Identity and Access Management: Explained
Published: 2023-11-06 05:34:19

The pillars of information security, namely Identification,  Authentication, Authorization, and Accountability (IAAA), are crucial  components in safeguarding sensitive information and resources by  ensuring their confidentiality, integrity, and availability.

1. **Identification** refers to the process of verifying a  user's claimed identity. Users provide a unique identifier, such as an  email address, username, or ID number, to establish their identity  within a particular system or environment. Many websites rely on email  addresses as identifiers instead of requiring users to create unique  usernames.
2. **Authentication** involves confirming that the user is  indeed who they claim to be. It aims to validate the claimed identity.  Passwords are a common authentication method, although other approaches  like entering a code received via email are gaining popularity due to  potential weaknesses in passwords.
3. **Authorization** determines the user's permitted access rights. It involves granting specific privileges and permissions based  on the user's role, job function, or clearance level. By restricting  access to only necessary resources, the risk of unauthorized access and  data breaches is minimized.
4. **Accountability** entails tracking user activity to  ensure they are held responsible for their actions. Once a user is  granted access to a system, mechanisms are in place to record and store  their activities in a centralized location. This logging of user  activity serves as a means to identify the source of security incidents  and take appropriate actions.

## Identity Management (IdM)

Identity Management (IdM) is a vital aspect of cybersecurity that pertains to the management and regulation of digital identities. It encompasses the administration of user identities, including their authentication, authorization, and access control. The primary objective of IdM is to ensure that only authorized individuals can access specific resources and information. IdM systems are employed to oversee user identities across an organization's network.

IdM systems utilize a centralized database to store user identities and access privileges. These systems offer functionalities for managing and monitoring user access to resources. Common features found in IdM systems include user provisioning, authentication, and authorization. User provisioning involves the creation and administration of user accounts, while authentication and authorization involve verifying a user's identity and granting access to designated resources.

IdM systems play a critical role in organizations that utilize multiple systems and applications requiring access control. They streamline the management of user identities, mitigating the risk of unauthorized access to resources. Furthermore, IdM systems establish a central point of reference for user identity management, simplifying the process of managing user access rights for organizations.

## Identity and Access Management (IAM)

IAM (Identity and Access Management) is a more inclusive concept compared to IdM (Identity Management). It encompasses a range of processes and technologies aimed at managing and safeguarding digital identities and access privileges. IAM systems incorporate various functions such as user provisioning, access control, identity governance, and compliance management. Their purpose is to ensure that only authorized individuals can access specific resources and data, while also monitoring and controlling their access.

IAM systems offer a comprehensive solution for managing and securing resource access within an organization. They integrate with multiple systems and applications, providing a centralized perspective on user identities and access rights. These systems utilize diverse technologies, including role-based access control, multi-factor authentication, and single sign-on, to manage access effectively.

IAM systems aid organizations in complying with regulatory requirements such as HIPAA, GDPR, and PCI DSS. They provide functionalities to handle the lifecycle of user identities, including onboarding, offboarding, and access revocation. Furthermore, IAM systems enable organizations to track and audit user activity, helping prevent security breaches and ensuring compliance with industry regulations.

Both IdM and IAM are integral components of cybersecurity as they ensure that only authorized individuals possess access to specific resources and information. While IdM systems focus on managing user identities, IAM systems encompass broader functions to manage and secure digital identities and access rights.

A system regulates access to different resources using a selected model. Several prevalent access control models include:

1. Discretionary Access Control (DAC)
2. Role-Based Access Control (RBAC)
3. Mandatory Access Control (MAC)
4. Attribute-Based Access Control (ABAC)

In these models, access to resources is managed and granted based on different principles and mechanisms.

## Discretionary Access Control

Many people have utilized Discretionary Access Control (DAC) to share files or folders with friends and colleagues. In DAC, the owner of the resource explicitly adds users and assigns them appropriate permissions.

For example, let's say you have your photos stored on an online platform. To share the images related to your graduation with your family, you individually add their accounts and grant them access to the specific album. As a result, the album permissions will reflect a few accounts with viewing privileges.

This process is straightforward and under the complete control of the data owner. It works well for sharing with family members or a select few users within a company. However, difficulties can arise when attempting to scale sharing to a larger number of users, particularly as users' roles evolve over time. This situation leads us to consider sharing based on user roles.

## Role-Based Access Control

Role-Based Access Control (RBAC) employs a highly intuitive approach. Each user is assigned one or more roles or functional positions, which determine their authorized access to different resources.

For example, an accountant may require access to the company's accounting books but does not need access to research and development labs or documents. Consequently, users are categorized into various groups based on their roles. Authorization and access are then granted based on the group to which a user belongs.

The classification of users according to their roles offers numerous advantages. For instance, when a user assumes a new role, it is simply a matter of adding them to the corresponding group. Similarly, if a user relinquishes a particular role, they can be removed from the relevant group. This approach greatly simplifies and streamlines maintenance tasks, making them more efficient.

## Mandatory Access Control

An operating system that implements Mandatory Access Control (MAC)  prioritizes security and imposes significant restrictions on user  capabilities. Such systems are typically used for specific purposes or  to handle highly classified data. Consequently, users are limited to  performing only essential tasks, and they are unable to carry out  actions like installing new software or modifying file permissions.

AppArmor is a tool that enables the implementation of MAC on Linux  distributions. It is already included in various Linux distributions  such as Debian and Ubuntu.

The SELinux project offers a flexible MAC solution for Linux systems. It is a standard feature in several Linux distributions like Red Hat  and Fedora.

## Attribute-Based Access Control

Attribute-Based Access Control (ABAC) is a sophisticated access  control model that grants permissions based on attributes associated  with users, resources, and environmental conditions. Unlike traditional  access control models that rely on roles or groups, ABAC considers a  wide range of attributes in its decision-making process. These  attributes can include user characteristics, such as job title or  department, resource properties, such as sensitivity or location, and  contextual factors, such as time of day or network location.

By evaluating these attributes, ABAC policies can dynamically  determine whether to grant or deny access to specific resources. This  dynamic decision-making capability allows organizations to implement  more fine-grained access control policies that align with their unique  security requirements. For example, an organization may define a policy  stating that only employees with a job title of "Manager" can access  confidential financial data during business hours, while restricting  access for other employees.

ABAC provides a flexible and granular approach to access control.  Organizations can define complex policies that take into account  multiple attributes and their combinations to make access control  decisions. This flexibility allows for the implementation of more  nuanced and context-aware access control policies. Additionally, ABAC  supports the concept of dynamic and adaptive authorization, enabling  real-time adjustments to access permissions based on changing attributes or environmental conditions.

Implementing ABAC typically involves the use of an attribute-based  policy language and an attribute-based policy enforcement point. The  policy language allows organizations to define and express their access  control policies using attributes and logical expressions. The policy  enforcement point evaluates these policies at runtime and enforces  access decisions based on the attributes associated with the requesting  user, requested resource, and the environment.