The purpose of this article is to share the key concepts of identity and access management for beginners. Identity and Access Management have key concepts that one should learn about in order to better and more effectively understand how Identity and Access Management play a role within their security posture. This blog post explores several key concepts that make up an identity and access management solution. When assessing different products and vendors, these key concepts will be part of the evaluation.
Identity & Access Management 101: Authentication
Authentication is the mechanism which proves an entity is who they say they are; it confirms the identity with a shared secret, or password. When authenticating an entity, the user name is the identity that is being authenticated, and the password is the mechanism which proves the entity is who they say they are. An example of this is when a person logs into a cloud based application and is prompted for a user name and password. If the user provides correct credentials, the identity management system knows what they have access to.
Multi-factor Authentication
Due to brute force attacks and compromised login credentials spreading over the dark web, a more robust way of authenticating has been developed. This way of authenticating is based on something you know, something you have, and/or something you are. An example of something you know is a password; an example of something you have is your mobile device; and an example of something you are is your finger print, retina, or voice. Adding a secondary factor for authentication exponentially increases the security of authentication.
IAM for Beginners: Authorization
Authorization means what do I as a user have authorization to access? This can be a specific set of folders in a directory, applications, or ability to make changes within a system, such as the permission levels of other users or making configuration changes on a network device. Authorization is given after authentication has occurred.
Role Based Identity
Managing identity and access by roles is more simple and less complex than managing access by the individual. Individuals change roles and have access to different things during the duration of the identity life-cycle. An example of this is when a person in sales moves to billing and now has both the capability to generate a quote and bill for it. This is not an ideal situation because it can lead to fraud. You would also not want to have someone move into another department from HR and still have access to sensitive HR files. Role based identity is able to simplify the process by assigning users to roles and giving access to roles, thus giving users access by the roles they occupy.
Directory
Directory stores, or directory services contain all the roles, authorization, and data that a user would access. This store can be a virtual directory which federates identity data across a multitude of applications and services into one single directory that is managed by the identity and access management system. This is becoming more and more important as organizations continue to move away from on premise applications into cloud based applications where identities are dispersed across several different sources. Directory services can simplify the management of identities and access across data and applications.
IAM for Beginners: Single Sign On
Due to the multitude of applications that users work with on a daily basis, and the amount of credentials they have to manage, single sign on was developed to reduce the complexity of changing credentials and having to remember different passwords for different applications. Single Sign On enables the end user to access all applications by using one password and managing the password complexity and change requirements on the back end. This enables the user to only need to manage one login credential, reducing password reset requests and loss of productivity due to being locked out of systems needed to perform job duties.
Provisioning and De-Provisioning
Provisioning and De-Provisioning automate and manage the life-cycle of identities. This is the concept that automatically manages moves, adds, changes, and revocation. When a new user is brought on board, provisioning takes care of adding all the access to the applications the user needs to perform their job and only provides them with those applications and data and nothing else. Additionally, when that employee is terminated, the provisioning system will automatically revoke that users access and disable their access across all applications, services, and data. Furthermore, when that employee moves to a new role, all the applications and data they had access to are revoked and new applications and data are assigned.
Identity and Access Management Concept Review
These concepts provide a foundation of Identity and Access Management and do not provide a full scope of what identity and access management solutions can provide. These concepts should be reviewed when considering an implementation of an IAM system in order to make sure that the foundation is set properly and that the project is set up for long term success.