
Abstract
Cloud identity and access management has traditionally been designed around human users, role-based access policies, and organizational accountability structures. However, contemporary cloud environments increasingly depend on non-human identities, including APIs, service accounts, workloads, containers, scripts, automation tools, IoT devices, machine-to-machine connectors, and platform-native identities. These identities often outnumber human users, operate continuously, interact across hybrid and multi-cloud boundaries, and frequently possess privileged access to sensitive resources. As a result, unmanaged or weakly governed non-human identities create a critical attack surface for credential theft, lateral movement, privilege escalation, data exposure, and compliance failure. This technical paper examines governance and protection strategies for non-human identities in cloud IAM, with particular emphasis on an automated governance framework that integrates continuous vulnerability scanning, least-privilege enforcement, zero-trust verification, lifecycle management, and policy-driven accountability.
The paper synthesizes the provided literature on IT governance, COBIT, GDPR-oriented information governance, zero-trust architecture, blockchain-enabled identity, self-sovereign identity, IoT security, cloud adoption, and cybersecurity readiness. The analysis identifies a persistent gap between high-level governance frameworks and the operational realities of machine identity management. Existing governance models provide strategic oversight, while zero-trust and blockchain-based approaches offer security principles for distributed environments; however, few approaches sufficiently integrate automated discovery, risk scoring, privilege optimization, continuous monitoring, and compliance evidence generation for machine identities. The proposed framework addresses this gap by treating non-human identities as governable digital assets with measurable ownership, risk posture, access justification, policy compliance, and revocation requirements.
The paper argues that effective protection of non-human identities requires a shift from static credential management to adaptive identity governance. The findings show that machine identity governance must combine technical controls, such as workload authentication, secret rotation, behavioral monitoring, and vulnerability scanning, with governance controls, such as ownership mapping, auditability, segregation of duties, and policy alignment. The study concludes that automated governance of non-human identities is essential for resilient cloud IAM, particularly in environments adopting zero trust, IoT integration, DevOps automation, and data protection regulation.
References
L. Alevizos, V. T. Ta, and M. Hashem Eiza, “Augmenting zero trust architecture to endpoints using blockchain: A state- of- the- art review,” Security Privacy, vol. 5, no. 1, p. e191, Jan. 2022.
S. Alsofyani, M. Ishaque, and M. Nofal, “Zero-trust architecture for smart city healthcare systems,” in Proc. 2nd Int. Conf. Adv. Innov. Smart Cities (ICAISC), Feb. 2025, pp. 1–6.
S. Ameer, L. Praharaj, R. Sandhu, S. Bhatt, and M. Gupta, “ZTA-IoT: A novel architecture for zero-trust in IoT systems and an ensuing usage control model,” ACM Trans. Privacy Secur., vol. 27, no. 3, pp. 1–36, Aug. 2024.
C. Avila, E. J. Chinchilla, and T. Velásquez Pérez, “It governance model for state entities, as support for compliance with the information security and privacy component in the framework of the digital government policy,” in Journal of Physics: Conference Series, 2019. doi: 10.1088/1742-6596/1409/1/012005.
P. C. Bartolomeu, E. Vieira, S. M. Hosseini, and J. Ferreira, “Self-sovereign identity: Use-cases, technologies, and challenges for industrial IoT,” in Proc. 24th IEEE Int. Conf. Emerging Technol. Factory Autom. (ETFA), Sep. 2019, pp. 1173–1180.
S. Borja Barrera, K. Kim, H. Yoon, and J. Hwang, IT Governance Effectiveness and Its Influence on Innovation Product and Process. 2018. doi: 10.23919/PICMET.2018.8481752.
M. Bosamia, Positive and Negative Impacts of Information and Communication Technology in our Everyday Life. 2013.
F. Burmeister, D. Huth, P. Drews, J. Schirmer, and F. Matthes, “Enhancing information governance with enterprise architecture management: Design principles derived from benefits and barriers in the GDPR implementation,” in Proceedings of the Annual Hawaii International Conference on System Sciences, 2020, pp. 5593–5602. Accessed: January 21, 2024. [Online]. Available: https://www.scopus.com/record/display.uri?eid=2-s2.0-85100220675&origin=inward&txGid=385068f1417f7b1eb48c6ec99b484084.
N. Casutt and N. Ebert, “Data protection officers: Figureheads of privacy or merely decoration?,” in Proceedings of the 16th European Conference on Management Leadership and Governance, ECMLG 2020, 2020, pp. 39–48. doi: 10.34190/ELG.20.021.
M. Chergui and A. Chakir, “IT GRC smart adviser: Process driven architecture applying an integrated framework,” Advances in Science, Technology and Engineering Systems, vol. 5, no. 6, pp. 247–255, 2020, doi: 10.25046/aj050629.
Cisco, “2024 Cisco Cybersecurity Readiness Index: Underprepared and overconfident companies tackle an evolving landscape,” 2024. [Online]. Available: https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cybersecurity-readiness-index-2024.html
Cloud Security Alliance, “An Analysis of the 2020 Zoom Breach | Csa. ” Accessed: January 26, 2024. [Online]. Available: https://cloudsecurityalliance.org/blog/2022/03/13/an-analysis-of-the-2020-zoom-breach/.
CNN Indonesia, “10 Kasus Kebocoran Data 2022: Bjorka Dominan, Ramai-ramai Bantah - Halaman 2.” Accessed: January 26, 2024. [Online]. Available: https://www.cnnindonesia.com/teknologi/20221230125430-192-894094/10-kasus-kebocoran-data-2022-bjorka-dominan-ramai-ramai-bantah/2.
L. Cocco and R. Tonelli, “Potentiality of self sovereign identities in smart grid,” IEEE Access, Feb. 05, 2025.
Council of the European Union, “General Data Protection Regulation,” 2016.
Data Privacy Manager, “20 biggest GDPR fines so far [2023] - Data Privacy Manager.” Accessed: May 06, 2024. [Online]. Available: https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-20201.
S. Dhar and I. Bose, “Securing IoT devices using zero trust and blockchain,” J. Org. Comput. Electron. Commer., vol. 31, no. 1, pp. 18–34, Jan. 2021.
U. Der, S. Jähnichen, and J. Sürmeli, “Self-sovereign identity–opportunities and challenges for the digital revolution,” arXiv preprint arXiv:1712.01767, Dec. 2017.
R. Dutta, A. Das, A. Dey, and S. Bhattacharya, “Blockchain vs GDPR in Collaborative Data Governance,” in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2020, pp. 81–92. doi: 10.1007/978–3-030-60816-3_10.
A. I. El-Zughaid, Z. A. Funousha, Y. A. Younis, and M. Y. Alghamdi, “A zero trust framework to secure IoT devices,” Univ. Ha’il-J. Sci. (UOHJS), vol. 5, no. 2, 2024.
E.-B. van Veen, “Observational health research in Europe: understanding the General Data Protection Regulation and underlying debate,” Eur J Cancer, vol. 104, pp. 70–80, 2018, doi: 10.1016/j.ejca.2018.09.032.
M. Firdaus, “A Review of Personal Data Protection Law in Indonesia,” 2021.
ForgeRock, “2023 ForgeRock Identity Breach Report,” 2023.
Gartner, “Definition of IT Governance (ITG) - IT Glossary.” Accessed: January 26, 2024. [Online]. Available: https://www.gartner.com/en/information-technology/glossary/it-governance.
G. Mangalaraj, A. Singh, and A. Taneja, “IT governance frameworks and COBIT - A literature review,” 20th Americas Conference on Information Systems, AMCIS 2014, Jan. 2014.
W. Gunawan, E. P. Kalensun, and A. N. Fajar, “Applying COBIT 5 in Higher Education,” in IOP Conference Series: Materials Science and Engineering, 2018. doi: 10.1088/1757-899X1420/1/012108.
S. Haes, W. Grembergen, A. Joshi, and T. Huygh, “COBIT as a Framework for Enterprise Governance of IT,” 2020, pp. 125–162. doi: 10.1007/978-3-030-25918-1_5.
M. Hasan, “Enhancing enterprise security with zero trust architecture,” arXiv preprint arXiv:2410.18291, Oct. 2024.
Y. He, D. Huang, L. Chen, Y. Ni, and X. Ma, “A survey on zero trust architecture: Challenges and future trends,” Wireless Commun. Mobile Comput., vol. 2022, no. 1, p. 6476274, 2022.
I. Hamzane and B. Abdessamad, “A built-in criteria analysis for best IT governance framework,” International Journal of Advanced Computer Science and Applications, vol. 10, no. 10, pp. 185–190, 2019, [Online]. Available: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85075735916&partnerID=40&md5=50df938a908a51266d741d5894f74d51.
M. James, T. Newe, D. O'Shea, and G. D. O'Mahony, “Authentication and authorization in zero trust IoT: A survey,” in Proc. 35th Irish Signals Syst. Conf. (ISSC), Jun. 2024, pp. 1–7.
ISACA, “The COBIT Framework Timeline | Infographic.” Accessed: January 26, 2024. [Online]. Available: https://www.isaca.org/resources/infographics/the-cobit-framework-timeline.
C. Itodo and M. Ozer, “Multivocal literature review on zero-trust security implementation,” Computers & Security, Mar. 2024, Art. no. 103827.
H. Kang, G. Liu, Q. Wang, L. Meng, and J. Liu, “Theory and application of zero trust security: A brief survey,” Entropy, vol. 25, no. 12, p. 1595, Nov. 2023.
B. Kitchenham and S. Charters, “Guidelines for performing Systematic Literature Reviews in Software Engineering,” vol. 2, Jan. 2007.
Kompas.com, “Menanti Lahirnya Peraturan Pelaksana UU PDP Halaman all - Kompas.com.” Accessed: January 26, 2024. [Online]. Available: https://nasional.kompas.com/read/2023/07/3l/09l42581/menanti-lahirnya-peraturan-pelaksana-uu-pdp?page=all.
S. Li, M. Iqbal, and N. Saxena, “Future industry internet of things with zero-trust security,” Inf. Syst. Front., vol. 26, no. 5, pp. 1653–1666, Oct. 2024.
K. M. Nyandongo and N. Mxobo, “Assessing the effectiveness of IT governance practices when adopting cloud computing,” in Towards Sustainable Technologies and Innovation - Proceedings of the 27th Annual Conference of the International Association for Management of Technology, IAMOT 2018, 2018. [Online]. Available: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85085667995&partnerID=40&md5=17882db2df60ed169c2591ed1ae99ba7.
S. Northcutt, L. Zeltser, S. Winters, K. Kent, and R. W. Ritchey, Inside Network Perimeter Security (Inside). Sams, Mar. 2005.
Pemerintah Pusat Indonesia, “Undang Undang Dasar 1945.” Accessed: January 26, 2024. [Online]. Available: https://www.dpr.go.id/jdih/uu1945.
Pemerintah Pusat Indonesia, “Undang-Undang Nomor 27 Tahun 2022 Tentang Pelindungan Data Pribadi,” 2022.
D. Puspasari, A. Soegiharto, A. N. Hidayanto, and Q. Munajat, “Data Privacy, What Still Need Consideration in Online Application System?,” 2020.
T. Ramírez-Gordillo, A. Maciá-Lillo, F. A. Pujol, N. García-D'Urso, J. Azorín-López, and H. Mora, “Decentralized identity management for Internet of Things (IoT) devices using IOTA blockchain technology,” Future Internet, vol. 17, no. 1, Jan. 2025.
P. Rozehnal, V. Novák, and O. Grunt, “Analysis of COBIT framework inputs,” in IDIMT 2019: Innovation and Transformation in a Digital World - 27th Interdisciplinary Information Management Talks, 2019, pp. 161–167. [Online]. Available: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85071452720&partnerID=40&md5=c1e78eed175a6bbb72dc596934f322c1.
C. Saadouni, S. El Jaouhari, N. Tamani, S. Ziti, L. Mroueh, and K. El Bouchti, “Identification techniques in the Internet of Things: Survey, taxonomy and research frontier,” IEEE Commun. Surv. Tutor., Feb. 11, 2025.
S. D. Rosadi, Pembahasan UU Pelindungan Data Pribadi (UU RI No. 27 Tahun 2022). Penerbit Sinar Grafika, 2023.
M. B. Younes and S. Al-Zoubi, “The Impact of Technologies on Society: A Review,” IOSR Journal Of Humanities And Social Science (IOSR-JHSS, vol. 20, no. 2, 2015, doi: 10.979010837-20258286.
M. Spencer and D. Pizio, “The de-perimeterisation of information security: The Jericho Forum, zero trust, and narrativity,” Soc. Stud. Sci., vol. 54, no. 5, pp. 655–677, Oct. 2024.
V. Stafford, Zero Trust Architecture, NIST Special Publication 800-207, Aug. 2020.
N. F. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, and R. Doss, “Zero trust architecture (ZTA): A comprehensive survey,” IEEE Access, vol. 10, pp. 57143–57179, May 2022.
A. Tsohou, “Privacy, security, legal and technology acceptance elicited and consolidated requirements for a GDPR compliance platform,” Information and Computer Security, vol. 28, no. 4, pp. 531–553, 2020, doi: 10.1108/ICS-01-2020-0002.
T. Weingaertner and O. Camenzind, “Identity of things: Applying concepts from self-sovereign identity to IoT devices,” J. Brit. Blockchain Assoc., Feb. 24, 2021.
M. Spencer and D. Pizio, “The de-perimeterisation of information security: The Jericho Forum, zero trust, and narrativity,” Soc. Stud. Sci., vol. 54, no. 5, pp. 655–677, Oct. 2024.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2025 Suresh Ganpathy
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors retain the copyright of their articles published in this journal. All articles are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). This license permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are properly cited.