Enterprise Identity & Access Management - Complete Theory Guide
Think of Identity and Access Management (IAM) as the "Security Brain" of a giant digital castle. This brain is responsible for knowing exactly who every person is, what they're allowed to do, and ensuring they don't have too much power. In modern enterprises, IAM is the foundational layer that enables Zero Trust architecture and protects against 80% of data breaches.
| Model | Best For | Complexity | Flexibility | Scalability |
|---|---|---|---|---|
| RBAC | Medium to large organizations with defined roles | Medium | Moderate | High |
| ABAC | Complex environments needing fine-grained control | High | Very High | Medium |
| MAC | Government, military, high-security environments | High | Very Low | Medium |
| DAC | Small teams, collaborative environments | Low | High | Low |
| ReBAC | Complex SaaS apps with hierarchical resources | High | Very High | Very High |
| PBAC | Cloud-native, microservices architectures | Medium-High | High | Very High |
Some accounts are more dangerous than others. Privileged accounts (like "Admins") have the power to delete the whole system, exfiltrate all data, or cover their tracks. PAM keeps them on a tight leash with vaulting, session control, and just-in-time elevation.
OIDC is an identity layer built on top of OAuth 2.0. It provides authentication (who you are) while OAuth 2.0 provides authorization (what you can access). OIDC is the de facto standard for modern web and mobile applications.
{
"iss": "https://idp.example.com", // Issuer - who created this token
"sub": "user-12345", // Subject - unique user identifier
"aud": "my-app-client-id", // Audience - intended recipient
"exp": 1735689600, // Expiration time (Unix timestamp)
"iat": 1735686000, // Issued at time
"auth_time": 1735685900, // When user actually authenticated
"nonce": "abc123", // Replay attack prevention
"email": "user@example.com", // Standard claim
"groups": ["admins", "developers"] // Custom claim for RBAC
}
SAML is the legacy enterprise standard for SSO, using XML-based assertions. Still widely used for enterprise applications that predate OIDC adoption. Most enterprise IdPs support both SAML and OIDC.
| Aspect | OIDC | SAML 2.0 |
|---|---|---|
| Format | JSON (JWT) | XML |
| Best For | Modern web, mobile, APIs | Enterprise legacy apps |
| Token Size | Compact (~1KB) | Large (~10KB+) |
| Complexity | Lower | Higher |
| Mobile Support | Native | Challenging |
Kerberos is the authentication protocol used by Active Directory. It uses tickets instead of passwords, providing SSO for Windows domain environments. Understanding Kerberos is essential for hybrid identity scenarios.
Zero Trust is a security model that eliminates implicit trust. Every access request is fully authenticated, authorized, and encrypted before granting access—regardless of where the request originates or what resource it accesses.
Verify and secure every identity with strong authentication before granting access.
Ensure devices meet security requirements before granting access to resources.
Segment networks and enforce micro-perimeters around sensitive resources.
Secure and monitor all applications, including shadow IT discovery.
Classify, label, and encrypt data. Apply data-centric security controls.
Phishing-resistant, passwordless authentication using public key cryptography.
Physical USB/NFC devices like YubiKey that generate cryptographic proofs.
Time-based one-time passwords from apps like Google Authenticator, Authy.
Approve/deny prompts sent to mobile device (Microsoft Authenticator, Duo).
One-time codes sent via email.
One-time codes sent via text message. Deprecated by NIST for high-value accounts.
Attackers compromised SolarWinds' build system, inserting malicious code into Orion software updates. Once deployed, the SUNBURST backdoor used stolen SAML signing certificates to forge authentication tokens, gaining persistent access to victim networks without triggering alerts.
A teenage hacker purchased stolen credentials from the dark web, then bombarded an Uber contractor with MFA push notifications until they approved one (MFA fatigue). The attacker then used social engineering via Slack to obtain elevated privileges, eventually accessing AWS, GCP, and internal admin tools.
Attackers gained access to Okta's customer support system through a compromised service account. They exfiltrated HAR files (HTTP Archive) containing session tokens, then used these tokens to impersonate legitimate users at downstream customers like BeyondTrust, Cloudflare, and 1Password.
Trust Services Criteria for service organizations. Focus on Security, Availability, Processing Integrity, Confidentiality, and Privacy.
International standard for Information Security Management Systems (ISMS). Annex A contains 93 controls.
Cybersecurity Framework with six functions: Govern, Identify, Protect, Detect, Respond, Recover.
Payment Card Industry Data Security Standard. Required for any organization handling cardholder data.
Health Insurance Portability and Accountability Act. Protects electronic Protected Health Information (ePHI).
Center for Internet Security prioritized security actions. 18 control families with implementation groups.
The Lead Developer needs to update the game's main server. This requires "Superuser" powers that can delete the entire player database. You don't want them to have this power active while they're just checking email or chatting on Discord.
The developer should request elevated privileges only when needed, receive them for a limited time (like 30 minutes), and have them automatically revoked when the time expires. All actions during this period should be logged and monitored.
Implementation: Use a PAM solution where the developer "checks out" admin credentials from a vault, which automatically expire and rotate. Require approval for high-risk operations.
A hacker stole the password of a Customer Support rep. The hacker is trying to log in at 3:00 AM from a country where the company doesn't even have offices. Usually, this rep only logs in from Los Angeles during the day.
ABAC evaluates multiple attributes: WHO (support rep), WHEN (3 AM vs business hours), WHERE (foreign country vs Los Angeles), and WHAT (trying to access customer data). The unusual time and location would trigger automatic denial.
Additional Defense: This should also trigger alerts for potential account compromise and require step-up MFA re-authentication. Implement impossible travel detection in your SIEM.
You want to make sure an employee can't secretly send $1,000 refunds to their own bank account. You decide that the person who requests a refund cannot be the same person who approves and sends the payment.
By requiring different people to initiate and approve refunds, you prevent a single person from committing fraud. This is a classic implementation of SoD.
Best Practice: Implement a workflow where: Person A requests refund → Person B reviews and approves → System automatically processes (or Person C executes). Use IGA tools to detect toxic access combinations.
An attacker has obtained valid credentials for one of your developers. They start sending dozens of MFA push notifications to the developer's phone at 2 AM, hoping they'll approve one just to make it stop.
Several controls mitigate MFA fatigue:
Key Points to Cover:
RBAC Advantages:
ABAC Advantages:
Recommendation: Start with RBAC for baseline access, layer ABAC for fine-grained controls. Most enterprises use a hybrid approach.
Zero Trust Implementation Pillars:
Implementation Approach:
Authentication (AuthN): Verifies WHO you are
Authorization (AuthZ): Determines WHAT you can do
Key Point: Authentication happens first, then authorization. You must know who someone is before you can determine what they're allowed to do.
Detection Methods:
Response Playbook:
Now that your Security Brain understands the concepts, you're ready to implement them in real environments!