Identity and access management makes sure the right people and software reach the right resources at the right time. Authentication proves who a user is and authorization decides what that user can open. Single sign on and multifactor authentication cut password risk. Cloud Security Alliance guidance lists IAM as topic 12 of 14.
Employees need quick access to apps and security teams need control over that access. IAM sits between those two goals.
This guide follows Microsoft and NIST documentation and the Cloud Security Alliance guidance list.
What is Identity and Access Management?
Microsoft describes IAM as making sure the right people and machines and software components access the right resources when needed. First the entity proves who or what it claims to be. Then it gets access or does not. See identity and access management.
NIST defines identity management broadly as the administration of individual identities within a system. In enterprise IT it involves establishing and managing the roles and access privileges of individual network users. See the NIST glossary entry.
What are the Core IAM Functions?
| Function | Purpose |
|---|---|
| Identity management | Create and store identity information |
| Identity federation | Let users from other identity providers sign in |
| Provisioning and deprovisioning | Create accounts and set permissions then remove them |
| Authentication | Confirm the user or machine is who it claims to be |
| Authorization | Grant the exact level of access |
| Access control | Define roles and permissions |
| Reports and monitoring | Log sign in time and systems accessed for audits |
What is the Difference Between Authentication and Authorization?
Authentication comes first. It proves identity and passes information in an ID token that often uses OpenID Connect or SAML.
Authorization follows a successful sign in. It decides the level of access and passes information in an access token that often uses OAuth 2.0.
How do SSO and MFA Reduce Risk?
- Single sign on. Users sign in once and the system signs them in silently to other resources that use the same identity.
- Multifactor authentication. Users give more than one proof like a password and a badge and a biometric.
- Role based access. Admins group permissions into roles and then grant roles to users.
Where does Cloud Security Alliance Guidance Place IAM?
Security Guidance v4.0 from the Cloud Security Alliance lists Identity, Entitlement and Access Management as topic 12 of 14. Released on 26 July 2017 and it sits beside topics for data security and incident response. See Security Guidance v4.0.
For related controls see cloud data protection controls and what a CASB is. For risks see top security issues in cloud computing.
Frequently Asked Questions
What is IAM?
IAM stands for identity and access management. It gives people and software access to approved resources only.
What is the Difference Between Authentication and Authorization?
Authentication proves identity. Authorization decides the level of access after sign in.
What is Single Sign-On?
Single sign on means users sign in once and reach other resources that use the same identity.
What is Provisioning in IAM?
Provisioning creates user accounts and sets which resources and permissions a user gets. Deprovisioning removes them.
Where does CSA Place IAM?
Security Guidance v4.0 from CSA lists it as topic 12 of 14.
Key Takeaways
- IAM gives approved users the access they need.
- Authentication proves identity while authorization sets access.
- SSO and MFA reduce password risk.
- Provisioning and deprovisioning manage the account lifecycle.
- CSA guidance lists IAM as topic 12 of 14.
Sources and References
This guide follows Microsoft and NIST documentation and the CSA guidance page.
- Identity and access management fundamentals (Microsoft Learn) learn.microsoft.com
- Identity and access management (NIST Glossary) csrc.nist.gov
- Security Guidance v4.0 (Cloud Security Alliance) cloudsecurityalliance.org