Identity and Access Management for “Dummies” by Richard Azu

Photo by Daria Shevtsova on Unsplash

Is your system and network environment being managed effectively against exponentially increasing attacks?

Do you have close control over user access defined in your environment?

If you answered anything but “yes” to either of these questions, read on to learn more about Identity Access Management (IAM) and how to implement it successfully.

What’s Identity Access Management (IAM)?

IAM is a system used to define and manage user identities and access permissions. With the right framework for IAM in place, system administrators can manage user access to critical data within your enterprise. System administrators also use IAM to regulate users’ access to systems and networks based on set definitions.

Identity and access management solutions deployed by teams like these top IT security companies in the UK consist of four major components: Authentication, Authorization, Administration and Central Identity Stores. These solutions provide users with access to systems in a seamless but secure way.

Authentication

Authentication is the process of verifying the identity of a user, system or device. The authentication process is invoked whenever a user, system or device initially makes the attempt to access a corporate network. During this process, users, systems and devices must verify their identity before being granted access to systems and networks. Once a user, system or device is authenticated, a session is created and referred to during all system interactions until the user, device or system logs off or the session is automatically timed out. 

To make it difficult for hackers to gain access to the entire network with a compromised username and password pair, additional steps are introduced during verification of identity. The additional steps require users to provide more information such as a One-Time Pin token (OTP), a fingerprint or a code sent to a mobile device. This extra level of authentication is commonly known as Multi-factor Authentication (MFA).

Authorization

Authorization refers to the process that determines what a user, device or system can do within a network. This is the next process after authentication is successful and you’re sure about the user, device or system trying to access the network.

This part of IAM determines whether a user, device or system is permitted to access a resource within a network. It does this by checking the access request presented by the user, device or system against the authorization policies defined in IAM (if one exists). If a request is the same as defined in the IAM system, access is granted. If the request is not, access is denied.

Administration

Administration is the method by which profiles are created for users, devices and systems.

This component of IAM defines the set of functions such as profile creation, propagation and maintenance of profile and privileges. This component of IAM has three sub-components: Delegated Administration, Provisioning and Self-Service.

Delegated Administration

Delegated Administration is the process of granting system administrators the ability to view another user’s identity data and execute actions on that profile.

Provisioning

Provisioning is the process of organizing the creation of user profiles and its dependencies in the form of roles.

Self-Service

Self-service is the process by which a user requests to modify her/his own identity attributes in the IAM system. This process also includes requests for new access rights.

Central Identity Stores

Central Identity Stores is a directory that contains identity information about a collection of users. Identity stores in IAM hold group membership information and the information required to validate credentials submitted from clients. The stores in IAM are the primary source and database for all the access profiles in IAM. Establishing a central identity store is necessary for centralizing IAM tasks and functions such as role-based access controls and provisioning or deprovisioning of access profiles.

Risks of not having an Identity and Access Management

Configuring Correct Access Profiles

Without an IAM solution, it would be difficult for organisations to control users’ access to their systems. Even though most organisations pay attention to external hackers, internal users contribute to many corporate security breaches. This makes it important to ensure users are configured with the right access profiles. This is strictly enforced and required for organisations that deal with very sensitive data for both internal and external clients. Ensuring the correct access profile is configured for each user should be an on-going activity that lasts for each user’s lifetime in the system. 

Termination of Access Profiles

After configuring the correct access profiles for users, system administrators may forget to terminate the account when its users have changed roles, resigned or had their appointment terminated. The life cycle of a user’s access profile must be monitored from its creation until the same profile is no longer required. There’s always significant focus on creating access profiles for users during initial employment, but the same urgency is lost when it’s time for the same access to be removed or deprovisioned. It’s important to manage the removal of such access profiles to prevent disgruntled employees from using credentials to access organisational data when they leave. 

Audits

One major problem with having no access management is dealing with audits and maintaining required compliance levels. When there are no systems in place to manage access, corporate organisations aren’t able to ensure they meet the required standards or rules in audits.

The importance of implementing an Identity and Access Management Solution

An SME or corporate organisation without an IAM solution leaves room for data breaches and several levels of security issues. An IAM solution ensures security requirements for organisations are met. The minimum IAM solution should include a process for provisioning and deprovisioning user profiles and monitoring it throughout its life cycle. This ensures users have just the right access required for their roles.

The core of an IAM solution oversees all the authentication, authorization, administration and central identity store processes. System administrators may manage the entire process from authentication to central identity stores, but the entire organisation can be impacted if user access profiles and their management aren’t properly aligned. Fortunately, a team of IT experts can create an automated IAM solution for your organisation that will minimize operational costs and streamline IAM operations.

---

About the Author:

Richard has a Diploma in Telecommunications Engineering from the Multimedia University – Malaysia and a Bsc. Engineering Physics from the University of Cape Coast, Ghana. He’s currently a member of the Institution of Engineering and Technology (IET  - UK). With over 16 years of experience in Network/Telecom Engineering, he’s experienced in the deployment of voice and data over the media; radio, copper and fibre. He is currently looking for ways to derive benefit from the WDM technology in Optics. Using Kali as a springboard, he has developed an interest in digital forensics and penetration testing.