Identity and Access Management (IAM)
An introduction to Identity and Access Management (IAM) and its importance in protecting organizational data, how IAM works, and the NIST CSF IAM control categories.
Introduction
In today's world, with data breaches becoming increasingly prevalent, identity and access management (IAM) has become a crucial aspect in the protection of organizational data. Managing user identities and access to resources is essential to ensure that only the right people have access to the right information. IAM is not just about protecting sensitive data, but also about ensuring that employees have the right level of access to the resources they need to do their jobs.
The Importance of IAM
IAM is an essential component of any organization's security program. With the rise of remote work, cloud computing, and the proliferation of mobile devices, managing user identities and access has become more complex. Organizations need to ensure that only authorized users have access to sensitive data, and that access is granted on a need-to-know basis. IAM helps organizations achieve this by providing a centralized system for managing user identities, authentication, and access control.
IAM also helps organizations comply with data protection regulations such as GDPR and HIPAA. These regulations require organizations to protect sensitive data and ensure that only authorized users have access to it. Failure to comply with these regulations can result in hefty fines and damage to an organization's reputation.
How IAM Works
IAM helps organizations manage user identities and access to resources. It does this by creating a central system for user authentication and authorization, as well as access control policies that decide what resources users can access and what actions they can perform. IAM also has tools for monitoring user activity and detecting potential security threats. Implementing IAM helps organizations protect their data, comply with regulations, and reduce the risk of data breaches.
There are two parts to granting secure access to an organization's resources: identity management and access management.
Identity management checks a login attempt against a database of people who should have access. The database is constantly updated as people join or leave the organization, change their roles, or the organization changes. The database stores employee names, job titles, managers, direct reports, mobile phone numbers, and personal email addresses. When someone logs in, their login information is matched with their identity in the database. This is called authentication.
For added security, many organizations require users to verify their identities with multifactor authentication (MFA). MFA adds an extra step to the login process where the user must verify their identity with an alternate method, such as a mobile phone number or personal email address. The IAM system usually sends a one-time code to the alternate method, which the user must enter into the login portal within a set time period.
Access management is the second part of IAM. Once the IAM system has confirmed the person or thing attempting to access a resource matches their identity, access management keeps track of which resources they have permission to access. Most organizations grant varying levels of access to resources and data, and these levels are determined by factors like job title, tenure, security clearance, and project.
NIST CSF IAM Control Categories
The NIST Cybersecurity Framework (CSF) provides guidelines for implementing IAM controls that protect organizational data. The CSF defines ten control categories specifically related to IAM. These categories include managing identities and credentials, managing physical and remote access, and authenticating users and devices. Organizations can use the CSF guidelines to develop an effective IAM program that meets their specific needs and requirements.
PR.AC-1
Identities and credentials are issued, managed, and revoked for authorized devices, users, and processes
Use a centralized identity management system that integrates with other systems, implement strong password policies, and use multifactor authentication
PR.AC-2
Physical access to assets is managed and protected
Use access controls such as badges or biometric authentication, monitor physical access, and limit access to sensitive areas
PR.AC-3
Remote access is managed
Implement a secure remote access solution, such as a virtual private network (VPN), use multifactor authentication, and limit access to authorized users
PR.AC-4
Access permissions are managed, incorporating the principles of least privilege and separation of duties
Implement a role-based access control (RBAC) system, limit privileges to only what is necessary, and separate duties to prevent conflicts of interest
PR.AC-5
Network integrity is protected (e.g., network segmentation, network segregation, network isolation)
Implement network segmentation, segregate sensitive data on separate networks, and isolate critical systems
PR.AC-6
Identities are proofed and authenticated
Verify the identity of users before granting access, use two-factor or multi-factor authentication, and monitor user activity for anomalies
PR.AC-7
Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor)
Use multifactor authentication, implement a strong password policy, and monitor user activity for anomalies
PR.AC-8
Access to assets is based on business need-to-know
Implement a least privilege access control model, regularly review access permissions, and limit access to only what is necessary
PR.AC-9
All access permissions are reviewed and approved periodically
Implement a regular review process for access permissions, revoke access for terminated employees, and limit access to only what is necessary
PR.AC-10
Account and access provisioning processes are tracked, monitored, and logged
Implement an access provisioning and deprovisioning process, monitor access logs for anomalies, and track changes to access permissions
Resources
Last updated
