Identity and Access Management: Explained

The pillars of information security, namely Identification, Authentication, Authorization, and Accountability (IAAA), are crucial components in safeguarding sensitive information and resources by ensuring their confidentiality, integrity, and availability.

1. Identification refers to the process of verifying a user's claimed identity. Users provide a unique identifier, such as an email address, username, or ID number, to establish their identity within a particular system or environment. Many websites rely on email addresses as identifiers instead of requiring users to create unique usernames.
2. Authentication involves confirming that the user is indeed who they claim to be. It aims to validate the claimed identity. Passwords are a common authentication method, although other approaches like entering a code received via email are gaining popularity due to potential weaknesses in passwords.
3. Authorization determines the user's permitted access rights. It involves granting specific privileges and permissions based on the user's role, job function, or clearance level. By restricting access to only necessary resources, the risk of unauthorized access and data breaches is minimized.
4. Accountability entails tracking user activity to ensure they are held responsible for their actions. Once a user is granted access to a system, mechanisms are in place to record and store their activities in a centralized location. This logging of user activity serves as a means to identify the source of security incidents and take appropriate actions.

Identity Management (IdM)

Identity Management (IdM) is a vital aspect of cybersecurity that pertains to the management and regulation of digital identities. It encompasses the administration of user identities, including their authentication, authorization, and access control. The primary objective of IdM is to ensure that only authorized individuals can access specific resources and information. IdM systems are employed to oversee user identities across an organization's network.

IdM systems utilize a centralized database to store user identities and access privileges. These systems offer functionalities for managing and monitoring user access to resources. Common features found in IdM systems include user provisioning, authentication, and authorization. User provisioning involves the creation and administration of user accounts, while authentication and authorization involve verifying a user's identity and granting access to designated resources.

IdM systems play a critical role in organizations that utilize multiple systems and applications requiring access control. They streamline the management of user identities, mitigating the risk of unauthorized access to resources. Furthermore, IdM systems establish a central point of reference for user identity management, simplifying the process of managing user access rights for organizations.

Identity and Access Management (IAM)

IAM (Identity and Access Management) is a more inclusive concept compared to IdM (Identity Management). It encompasses a range of processes and technologies aimed at managing and safeguarding digital identities and access privileges. IAM systems incorporate various functions such as user provisioning, access control, identity governance, and compliance management. Their purpose is to ensure that only authorized individuals can access specific resources and data, while also monitoring and controlling their access.

IAM systems offer a comprehensive solution for managing and securing resource access within an organization. They integrate with multiple systems and applications, providing a centralized perspective on user identities and access rights. These systems utilize diverse technologies, including role-based access control, multi-factor authentication, and single sign-on, to manage access effectively.

IAM systems aid organizations in complying with regulatory requirements such as HIPAA, GDPR, and PCI DSS. They provide functionalities to handle the lifecycle of user identities, including onboarding, offboarding, and access revocation. Furthermore, IAM systems enable organizations to track and audit user activity, helping prevent security breaches and ensuring compliance with industry regulations.

Both IdM and IAM are integral components of cybersecurity as they ensure that only authorized individuals possess access to specific resources and information. While IdM systems focus on managing user identities, IAM systems encompass broader functions to manage and secure digital identities and access rights.

A system regulates access to different resources using a selected model. Several prevalent access control models include:

1. Discretionary Access Control (DAC)
2. Role-Based Access Control (RBAC)
3. Mandatory Access Control (MAC)
4. Attribute-Based Access Control (ABAC)

In these models, access to resources is managed and granted based on different principles and mechanisms.

Discretionary Access Control

Many people have utilized Discretionary Access Control (DAC) to share files or folders with friends and colleagues. In DAC, the owner of the resource explicitly adds users and assigns them appropriate permissions.

For example, let's say you have your photos stored on an online platform. To share the images related to your graduation with your family, you individually add their accounts and grant them access to the specific album. As a result, the album permissions will reflect a few accounts with viewing privileges.

This process is straightforward and under the complete control of the data owner. It works well for sharing with family members or a select few users within a company. However, difficulties can arise when attempting to scale sharing to a larger number of users, particularly as users' roles evolve over time. This situation leads us to consider sharing based on user roles.

Role-Based Access Control

Role-Based Access Control (RBAC) employs a highly intuitive approach. Each user is assigned one or more roles or functional positions, which determine their authorized access to different resources.

For example, an accountant may require access to the company's accounting books but does not need access to research and development labs or documents. Consequently, users are categorized into various groups based on their roles. Authorization and access are then granted based on the group to which a user belongs.

The classification of users according to their roles offers numerous advantages. For instance, when a user assumes a new role, it is simply a matter of adding them to the corresponding group. Similarly, if a user relinquishes a particular role, they can be removed from the relevant group. This approach greatly simplifies and streamlines maintenance tasks, making them more efficient.

Mandatory Access Control

An operating system that implements Mandatory Access Control (MAC) prioritizes security and imposes significant restrictions on user capabilities. Such systems are typically used for specific purposes or to handle highly classified data. Consequently, users are limited to performing only essential tasks, and they are unable to carry out actions like installing new software or modifying file permissions.

AppArmor is a tool that enables the implementation of MAC on Linux distributions. It is already included in various Linux distributions such as Debian and Ubuntu.

The SELinux project offers a flexible MAC solution for Linux systems. It is a standard feature in several Linux distributions like Red Hat and Fedora.

Attribute-Based Access Control

Attribute-Based Access Control (ABAC) is a sophisticated access control model that grants permissions based on attributes associated with users, resources, and environmental conditions. Unlike traditional access control models that rely on roles or groups, ABAC considers a wide range of attributes in its decision-making process. These attributes can include user characteristics, such as job title or department, resource properties, such as sensitivity or location, and contextual factors, such as time of day or network location.

By evaluating these attributes, ABAC policies can dynamically determine whether to grant or deny access to specific resources. This dynamic decision-making capability allows organizations to implement more fine-grained access control policies that align with their unique security requirements. For example, an organization may define a policy stating that only employees with a job title of "Manager" can access confidential financial data during business hours, while restricting access for other employees.

ABAC provides a flexible and granular approach to access control. Organizations can define complex policies that take into account multiple attributes and their combinations to make access control decisions. This flexibility allows for the implementation of more nuanced and context-aware access control policies. Additionally, ABAC supports the concept of dynamic and adaptive authorization, enabling real-time adjustments to access permissions based on changing attributes or environmental conditions.

Implementing ABAC typically involves the use of an attribute-based policy language and an attribute-based policy enforcement point. The policy language allows organizations to define and express their access control policies using attributes and logical expressions. The policy enforcement point evaluates these policies at runtime and enforces access decisions based on the attributes associated with the requesting user, requested resource, and the environment.