Identity and Access Management

Introduction

Identity and Access Management (IAM) is the discipline of ensuring that the right people, devices, applications, and services obtain the right access to the right resources at the right time. IAM is central to cybersecurity because most attacks ultimately involve misuse of identity: stolen credentials, excessive privileges, compromised service accounts, weak authentication, or failures to remove access when a person changes role or leaves an organization.

IAM is commonly described through four related functions:

1. Identification: claiming an identity, such as entering a username.
2. Authentication: proving that the claimed identity is genuine.
3. Authorization: determining what an authenticated identity may do.
4. Accounting: recording and reviewing what the identity did.

These functions are distinct. A user may identify as aisha.rahman, authenticate successfully with a password and security key, receive authorization to read financial records, and have that access recorded in an audit log. Confusing these functions creates security weaknesses. Authentication does not automatically mean authorization, and authorization without accounting makes misuse difficult to detect.

Learning Objectives

By the end of this chapter, you should be able to:

• distinguish identification, authentication, authorization, and accounting;
• explain authentication factors and evaluate passwords, multifactor authentication, and biometrics;
• describe single sign-on and federation;
• apply role-based access control and least privilege;
• explain privileged access management and identity lifecycle controls;
• recognize IAM risks, governance responsibilities, and implementation practices.

1. The IAM Security Model

Identification

Identification is the presentation of an identity claim. Examples include a username, email address, employee number, device identifier, or service account name. Identification alone provides no proof. Anyone may claim to be another user.

Identities can represent:

• human users;
• organizations or tenants;
• devices and endpoints;
• applications and workloads;
• automated services and APIs.

A modern IAM program must therefore manage both human identities and non-human identities. Service accounts, API keys, certificates, and workload identities can have extensive privileges and are often overlooked.

Authentication

Authentication verifies an identity claim. Authentication evidence is generally grouped into factors:

Strictly speaking, multifactor authentication requires evidence from two or more different factor categories. Entering a password and answering a security question usually remains one-factor authentication because both are knowledge factors. A password plus a hardware security key uses two different categories.

Authorization

Authorization determines which operations an authenticated identity may perform on a resource. Typical operations include read, create, modify, delete, approve, execute, or administer. Authorization decisions may depend on the identity, role, resource, requested action, device, time, location, and risk level.

A useful principle is least privilege: grant only the access necessary for an approved task, for only as long as it is necessary. Least privilege reduces the damage caused by compromised accounts and accidental actions.

Accounting and Accountability

Accounting records identity-related activity. Logs may include the identity used, time, source device, resource, operation, result, and administrative changes. Accounting supports:

• incident investigation;
• compliance reporting;
• fraud detection;
• capacity and usage analysis;
• accountability and deterrence.

Logs must be protected against unauthorized alteration, retained for an appropriate period, and reviewed. Recording events without examining them does not provide effective monitoring.

2. Authentication Methods

Passwords and Passphrases

Passwords remain common because they are inexpensive and easy to deploy, but they are vulnerable to phishing, reuse, guessing, credential stuffing, malware, and database breaches. A password database should not store passwords in plaintext. Instead, systems should use a dedicated password-hashing function with a unique salt for each password. A salt is a random value stored with the password hash; it prevents identical passwords from producing identical stored values and reduces the usefulness of precomputed tables.

Good password practice includes:

• allowing long passwords and passphrases;
• blocking known breached or commonly used passwords;
• avoiding arbitrary frequent resets that encourage predictable variations;
• using rate limiting and account lockout carefully;
• storing passwords with a modern, deliberately slow password-hashing scheme;
• supporting password managers;
• never transmitting passwords unnecessarily or storing them in plaintext.

Password length generally provides more resistance to guessing than complex but short patterns. Organizations should combine strong password handling with phishing-resistant multifactor authentication rather than relying on passwords alone.

Multifactor Authentication

Multifactor authentication (MFA) requires multiple independent factors. Examples include:

• password plus a hardware security key;
• password plus an authenticator application code;
• smart card plus a PIN;
• biometric verification plus a device-bound cryptographic key.

MFA substantially reduces the value of a stolen password, although it does not eliminate all risk. Attackers may use phishing proxies, social engineering, malware, session theft, or push-notification fatigue. Number-matching prompts, rate limits, risk-based controls, and phishing-resistant standards improve protection.

One-time codes sent by text message are generally weaker than security keys because telephone numbers can be attacked through interception, SIM-swap fraud, or social engineering. They may be useful as a transitional method but should not be treated as the strongest available control.

Biometrics

Biometric authentication uses physical or behavioral characteristics. Advantages include convenience and resistance to casual sharing. Limitations include false matches, false rejections, sensor attacks, privacy concerns, and the fact that biometric traits cannot be changed like passwords if compromised.

A biometric system should normally be designed so that biometric data is used locally to unlock a device-held credential, rather than sending a centrally stored image of a fingerprint or face for every login. Biometric matching is probabilistic, so organizations must define acceptable error rates and provide secure alternatives for users who cannot or do not wish to use a particular biometric method.

Cryptographic and Phishing-Resistant Authentication

Security keys and passkeys use public-key cryptography. During enrollment, a device creates a private key and corresponding public key. The service stores the public key; the private key remains protected by the authenticator. During login, the authenticator signs a challenge, and the service verifies the signature. A captured response cannot normally be reused because the challenge is fresh.

This design reduces exposure to password theft and helps bind authentication to the legitimate website or service. It is particularly valuable for administrators, remote access, email, and other high-impact systems.

3. Single Sign-On and Federation

Single sign-on (SSO) allows a user to authenticate once and access multiple approved applications without separately entering credentials into each application. SSO improves usability and can reduce password reuse, but it creates concentration risk: compromise of the central identity provider may affect many services. Strong MFA, careful session management, recovery controls, and monitoring are therefore essential.

Federation is the establishment of trust between separate security domains. An identity provider authenticates the user and communicates an assertion or token to a relying application, often called a service provider. The application trusts the identity provider under defined technical and governance conditions.

Common federation technologies include:

• SAML, widely used for browser-based enterprise SSO;
• OpenID Connect, an identity layer built on OAuth 2.0;
• OAuth 2.0, primarily an authorization framework for delegated access rather than an authentication protocol by itself.

Federation requires agreement about identifier formats, claims, signing keys, audience restrictions, token lifetime, logout behavior, and incident response. A token should communicate only the claims needed by the receiving application. Excessive claims increase privacy and security exposure.

4. Authorization Models

Access Control Lists

An access control list (ACL) associates a resource with permitted subjects and operations. For example, a file may allow a finance group to read and modify it while allowing auditors to read it only. ACLs are direct and useful for individual resources, but they can become difficult to administer at scale.

Role-Based Access Control

Role-based access control (RBAC) assigns permissions to roles and assigns users to roles. A role might be Help Desk Analyst, Payroll Specialist, or Database Administrator. RBAC reduces the need to configure permissions separately for every user and supports job-function alignment.

A simplified RBAC relationship is:

RBAC requires disciplined role design. Poorly designed roles can accumulate permissions, produce excessive access, or create “role explosion.” Roles should be reviewed, documented, and linked to actual responsibilities. Separation of duties may require that no single role can both create and approve a sensitive transaction.

Attribute- and Policy-Based Access

Attribute-based access control (ABAC) evaluates attributes such as department, clearance, device health, data classification, location, and time. A policy might state: “A payroll employee may read payroll records from a managed device during approved working conditions.”

ABAC can express context-sensitive decisions more precisely than basic RBAC, but it depends on accurate attributes, reliable policy evaluation, and understandable governance. Many organizations use a hybrid approach: RBAC supplies broad job permissions while attributes and risk signals refine the decision.

Zero Trust Perspective

Zero Trust is an architectural approach in which access is not granted merely because a user is inside a network. Each request is evaluated using identity, device, application, resource, and contextual signals. The approach emphasizes continuous verification, least privilege, segmentation, and explicit policy decisions. Zero Trust does not mean that trust is impossible; it means that trust is not assumed solely from network location.

5. Privileged Access Management

Privileged accounts can change configurations, create identities, disable security controls, access sensitive data, or control infrastructure. Examples include domain administrators, cloud organization administrators, database administrators, root accounts, and emergency “break-glass” accounts.

Privileged Access Management (PAM) reduces the risk associated with these accounts through controls such as:

• separate administrative accounts rather than using administrator rights for daily work;
• just-in-time and time-limited elevation;
• approval workflows for sensitive actions;
• password vaulting and automated credential rotation;
• session recording and command logging;
• restrictions on administrative workstations;
• emergency accounts protected by strong controls and tested procedures;
• regular review of privileged group membership.

PAM should not become a single high-value repository without appropriate resilience and monitoring. Its own administrators require strong authentication, separation of duties, and independent oversight.

6. Identity Lifecycle Management

An identity is not static. It moves through a lifecycle:

1. Joiner: identity creation, verification, initial access, and training.
2. Mover: role or department change, requiring access adjustment.
3. Leaver: prompt disabling of accounts, recovery of assets, and termination of sessions.
4. Periodic review: confirmation that access remains appropriate.

Identity governance connects human-resources, contractor, student, and asset records with IAM systems. Automated provisioning can reduce delays and errors, but automation must be based on accurate authoritative data. A terminated worker whose HR record is not updated can retain access; conversely, an incorrect job record can remove necessary access.

Lifecycle controls should address:

• identity proofing before account creation;
• unique identifiers and prevention of duplicate accounts;
• approval of access requests;
• documented owners for applications and roles;
• periodic access certification;
• immediate or scheduled deprovisioning according to risk;
• recovery of tokens, keys, badges, and devices;
• service-account ownership, rotation, and retirement;
• archival or deletion consistent with legal and business requirements.

Dormant accounts, shared accounts, orphaned accounts, and excessive entitlements are warning signs. Shared accounts weaken accountability and should be avoided except where technically necessary and tightly controlled.

7. A Practical IAM Implementation Framework

A small organization can develop IAM systematically:

Step 1: Inventory identities and resources

Identify users, devices, service accounts, applications, data stores, privileged groups, and external partners. Assign owners to important resources.

Step 2: Classify risk

Prioritize systems containing sensitive data, administrative functions, financial transactions, safety functions, or broad connectivity. Stronger controls should protect higher-impact systems.

Step 3: Establish authoritative identity data

Define which system provides reliable employment, student, contractor, and organizational information. Document who may approve changes.

Step 4: Implement baseline authentication

Require strong passwords where passwords remain necessary, deploy MFA, and prioritize phishing-resistant methods for administrators and high-value systems.

Step 5: Design authorization

Use least privilege, well-defined roles, separation of duties, and context-aware policies where appropriate. Avoid granting broad access merely because it is convenient.

Step 6: Protect privileged access

Separate administrative identities, introduce time-limited elevation, secure emergency access, and monitor privileged activity.

Step 7: Monitor and review

Collect authentication, authorization, provisioning, and administrative logs. Review unusual events such as impossible travel, repeated failures, new privileged assignments, and access outside normal patterns.

Step 8: Test recovery and deprovisioning

Run exercises for lost devices, compromised accounts, employee termination, identity-provider outage, and recovery of emergency accounts. A policy that has never been tested may fail when needed.

8. Illustrative Case: Northbridge College

Background

Northbridge College uses separate usernames and passwords for its learning platform, payroll system, virtual private network, and library services. Students and employees frequently reuse passwords. IT staff maintain several shared administrator accounts, and terminated contractors are sometimes disabled days after departure.

Problem

A phishing campaign captures employee passwords. Attackers use password reuse to enter the VPN and then access internal applications. Investigation is difficult because shared administrator accounts do not identify individual users.

Analysis

The college has weaknesses in all four IAM functions. Identification is inconsistent across systems. Authentication depends mainly on passwords. Authorization is broad and is not regularly reviewed. Accounting is incomplete because logs cannot reliably connect actions to individuals.

Approach

The college establishes a central identity provider and adopts SSO with MFA. Administrators receive separate named accounts and phishing-resistant security keys. Application access is assigned through roles such as Student, Faculty, Payroll Officer, and System Administrator. Payroll access requires a managed device. A PAM system provides temporary administrative elevation and records sessions.

HR termination events trigger immediate account suspension, while application owners conduct quarterly access reviews. Service accounts are assigned owners, restricted to defined systems, and reviewed for continued need. Security logs are centralized and alerts are created for unusual authentication and privileged changes.

Outcome

Password reuse decreases, administrative activity becomes attributable to named individuals, and terminated accounts are disabled more quickly. The college still retains residual risks, including phishing, identity-provider outage, and incorrect role assignments. These are addressed through awareness training, tested recovery procedures, policy review, and periodic technical assessment.

Learning Points

The case demonstrates that IAM is not merely a login technology. Effective IAM combines identity data, authentication, authorization, lifecycle governance, privileged access management, monitoring, and accountability.

9. Challenges, Ethics, and Governance

IAM decisions affect privacy, fairness, accessibility, and employment relationships. Excessive monitoring can create unjustified surveillance. Biometric systems raise concerns about consent, retention, secondary use, and irreversible compromise. Automated risk scoring may disadvantage users because of inaccurate data or biased models. Organizations should collect only necessary information, explain important decisions, provide correction and appeal processes, and protect sensitive identity data.

Governance should define:

• who owns identities and applications;
• who approves access;
• how conflicts of interest are managed;
• how long logs and identity records are retained;
• how suppliers and partners are trusted;
• how incidents involving credentials are reported;
• how legal, contractual, and sector-specific obligations are met.

IAM controls should be usable. If security processes are excessively difficult, users may bypass them, share credentials, or create unapproved workarounds. Good design combines security with accessibility, clear recovery processes, and support for users with disabilities.

10. Contemporary Developments

Cloud services have expanded federation, conditional access, and identity-as-a-service. Workload identity, short-lived credentials, secrets management, and software supply-chain security are increasingly important because automated systems can possess broad permissions.

Passkeys and hardware-backed credentials are gaining adoption as alternatives to passwords. Continuous and adaptive authentication uses changing context, such as device posture and anomalous behavior, to adjust access decisions. However, adaptive systems should supplement—not silently replace—clear policy, human oversight, and reliable recovery.

Artificial intelligence can help detect anomalous sign-ins, identify privilege accumulation, classify access requests, and summarize audit events. It can also generate false positives, encode bias, expose sensitive data, or be manipulated by attackers. AI-assisted IAM should therefore use verified data sources, documented decision rules, human review for consequential decisions, audit trails, and controlled permissions for the AI system itself.

Best Practices Checklist

• Use unique identities and prohibit unnecessary shared accounts.
• Enable MFA, prioritizing phishing-resistant methods.
• Apply least privilege and separation of duties.
• Use SSO with strong protection for the identity provider.
• Design roles around real job functions and review them regularly.
• Separate administrative accounts from ordinary user accounts.
• Use PAM for high-impact privileges.
• Automate joiner, mover, and leaver processes from authoritative records.
• Protect passwords with modern salted password hashing.
• Log authentication, authorization, provisioning, and privileged activity.
• Monitor logs and test incident-response procedures.
• Minimize biometric and personal data collection.
• Test emergency access, outages, recovery, and deprovisioning.

Chapter Summary

Identity and Access Management provides the foundations for controlling digital access. Identification states who or what is requesting access; authentication verifies the claim; authorization determines permitted actions; and accounting records activity for accountability. Passwords remain common but should be strengthened through secure storage, password managers, rate limiting, and MFA. Phishing-resistant cryptographic authenticators provide particularly strong protection, while biometrics are best understood as a convenient local unlocking mechanism with privacy and recovery considerations.

SSO improves usability and centralizes control, while federation extends trust across organizational boundaries. Authorization models include ACLs, RBAC, ABAC, and hybrid policy approaches. Least privilege, separation of duties, Zero Trust principles, and PAM limit the damage that compromised accounts can cause. Identity lifecycle management ensures that access is created, changed, reviewed, and removed as people and systems change. Effective IAM also requires monitoring, governance, ethical safeguards, usable processes, and tested recovery.

Key Terms

Identification: Claiming or presenting a digital identity.

Authentication: Verifying that an identity claim is genuine.

Authorization: Determining what an authenticated identity may access or do.

Accounting: Recording and reviewing identity-related activity.

Identity provider: A system that authenticates identities and issues assertions or tokens.

Multifactor authentication: Authentication using evidence from at least two different factor categories.

Phishing-resistant authentication: Authentication designed to resist credential capture through techniques such as origin-bound cryptographic challenges.

Biometrics: Authentication using physical or behavioral characteristics.

Single sign-on: Access to multiple approved applications after one authentication event.

Federation: Trust between separate identity or security domains.

Access control list: Resource-level list of subjects and permitted operations.

Role-based access control: Assigning permissions to roles and users to roles.

Attribute-based access control: Making access decisions using attributes and policies.

Least privilege: Granting only the access necessary for an approved task.

Separation of duties: Dividing sensitive responsibilities among different people or roles.

Privileged access management: Controls for securing, limiting, monitoring, and governing high-impact accounts.

Identity lifecycle: The creation, modification, review, and removal of an identity and its access.

Service account: A non-human account used by an application, service, or automated process.

Audit log: A protected record of events used for monitoring and investigation.

Zero Trust: An approach that requires explicit, context-aware verification rather than relying on network location.

Review Questions

5 Short Answer Questions

1. Distinguish identification from authentication.
2. What makes an authentication method multifactor?
3. State two benefits and one risk of single sign-on.
4. Define least privilege.
5. Why are shared administrator accounts a security concern?

5 Long Answer Questions

1. Explain the relationship among identification, authentication, authorization, and accounting using an organizational example.
2. Compare passwords, authenticator applications, security keys, and biometrics as authentication methods.
3. Explain how RBAC and ABAC differ and why an organization might combine them.
4. Describe the main controls that should be included in a privileged access management program.
5. Explain joiner, mover, and leaver processes and the risks created by poor lifecycle management.

3 Analytical / Application Questions

1. A company has strong passwords but no MFA, broad administrator groups, and no quarterly access reviews. Analyze its major IAM risks and propose a prioritized improvement plan.
2. Design an IAM approach for a college that uses cloud applications, contractors, student workers, and sensitive payroll data. Justify your authentication, authorization, lifecycle, and monitoring choices.
3. An AI system flags an employee’s login as high risk because of an unusual location. Analyze how the organization should respond while balancing security, privacy, accuracy, and fairness.

Multiple Choice Questions with Answers

Question 1

Which IAM function determines whether an authenticated user may modify a file?

A. Identification

B. Authentication

C. Authorization

D. Accounting

Correct Answer: C. Authorization

Question 2

Which combination is an example of multifactor authentication?

A. Password and security question

B. Password and hardware security key

C. Two different passwords

D. Username and email address

Correct Answer: B. Password and hardware security key

Question 3

What is the primary purpose of a unique password salt?

A. To make passwords visible to administrators

B. To prevent identical passwords from producing identical stored hashes

C. To allow passwords to be recovered in plaintext

D. To eliminate the need for password hashing

Correct Answer: B. To prevent identical passwords from producing identical stored hashes

Question 4

Which authorization model assigns permissions to job-function roles?

A. RBAC

B. Biometric authentication

C. Federation

D. Accounting

Correct Answer: A. RBAC

Question 5

What is a major risk of single sign-on?

A. It prevents centralized policy enforcement

B. It requires every application to use a different password

C. Compromise of the identity provider may affect many applications

D. It eliminates the need for authentication

Correct Answer: C. Compromise of the identity provider may affect many applications

Question 6

Which control is most closely associated with privileged access management?

A. Permanent administrator rights for all employees

B. Time-limited administrative elevation

C. Disabling audit logs

D. Using shared administrator accounts

Correct Answer: B. Time-limited administrative elevation

Question 7

What should normally happen when an employee leaves an organization?

A. Access should remain active for convenience

B. Only the email password should be changed

C. Identity access should be promptly disabled and assets or credentials recovered

D. The account should be renamed and reused

Correct Answer: C. Identity access should be promptly disabled and assets or credentials recovered

Question 8

Which statement about OAuth 2.0 is most accurate?

A. It is primarily an authorization framework for delegated access

B. It is a biometric standard

C. It is a password-hashing algorithm

D. It is a hardware security key

Correct Answer: A. It is primarily an authorization framework for delegated access

Question 9

Which principle requires granting only the access needed for a task?

A. Federation

B. Least privilege

C. Password reuse

D. Token replay

Correct Answer: B. Least privilege

Question 10

Why are named administrator accounts preferable to shared administrator accounts?

A. They remove the need for authorization

B. They improve individual accountability in audit records

C. They guarantee that phishing cannot occur

D. They allow unlimited privileges without monitoring

Correct Answer: B. They improve individual accountability in audit records