Identity and Access Management (IAM)

Authentication is the process of verifying the identity of a user, device, or system entity. It answers the question "Who are you?" and is the first gate in the IAM process.

• Primary Methods: Passwords, biometrics, hardware security keys, and one-time passcodes (OTP).
• Modern Standards: Protocols like OAuth 2.0, OpenID Connect (OIDC), and Security Assertion Markup Language (SAML) enable federated authentication and Single Sign-On (SSO).
• Contextual Factors: Advanced systems use multi-factor authentication (MFA) and evaluate risk signals like device posture, location, and time of access.

Authorization determines what an authenticated identity is allowed to do. It answers the question "What are you allowed to access?" by evaluating policies against the request.

• Core Models:
  • Role-Based Access Control (RBAC): Permissions are assigned to roles, and users are assigned roles.
  • Attribute-Based Access Control (ABAC): Access is granted based on dynamic attributes of the user, resource, action, and environment.
• Policy Enforcement: The Policy Decision Point (PDP) evaluates requests against policy rules, and the Policy Enforcement Point (PEP) executes the allow/deny decision at the resource gateway.

Identity Governance and Administration is the policy and process layer that manages the complete identity lifecycle, ensures compliance, and provides oversight.

• Key Functions:
  • Provisioning/De-provisioning: Automated creation, updating, and removal of user accounts and access rights (Joiner-Mover-Leaver processes).
  • Access Certification: Periodic review and attestation of user access by managers or data owners.
  • Role Management: Defining and maintaining the business-aligned roles used in RBAC.
  • Audit and Reporting: Generating logs and reports for compliance (e.g., SOX, GDPR) and security audits.

Privileged Access Management is a subset of IAM focused on securing, monitoring, and controlling access for highly powerful accounts used by administrators, systems, and services.

• Core Capabilities:
  • Vaulting: Storing privileged credentials (like SSH keys or admin passwords) in a secure, encrypted vault.
  • Just-In-Time Access: Elevating privileges for a limited time and specific task, adhering to the least privilege principle.
  • Session Monitoring and Recording: Full keystroke and video logging of privileged sessions for audit and forensic analysis.
• Targets: Root accounts, service accounts, database administrators, and network devices.

A directory service is the central repository (the 'source of truth') that stores and organizes identity information and enables lookup and authentication services across a network.

• Primary Function: Stores core identity attributes like usernames, group memberships, and device profiles.
• Common Protocols: Lightweight Directory Access Protocol (LDAP) and Active Directory (AD) are the dominant standards for on-premises directories.
• Cloud Evolution: Modern systems use cloud-native directories (e.g., Azure AD, Okta Universal Directory) or hybrid sync tools to bridge on-prem and cloud environments.

The audit and analytics component provides visibility, detection, and insights into all identity-related events and access patterns, which is critical for security and compliance.

• Logging: Captures immutable records of authentication attempts, authorization decisions, privilege escalations, and administrative changes.
• Security Information and Event Management (SIEM) Integration: IAM logs are fed into SIEM systems for correlation and threat detection.
• User and Entity Behavior Analytics (UEBA): Uses machine learning to establish behavioral baselines and flag anomalous activities, such as impossible travel or unusual data access patterns, which may indicate a compromised account.

Role-Based Access Control (RBAC) is an access control model where permissions to perform operations on system resources are assigned to roles, not individual users. Users are then made members of roles, inheriting their permissions. This centralizes policy management and simplifies auditing.

• Core Components: Roles, permissions, user-role assignments, and role-permission assignments.
• Enterprise Use: Ideal for organizations with stable, well-defined job functions (e.g., 'Developer', 'Finance Analyst', 'Auditor').
• Limitation: Can be inflexible for dynamic, attribute-based access decisions.

Attribute-Based Access Control (ABAC) is a dynamic model that grants access by evaluating policies against attributes of the user, resource, action, and environment. Access decisions are made in real-time based on these contextual attributes.

• Key Attributes: User department, resource sensitivity, time of day, location, and project affiliation.
• Policy Language: Uses standards like XACML (eXtensible Access Control Markup Language) to define complex rules.
• Advantage: Enables fine-grained, context-aware security policies (e.g., 'A consultant can access project files only during business hours from the corporate network').

Single Sign-On (SSO) is an authentication process that allows a user to access multiple, independent applications or systems after a single initial login. It improves user experience and centralizes authentication logic and logging.

• Underlying Protocols: Commonly implemented using SAML 2.0, OpenID Connect (OIDC), or Kerberos.
• Architecture: Relies on a central Identity Provider (IdP) that authenticates the user and issues a security token to the Service Provider (SP).
• Security Benefit: Reduces password fatigue and the attack surface associated with multiple credential stores.

Privileged Access Management (PAM) is a subset of IAM focused on controlling, monitoring, and securing elevated ('privileged') access for human and machine identities. This includes administrator accounts, service accounts, and secrets used by applications.

• Core Capabilities: Just-in-time access provisioning, session monitoring and recording, credential vaulting, and automated rotation of secrets.
• Principle of Least Privilege: Enforces this by granting elevated permissions only when needed and for the shortest duration required.
• Critical For: Protecting root accounts, database admins, and CI/CD pipeline secrets from misuse and insider threats.

Zero Trust is a security model centered on the principle of 'never trust, always verify.' It assumes no implicit trust is granted to assets or user accounts based solely on their physical or network location. Every access request must be authenticated, authorized, and encrypted.

• Core Tenets: Explicit verification, least-privilege access, and assume breach.
• IAM's Role: IAM is the enforcement engine for Zero Trust, providing the continuous authentication and granular authorization decisions.
• Implementation: Relies heavily on strong identity verification, micro-segmentation, and real-time policy evaluation.

These are the two primary entities in a federated identity model.

• Identity Provider (IdP): A system that creates, maintains, and manages identity information and provides authentication services. Examples include Okta, Azure AD, and Ping Identity. It asserts a user's identity to other applications.
• Service Provider (SP): An application or service that relies on the IdP for authentication. The SP trusts the identity assertions (like a SAML response or OIDC ID Token) from the IdP to grant access.

This federation decouples authentication from application logic, enabling SSO and centralized user lifecycle management.