• Critical component of enterprise security, focusing on managing access to information
• Ensures the right individuals have access to the right resources at the right times for the right reasons

Four Main IAM Processes

Identification

• User claims an identity using a unique identifier (e.g., username or email address)
• ensures user legitimacy and accuracy of provided information

Authentication

• Verifies the identity of a user, device, or system

• Typically involves validating user credentials against an authorized user database

  Methods:

  1. Passwords
  2. Biometrics
  3. Multi-factor authentication

Authorization

• Determines the permissions or access levels for authenticated users
• Ensures users have access only to appropriate resources
• Role-based access control often used

Accounting (Auditing)

• Tracks and records user activities
  1. Logins
  2. Actions
  3. Changes
• Helps detect security incidents, identify vulnerabilities, and provide evidence in case of breaches

Key IAM Concepts

Provisioning and Deprovisioning of User Accounts

• Provisioning — Creating new user accounts, assigning permissions, and providing system acess
• Deprovisioning — Removing access rights when no longer needed (e.g., when an employee leaves)