Identity and Access Management (IAM)

IAM is a framework of policies and technologies that ensure the right individuals have appropriate access to technology resources at the right times and for the right reasons.

Identity and Access Management encompasses the processes and technologies used to manage digital identities and control access to enterprise resources.

Core IAM components: - Identity Governance: User lifecycle, roles, certifications - Access Management: Authentication and authorization - Privileged Access Management (PAM): Securing admin accounts - Single Sign-On (SSO): One login for multiple applications - Federation: Cross-organization identity trust - Multi-Factor Authentication (MFA): Additional verification

IAM lifecycle: 1. Joiner: Provisioning access for new employees 2. Mover: Adjusting access when roles change 3. Leaver: Revoking access when employees depart

Key IAM principles: - Least privilege access - Separation of duties - Regular access reviews - Strong authentication

Popular IAM platforms: Okta, Azure AD, OneLogin, Auth0

Why It Matters

IAM is the cornerstone of zero trust security. Without centralized identity management, organizations cannot enforce consistent access policies, conduct meaningful access reviews, or ensure timely deprovisioning when employees leave. The Joiner-Mover-Leaver lifecycle is one of the most scrutinized areas in SOC 2 audits—auditors specifically verify that access is revoked promptly upon termination.

Key Points

Manages digital identities and access rights

Includes SSO, MFA, and privileged access management

Joiner-Mover-Leaver lifecycle management

Regular access reviews are essential

Foundation for zero trust security

Applicable Compliance Frameworks

SOC 2 ISO 27001 HIPAA PCI DSS

Related Terms

Multi-Factor Authentication (MFA)

MFA is a security mechanism requiring users to provide two or more verification factors to gain access, significantly reducing the risk of unauthorized access.

Access Control

Access control is a security mechanism that regulates who can view or use resources in a computing environment, ensuring only authorized users can access systems and data.

Zero Trust

Zero Trust is a security model that requires strict identity verification for every person and device, regardless of network location.

Frequently Asked Questions

What is the difference between IAM and PAM?

IAM manages all user identities and access. PAM specifically secures privileged/admin accounts with additional controls like session recording and just-in-time access.