Key Takeaways
- Identity is the new security perimeter
- MFA everywhere is non-negotiable
- Least privilege limits blast radius
- PAM protects privileged access
Contents
1. IAM Fundamentals
Identity and Access Management ensures the right people have the right access to the right resources at the right time. It encompasses authentication (who you are) and authorization (what you can do).
2. Authentication Methods
Authentication Factors
- Knowledge: Passwords, PINs, security questions
- Possession: Phone, hardware token, smart card
- Inherence: Fingerprint, face, iris (biometrics)
- Context: Location, device, time, behavior
3. Multi-Factor Authentication
# MFA strength hierarchy (strongest to weakest):
1. Hardware security keys (FIDO2/WebAuthn)
2. Authenticator apps (TOTP)
3. Push notifications
4. SMS/Voice OTP (vulnerable to SIM swap)
5. Email OTP
# Passwordless options:
- FIDO2 security keys
- Windows Hello for Business
- Passkeys
- Certificate-based auth4. Single Sign-On (SSO)
- SAML 2.0: Enterprise SSO standard
- OIDC: Modern OAuth 2.0-based SSO
- Benefits: Better UX, centralized control
- Risk: Single point of compromise
5. Access Control Models
# Role-Based Access Control (RBAC)
# Users → Roles → Permissions
User: john.doe
Role: Sales Manager
Permissions: Read CRM, Edit Opportunities
# Attribute-Based Access Control (ABAC)
# Policy-based, contextual decisions
IF user.department = "Finance"
AND resource.classification = "Financial"
AND time.hour BETWEEN 9 AND 18
THEN allow
# Least Privilege Principle
# Grant minimum access needed
# Review and revoke regularly6. Privileged Access Management
- Password vault: Secure credential storage
- Session recording: Audit privileged actions
- Just-in-time access: Temporary elevation
- Approval workflows: Request-based access
- Solutions: CyberArk, BeyondTrust, Delinea
7. Identity Lifecycle
- Provisioning: Create accounts, assign access
- Access requests: Self-service with approvals
- Reviews: Regular access certifications
- Deprovisioning: Remove access on termination
8. IAM Solutions
| Category | Solutions |
|---|---|
| IdP | Okta, Azure AD, Ping Identity |
| PAM | CyberArk, BeyondTrust, Delinea |
| IGA | SailPoint, Saviynt |
| CIAM | Auth0, ForgeRock |
FAQ
Should we go passwordless?
Yes, passwordless authentication with FIDO2/passkeys is more secure and provides better user experience. Start with high-risk users and expand gradually.