The discipline in one sentence
Identity and Access Management (IAM) is the set of policies, processes and technology that ensures the right people and systems have the right access to the right resources at the right time, and nothing more. Every other security control assumes IAM is working. Encryption protects data from people without the key; IAM decides who has the key.
The core vocabulary
- Identity: a digital representation of a person, device, application or service. One person may have several identities across systems, which is itself a problem IAM tries to solve.
- Authentication: proving that the entity presenting an identity is who it claims to be, using something it knows, has or is.
- Authorization: deciding what an authenticated identity is permitted to do.
- Accounting or auditing: recording what identities did so the record can be reviewed.
- Lifecycle: the creation, modification and removal of identities and their access as people join, move within and leave an organisation.
- Governance: the oversight that confirms access is appropriate, reviewed and compliant with policy.
Why IAM matters more than ever
Organisations now run on dozens or hundreds of cloud applications, each with its own notion of users and permissions. Staff work from anywhere, on devices the organisation may not own. Machine identities, such as service accounts, API keys and automation bots, often outnumber human identities several times over. Without a coherent IAM program, access sprawls, former employees keep access, and a single stolen password unlocks everything. Most serious breaches begin with a compromised or over-privileged identity.
The IAM lifecycle at a glance
- Join: an identity is created from an authoritative source, such as the HR system, and receives baseline access based on role.
- Use: the identity authenticates, is authorised and is logged.
- Change: when the person changes role, access is adjusted, with old entitlements removed, not just new ones added.
- Review: managers and owners periodically certify that access is still needed.
- Leave: access is removed promptly across every system, and the identity is disabled then eventually deleted according to policy.
Worked example
A new analyst joins a finance team. Without IAM discipline, a colleague emails three application owners asking for accounts, each created with whatever permissions the owner picks. Six months later the analyst moves to marketing and keeps the finance access. Two years later she leaves and the accounts are never closed. With an IAM program, HR creates her record, the identity platform provisions a standard analyst bundle, the move triggers removal of finance entitlements and provisioning of marketing ones, quarterly reviews confirm what she holds, and her departure disables everything within the hour.
Common mistakes
- Treating IAM as a technology purchase rather than a program of policy, process and technology.
- Focusing only on human users and ignoring machine identities.
- Granting access generously and relying on nobody misusing it.
Action Step: Write down the five lifecycle stages and, for each, name the system and the person responsible in your organisation today. Mark any stage with no clear owner.