Identity, Access, Data Security, and Privacy

Introduction

Modern organizations depend on digital identities and data. Employees, contractors, customers, applications, devices, and automated agents all require access to information systems. If identities are poorly managed, unauthorized users may obtain access, legitimate users may retain unnecessary privileges, and sensitive information may be disclosed or altered. Cybersecurity management therefore requires more than installing technical controls: it requires governing who may access what, under which conditions, for what purpose, and for how long.

This chapter examines identity and access management (IAM), authentication, authorization, privileged access, federation, data classification, encryption, retention, data loss prevention (DLP), privacy principles, and privacy by design. These subjects are closely related. Identity establishes an actor’s digital representation; authentication verifies that representation; authorization determines permitted actions; data security protects information; and privacy governs the legitimate and ethical use of information about people.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain identity lifecycles, authentication factors, authorization models, and federation.
2. Apply least privilege, separation of duties, and privileged-access-management principles.
3. Design a basic data-classification, encryption, retention, and DLP program.
4. Distinguish cybersecurity requirements from privacy obligations.
5. Analyze privacy risks and apply privacy-by-design practices.
6. Evaluate identity and data-security controls in an organizational case.

1. Identity as a Security and Governance Asset

A digital identity is a set of attributes and credentials representing an entity in an information system. The entity may be a person, service, device, application, organization, or autonomous process. An identity record may include a name, employee number, role, department, device identifier, public key, or account status.

Identity management is concerned with the full identity lifecycle:

1. Registration and proofing: establishing that an identity corresponds to a real and authorized entity.
2. Provisioning: creating accounts, credentials, groups, and access rights.
3. Use and maintenance: updating attributes, roles, and authentication methods.
4. Review and recertification: confirming that access remains appropriate.
5. Suspension: temporarily disabling an account because of investigation, leave, or risk.
6. Deprovisioning: removing access when employment, contracts, or business need ends.
7. Audit and evidence: recording decisions and actions for accountability.

A major management risk is privilege accumulation. A person who changes departments may retain permissions from previous roles. This creates excessive access and increases the impact of account compromise. Effective identity governance links access to current business responsibilities rather than historical permissions.

Joiner, Mover, and Leaver Processes

The joiner–mover–leaver model provides a practical way to manage identity changes. A joiner receives an approved baseline of access. A mover has access reviewed when responsibilities change. A leaver is promptly disabled and has credentials, tokens, devices, and application sessions revoked or recovered.

Automation can improve speed and consistency, but it does not remove the need for governance. Human-resource records may be incomplete, role definitions may be ambiguous, and emergency access may require special treatment. Access ownership must therefore be assigned to accountable managers or system owners.

2. Authentication and Accountability

Authentication is the process of establishing confidence that an entity is the subject associated with an identity. Identification claims an identity; authentication provides evidence for the claim; authorization determines what the authenticated identity can do.

Authentication factors are commonly classified as:

A password and a PIN are both knowledge factors, so using both does not automatically create multifactor authentication. Multifactor authentication (MFA) requires evidence from different factor categories. MFA substantially reduces the value of stolen passwords, although phishing-resistant methods are stronger than one-time codes that can be relayed by an attacker.

Authentication Technologies

Passwords should be unique, difficult to guess, protected against automated attempts, and stored using a slow, salted password-hashing scheme rather than reversible encryption. Organizations should avoid unnecessary password rotation that encourages predictable patterns. Password managers and passkeys can reduce reuse and phishing exposure.

One-time passwords (OTPs) generate temporary codes, commonly through a hardware token or authenticator application. They improve on static passwords but may remain vulnerable to phishing or real-time relay attacks.

Public-key authentication uses a private key held by the user or device and a corresponding public key. A digital signature demonstrates possession of the private key without disclosing it. The private key must be protected against theft and unauthorized use.

Biometrics can be convenient, but biometric traits are not secrets in the same way as passwords. A compromised password can be changed; a fingerprint cannot easily be replaced. Biometric systems should therefore use protected templates, liveness detection where appropriate, fallback mechanisms, and strict purpose limitations.

Adaptive authentication evaluates contextual signals such as device health, location, time, behavior, and requested resource. It may require stronger verification for a high-risk transaction. Contextual signals are probabilistic and can create privacy concerns or wrongly block legitimate users; they should support, not replace, sound identity governance.

Authentication Assurance

The strength of authentication depends on more than the number of factors. Important considerations include identity proofing, resistance to phishing, protection of authenticators, recovery procedures, session management, and the security of the authentication service itself. Account recovery is often an overlooked weakness: if an attacker can bypass MFA through a weak recovery process, the apparent strength of MFA is reduced.

3. Authorization Models and Least Privilege

Authorization is the decision process that determines whether an authenticated subject may perform an action on a resource. A useful authorization decision can be represented conceptually as:

Here, subject is the requesting identity, resource is the object or service, action is the requested operation, context includes conditions such as time or device status, and policy contains organizational rules. The notation is conceptual rather than a numerical formula.

Major Authorization Models

Discretionary access control (DAC) allows resource owners to decide who may access resources. It is flexible but can lead to uncontrolled sharing and permission propagation.

Mandatory access control (MAC) assigns centrally managed labels and rules. Users cannot normally override the policy. MAC is useful in environments requiring strong information-flow control.

Role-based access control (RBAC) assigns permissions to roles, and users receive roles according to job responsibilities. RBAC is understandable and manageable when roles are well defined, but too many roles can create “role explosion.”

Attribute-based access control (ABAC) makes decisions using attributes of subjects, resources, actions, and context. ABAC supports fine-grained policies such as “clinical staff may view records for patients assigned to their current facility.” Its flexibility requires reliable attributes and well-governed policy administration.

Rule- or policy-based access control evaluates explicit conditions, often combining RBAC and ABAC. Cloud platforms commonly use policy statements involving principals, actions, resources, and conditions.

Least Privilege and Separation of Duties

Least privilege means granting only the access necessary for an authorized task, for the minimum practical duration. It applies to users, administrators, applications, service accounts, and devices. Least privilege is not merely “read-only access”; it also concerns scope, time, environment, and data volume.

Separation of duties prevents one person from controlling incompatible stages of a sensitive process. For example, the person who creates a supplier may not approve payment to that supplier. This reduces fraud and limits the consequences of a compromised account.

Access reviews should examine actual use, not merely assigned permissions. However, usage data alone cannot prove that unused access is unnecessary; an infrequent emergency responsibility may be legitimate. Review decisions therefore require business context and accountable approval.

4. Privileged Access Management

Privileged accounts can alter security settings, access large volumes of data, create accounts, or disable controls. Examples include domain administrators, database administrators, cloud root accounts, security-tool administrators, and emergency accounts.

A privileged access management (PAM) program commonly includes:

• separate administrative accounts rather than using ordinary accounts for administration;
• MFA and phishing-resistant authentication for privileged actions;
• just-in-time or time-limited elevation;
• approval and business justification;
• credential vaulting, rotation, and secret protection;
• session recording or command logging where lawful and proportionate;
• monitoring for unusual administrative behavior;
• emergency “break-glass” accounts with strict controls and review;
• periodic testing of recovery and revocation.

PAM does not eliminate insider risk. Excessive monitoring may also affect employee privacy, so monitoring purposes, access to logs, retention periods, and oversight should be defined in advance.

5. Federation and Single Sign-On

Identity federation allows one organization or identity provider to provide authentication assertions to another service provider. Single sign-on (SSO) allows a user to authenticate once and access multiple authorized services, subject to session and policy controls.

Federation reduces password duplication and centralizes lifecycle management. It can also create concentration risk: compromise of the identity provider may affect many services. Federation agreements should define trust, assurance levels, attribute release, incident notification, revocation, logging, and responsibilities.

Common federation approaches include SAML-based enterprise federation and OpenID Connect built on OAuth 2.0. OAuth primarily concerns delegated authorization, while OpenID Connect adds an identity layer. A token should contain only necessary claims, have an appropriate audience and lifetime, and be validated by the receiving service. The existence of SSO does not imply that every federated user should receive the same permissions.

6. Data Classification and Handling

Data classification converts business and legal sensitivity into handling requirements. A simple scheme may include:

Classification should consider confidentiality, integrity, availability, legal requirements, contractual obligations, business impact, and sensitivity to individuals. A classification label is useful only when connected to handling rules. Those rules should cover storage, transmission, copying, printing, sharing, disposal, backup, and incident response.

Data owners are accountable for classification and access decisions; custodians implement technical and operational controls. Classification should be reviewed when the data’s value, context, or legal status changes. Aggregation can increase sensitivity: several individually low-risk fields may together reveal a person’s identity or behavior.

7. Encryption and Key Management

Encryption transforms readable plaintext into ciphertext using an algorithm and key. Decryption reverses the transformation for an authorized party. Encryption supports confidentiality but does not by itself guarantee integrity, authenticity, correct authorization, or lawful processing.

Symmetric encryption uses the same secret key for encryption and decryption. It is efficient for bulk data. Asymmetric cryptography uses a public/private key pair and supports key exchange, digital signatures, and identity mechanisms, but is generally more computationally expensive for bulk encryption. Modern systems often use asymmetric methods to establish or protect a symmetric session key.

Authenticated encryption, such as an authenticated-encryption mode, provides confidentiality and integrity when implemented correctly. Nonces or initialization values must be generated and used according to the algorithm’s requirements; accidental reuse can be catastrophic for some modes. Cryptographic libraries should be preferred over self-designed algorithms.

Key management is frequently more important than the algorithm. It includes generation, distribution, storage, rotation, backup, access control, revocation, escrow where justified, and destruction. Encryption at rest protects storage media and backups, while encryption in transit protects communications. Neither protects data after an authorized application decrypts it for a malicious or compromised user.

8. Retention, Disposal, and Data Loss Prevention

Retention is the period for which information is kept for legal, regulatory, operational, evidentiary, or historical purposes. Retaining data indefinitely increases breach exposure, discovery costs, and privacy risk. Deleting too early may violate legal holds, contractual duties, or business requirements.

A defensible retention schedule identifies the record type, owner, retention trigger, minimum period, disposal method, legal hold process, and exceptions. Legal holds suspend ordinary disposal for relevant information. Disposal should address primary systems, replicas, caches, endpoints, paper records, and backups. “Delete” may mean logical deletion, cryptographic erasure, overwriting, or physical destruction depending on the medium and assurance required.

DLP controls seek to detect and prevent unauthorized disclosure through email, web uploads, removable media, cloud sharing, printing, or applications. DLP may inspect content, context, and destination. Effective programs combine technology with classification, user education, data minimization, and clear exception processes. Poorly tuned DLP creates false positives, workarounds, and operational disruption.

9. Privacy Principles and Privacy by Design

Privacy concerns the appropriate collection, use, disclosure, retention, and disposal of information relating to identifiable or identifiable individuals. Security protects information from unauthorized actions; privacy also asks whether the organization should collect or use the information at all.

Widely recognized privacy principles include:

• Lawfulness, fairness, and transparency: processing should have a valid basis and be understandable.
• Purpose limitation: data should be collected for specified, legitimate purposes and not reused incompatibly.
• Data minimization: collect only what is necessary.
• Accuracy: keep personal data accurate and allow correction where appropriate.
• Storage limitation: retain information no longer than justified.
• Integrity and confidentiality: protect data against unauthorized access, loss, or alteration.
• Accountability: the organization should be able to demonstrate compliance.

Legal requirements vary by jurisdiction and sector. Organizations must identify applicable laws, contractual obligations, individual rights, cross-border transfer rules, breach-notification duties, and requirements for sensitive or special-category data. Legal compliance is necessary but does not exhaust ethical responsibility.

Privacy by design embeds privacy into architecture and development rather than adding it after deployment. Practical methods include privacy impact assessments, purpose-specific data stores, tokenization or pseudonymization, role-based access, short default retention, user controls, clear notices, privacy-preserving analytics, and testing for re-identification. Privacy by default means that the least intrusive reasonable setting is selected without requiring users to discover and configure it themselves.

Privacy and Artificial Intelligence

AI systems may infer sensitive characteristics from apparently ordinary data, combine data from different sources, and make decisions that affect individuals. Governance should address provenance, purpose compatibility, data quality, explainability appropriate to the use, human oversight, bias testing, model access, retention of prompts and outputs, and vendor processing. De-identification reduces risk but is not an absolute guarantee: linkage attacks may re-identify individuals when auxiliary data are available.

10. Integrated Control Design

Identity, access, data, and privacy controls should operate as a system. For example, a privacy requirement to limit access to patient data may be implemented through identity proofing, MFA, role and attribute policies, encryption, audit logs, retention schedules, and DLP. A control is effective only when its design, implementation, operation, and evidence align.

A practical control-design sequence is:

1. Identify information, subjects, business purposes, and legal obligations.
2. Classify data and define owners.
3. Map identities, roles, applications, devices, and trust relationships.
4. Define authorization policies using least privilege and separation of duties.
5. Select authentication and encryption controls proportional to risk.
6. Establish lifecycle, retention, disposal, and incident processes.
7. Test preventive, detective, and corrective controls.
8. Measure exceptions, access-review completion, dormant accounts, privileged activity, and incidents.
9. Improve controls using audit findings, threat intelligence, and lessons learned.

Applied Case: University Research Data Platform

Background

This illustrative case concerns Northbridge University, which operates a platform containing student records, research datasets, staff information, and externally funded clinical research data. Researchers, administrators, visiting scholars, and automated analysis services use the platform.

Problem

An audit found dormant accounts belonging to former researchers, shared administrator credentials, excessive access to clinical datasets, unencrypted exports on laptops, and no consistent retention schedule. The university also used a cloud analytics provider whose contract did not clearly define deletion and breach-notification responsibilities.

Analysis

The risks were interconnected. Weak leaver processes left identities active. Shared accounts prevented reliable accountability. Broad research roles violated least privilege. Unencrypted exports increased exposure if devices were lost. Indefinite retention conflicted with data minimization and increased the impact of a breach. The supplier relationship created uncertainty about processing purposes, sub-processors, and deletion.

Approach and Solution

The university established an identity governance process linked to human resources and research administration. New accounts required identity proofing and sponsor approval; movers received access review; leavers were disabled automatically, with exceptions documented. Researchers used individual accounts with MFA, while administrative functions required separate privileged accounts and just-in-time elevation.

A classification scheme distinguished public research outputs, internal university records, confidential student data, and restricted clinical data. Clinical data were stored in a controlled environment, with role and project attributes evaluated at access time. Exports required approval, encryption, and an expiry date. The university introduced a retention schedule, legal-hold procedure, and secure disposal process.

The cloud contract specified permitted purposes, security measures, sub-processor controls, incident notification, audit rights, return or deletion of data, and assistance with individual rights. Privacy impact assessments were required for new datasets and analytic uses. DLP rules monitored restricted data leaving approved environments, with a review process for legitimate research exceptions.

Outcome

The university reduced dormant accounts, eliminated routine shared credentials, improved access-review evidence, and limited the number of users able to access clinical data. Researchers retained necessary capabilities through project-based roles rather than broad permanent permissions. Some false DLP alerts initially disrupted workflows, so rules were tuned and researchers were trained on approved transfer methods.

Learning Points

The case demonstrates that identity governance, access control, data classification, privacy, and supplier management cannot be treated as isolated projects. Strong technology failed to compensate for unclear ownership and weak lifecycle processes. The most sustainable approach combined accountable decisions, automation, technical enforcement, user education, and periodic review.

Challenges and Limitations

No control is perfect. MFA can be bypassed through phishing, session theft, social engineering, or compromised recovery channels. RBAC can become complex, while ABAC depends on accurate attributes and understandable policies. Encryption can create availability and recovery problems if keys are lost. DLP may miss novel exfiltration methods or block legitimate work. Biometrics and behavioral analytics can introduce discrimination and privacy risks. Federation reduces duplication but concentrates trust. Privacy notices may be technically accurate yet incomprehensible to ordinary users.

Managers should therefore evaluate controls according to threat, consequence, usability, accessibility, cost, legal requirements, and residual risk. Exceptions should be documented, time-limited, approved by accountable owners, and reviewed rather than becoming permanent weaknesses.

Best-Practice Checklist

• Maintain authoritative identity records and automate joiner–mover–leaver events.
• Require MFA for sensitive and privileged access, favoring phishing-resistant methods.
• Separate ordinary and administrative accounts.
• Use least privilege, separation of duties, time-limited elevation, and periodic recertification.
• Prefer standards-based federation and validate token audience, issuer, lifetime, and claims.
• Classify data and connect every class to practical handling rules.
• Protect data in transit, at rest, in backups, and during key lifecycle operations.
• Define retention, legal holds, secure disposal, and exceptions.
• Combine DLP technology with minimization, education, and governance.
• Conduct privacy impact assessments and apply privacy by design and by default.
• Monitor effectiveness, investigate anomalies, and preserve evidence.

Chapter Summary

Identity and access management establishes trustworthy digital identities and governs their complete lifecycle. Authentication verifies identity claims, while authorization applies policies to determine permitted actions. MFA, federation, RBAC, ABAC, least privilege, separation of duties, and privileged access management are complementary mechanisms rather than substitutes for one another.

Data security begins with classification and continues through access control, encryption, key management, retention, disposal, and loss prevention. Privacy adds questions of purpose, necessity, transparency, individual impact, and accountability. Privacy by design incorporates these requirements into systems from the beginning. Effective cybersecurity management integrates people, processes, technology, suppliers, and evidence; it also recognizes limitations and continually manages residual risk.

Key Terms

Identity: A representation of an entity in a digital system.

Identity proofing: Establishing confidence that an identity corresponds to a real entity.

Provisioning: Creating accounts and assigning approved access.

Authentication: Verifying the identity claimed by a subject.

Authorization: Determining which actions an authenticated subject may perform.

Multifactor authentication: Authentication using evidence from different factor categories.

Federation: Trust between organizations or systems for exchanging identity assertions.

Single sign-on: Access to multiple services following one authentication event.

Least privilege: Granting only the access necessary for an authorized task.

Separation of duties: Dividing incompatible responsibilities among people or systems.

Privileged access management: Controls for administering and monitoring high-risk access.

Role-based access control: Assigning permissions through organizational roles.

Attribute-based access control: Making decisions using subject, resource, action, and contextual attributes.

Data classification: Categorizing data according to sensitivity and handling requirements.

Encryption: Transforming plaintext into ciphertext using a cryptographic key.

Key management: The lifecycle management of cryptographic keys.

Data loss prevention: Controls intended to detect or prevent unauthorized data disclosure.

Data minimization: Collecting and using no more personal data than necessary.

Privacy by design: Embedding privacy protections into systems and processes from the outset.

Pseudonymization: Replacing direct identifiers with substitutes while retaining a controlled means of linkage.

Review Questions

Short Answer Questions

1. Distinguish identification, authentication, and authorization.
2. Why is a mover process important in identity lifecycle management?
3. What is the difference between RBAC and ABAC?
4. Explain why encryption alone does not guarantee privacy.
5. Identify three activities included in privileged access management.

Long Answer Questions

1. Explain the joiner–mover–leaver model and discuss how automation can improve, but not replace, governance.
2. Compare DAC, MAC, RBAC, and ABAC, including one advantage and limitation of each.
3. Describe a complete data-classification and handling program for a medium-sized organization.
4. Explain the relationship between encryption, key management, retention, and secure disposal.
5. Discuss privacy by design and explain how it differs from treating privacy as a post-deployment compliance task.

Analytical / Application Questions

1. A departing contractor’s account remains active for three days, and the account is used to download restricted files. Analyze the control failures and propose preventive, detective, and corrective measures.
2. A hospital wants to use historical patient records to train an AI model. Design an approval and control process addressing purpose limitation, minimization, access, de-identification, retention, supplier risk, and individual impact.
3. An organization proposes one permanent administrator role for all cloud systems because it is operationally convenient. Critically evaluate the proposal and design a safer alternative using least privilege, PAM, federation, logging, and emergency access controls.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes authentication from authorization?

A. Authentication determines what actions are permitted, while authorization verifies identity.

B. Authentication verifies identity, while authorization determines permitted actions.

C. Authentication encrypts data, while authorization classifies data.

D. Authentication removes accounts, while authorization creates accounts.

Correct Answer: B. Authentication verifies identity, while authorization determines permitted actions.

Question 2

Which combination represents multifactor authentication?

A. Password and PIN

B. Fingerprint and facial recognition

C. Password and hardware security key

D. Username and password

Correct Answer: C. Password and hardware security key

Question 3

What is the primary purpose of the mover process?

A. To create the organization’s first administrator account

B. To review and adjust access when a person’s responsibilities change

C. To encrypt all employee records

D. To publish public information

Correct Answer: B. To review and adjust access when a person’s responsibilities change

Question 4

Which access-control model makes decisions using subject, resource, action, and contextual attributes?

A. DAC

B. MAC

C. RBAC

D. ABAC

Correct Answer: D. ABAC

Question 5

Which practice most directly supports least privilege for administrators?

A. Giving every administrator permanent global access

B. Using shared administrator credentials

C. Providing time-limited elevation for approved tasks

D. Disabling all administrative logging

Correct Answer: C. Providing time-limited elevation for approved tasks

Question 6

What is a major risk of centralized identity federation?

A. It prevents all forms of single sign-on

B. Compromise of the identity provider may affect many connected services

C. It makes authorization unnecessary

D. It eliminates the need for account deprovisioning

Correct Answer: B. Compromise of the identity provider may affect many connected services

Question 7

Which statement about encryption is correct?

A. Encryption guarantees that data is being used lawfully

B. Encryption eliminates the need for key management

C. Encryption can support confidentiality, but does not by itself ensure correct authorization

D. Encryption prevents all attacks against decrypted data

Correct Answer: C. Encryption can support confidentiality, but does not by itself ensure correct authorization

Question 8

Which privacy principle favors collecting only the personal data necessary for a stated purpose?

A. Data minimization

B. Purpose expansion

C. Indefinite retention

D. Credential sharing

Correct Answer: A. Data minimization

Question 9

What is the main function of a retention schedule?

A. To define how long categories of information should be kept and when disposal is permitted

B. To assign passwords to users

C. To authenticate cloud services

D. To replace encryption keys after every transaction

Correct Answer: A. To define how long categories of information should be kept and when disposal is permitted

Question 10

Which practice best represents privacy by design?

A. Collecting all potentially useful data and deciding later how to use it

B. Adding a privacy notice only after the system is deployed

C. Embedding minimization, access controls, short default retention, and impact assessment into system development

D. Allowing unrestricted internal access because employees are trusted

Correct Answer: C. Embedding minimization, access controls, short default retention, and impact assessment into system development