Identity and Access Management (IAM)

Identity and Access Management (IAM)

• IAM is a cybersecurity discipline focused on how users access digital resources and what actions they can perform.
• IAM systems prevent unauthorized access.
• IAM ensures each user has the precise permissions required for their job.
• The average corporate network covers human users (employees, customers, contractors) and nonhuman users (bots, IOT, endpoint devices, and automated workloads).
• Remote work and cloud computing have made users and resources more dispersed.
• Organizations struggle to track user activity across diverse environments.
• Lack of control creates security risks, including undetected hackers and malicious insiders.
• IAM initiatives streamline access control and secures assets.
• IAM systems assign digital identities that are unique to each user with permissions to the users role.
• IAM ensures the appropriate users access the right resources and blocks unauthorized access.
• The purpose of IAM is to prevent unauthorized access while allowing authorized access to the resources they need.
• IAM implementations consist of tools and strategies.
• Typical IAM systems include a database or directory containing user details and permissions.
• IAM systems verify user identities, track actions, and enforce authorized activities.

Core Components of IAM Initiatives

• Identity lifecycle management involves creating and maintaining digital user identities.
• Organizations monitor activity and tailor permissions by differentiating users through digital identities.
• Digital identities consist of attributes such as name, login credentials, job title, and access rights.
• Digital identities are housed in a central database or directory.
• IAM systems use this information to validate users and regulate actions.
• Distinct digital identities facilitate user tracking and granular access policies.
• IAM enables specified system permissions to users.
• Many IAM systems use role-based access control (RBAC).
• RBAC bases user privileges on job function and responsibility level.
• RBAC streamlines permission settings and mitigates the risks of high level privileges.
• Authentication and authorization are how IAM systems implement access control policies.
• Authentication confirms a user's claimed identity, to be either human or nonhuman.
• Users submit credentials to prove their identity when logging in or requesting access.
• Multi-Factor Authentication (MFA) needs users to prove their identity.
• MFA needs two or more verification steps.
• Common MFA factors include security codes sent to phones, physical security keys, or biometric scans.
• Single sign-on (SSO) enables access to multiple apps and services with a single login.
• The SSO portal authenticates users generate security certificate or token for resources.
• SSO systems use open protocols like SAML to freely exchange keys between service providers.
• Adaptive authentication, also called risk-based authentication, uses AI and machine learning.
• Adaptive authentication analyzes user behavior and adjusts authentication needs based on risk.
• Risk-based authentication schemes protect critical assets from hackers and insider threats.

Risk Management

• Cyber risk management identifies, prioritizes, manages, and monitors risks to systems.
• Cyber risk management has become a component of enterprise risk efforts.
• Companies depend on information technology, which exposes them to various threats.
• Threats can disrupt systems, leading to revenue loss, data theft, reputation damage, and fines.
• Cyber risk management methodologies include NIST Cybersecurity Framework (CSF) and NIST Risk Management Framework (RMF).
• These methods share a similar set of core steps.

Risk Framing

• Risk framing defines the context for risk decisions and aligns risk management with business strategies.
• Risk framing helps prevent mistakes and controls.
• Framing risk, companies define the scope of the data, inventory, priorities, and compliance needs.

Risk assessment

• Cybersecurity risk assessments identify threats, vulnerabilities, impacts and determine critical risks.
• Risk assessment depends on priorities, scope, and risk tolerance.
• Most assessments evaluate threats, vunerablities, and impacts.
• Threats can disrupt systems, steal data, or compromise security, including ransomware, phishing, employee mistake, or natural disasters.
• Vulnerabilities are flaws or weaknesses that threats can exploit: these include technical issues or weak policies.
• Impacts refer to the consequences of a threat, such as service disruption, data loss, email compromise attacks, or stolen PII.
• Companies use risk assessment results to decide responses to risks.
• Low-impact risks may be accepted if security measures are expensive.
• Likely and High impact risks are normally addressed.
• Risk mitigation uses controls to reduce the impact of exploitation, like intrusion-prevention systems and incident response plans.
• Risk remediation addresses vulnerabilities through patching or retiring vulnerable assets.
• Risk transfer involves shifting responsibility, often through cyber insurance policies.

Monitoring

• Organizations monitor security controls to assure they are working and are meeting regulatory compliance.
• Continuous surveillance allows companies to proactively and refine cybersecurity and risk management strategies.

Cryptography and Public Key Infrastructure (PKI)

• Data security and privacy are crucial for internet users so encryption is used to protect data.
• Public Key Infrastructure (PKI) is a common method of cryptography.
• PKI combines physical components, human procedures, and software to manage digital certificates.
• Cryptographic tools and signatures enable confidentiality, authentication, integrity, and non-repudiation.
• Confidentiality ensures only authorized users can access data.
• Authentication verifies the legitimacy of access requests.
• Integrity ensures data has not been altered.
• Non-repudiation prevents senders from denying authorship.
• PKI comprises a certification authority, a registration authority, and a central directory.
• These components distribute and validate the digital certificates.
• A Certification Authority (CA) issues and manages certificate, signs each certificate to verify its own authority.
• A Registration Authority (RA) interfaces between users/certificate holders and the CA.
• Central directory stores digital certificates and manages the certificate revocation list (CRL).
• Cryptography protects data using unreadable ways for security.
• There are two cryptography way, symmetric keys and asymmetric keys for many security processes.
• Symmetric encryption uses the same key encrypt and decrypt, only the recipient has this key to decrypt.
• Asymmetric encryption encrypts with the public key and decrypts the private key, only the recipient has the private key to decrypt.
• The Digital Signature ensures the message is from an author and the integrity of a messafe.
• It prevents senders from denying a sent message through non-repudiation.
• Digital signatures have algorithms and values, the hash function generates a hash value to show the signature.
• Any message changes will be shown if the different hash value shows up which validates it.
• Digital Certificates provide information about the certificate's subject, validity, applications, and services.
• Digital certificates identify the certificate holder and use cryptographic methods to stop someone impersonating someone else.
• Certificates are digitally signed by the CA to certify that they are the correct certificate.

IAM is a cybersecurity discipline focused on how users access digital resources. IAM systems assign digital identities that are unique to each user. IAM ensures the appropriate users access the right resources and blocks unauthorized access. The purpose of IAM is to prevent unauthorized access.