IAM Foundations: The Security Brain

Master the Core Concepts Before Your Hands-On Labs

🧠 The Security Brain of Enterprise

Think of Identity and Access Management (IAM) as the "Security Brain" of a giant digital castle. This brain is responsible for knowing exactly who every person is and making sure they don't have too much power.

🔐
Authentication
Who are you?
🎯
Authorization
What can you do?
📊
Accounting
What did you do?
🛡️
Administration
How do we manage it?

📋 Fundamental Security Principles

🔒
Need-to-Know (Confidentiality)
Even if you're a high-level manager, you shouldn't see a file unless you specifically need it for your current task.
Example: The CEO doesn't get access to the HR system's salary database unless they're actively reviewing compensation.
⚡
Least Privilege (Integrity)
You should only have the minimum "powers" that you absolutely need to do your job.
Example: A student can read their grades but cannot edit them. A teacher can edit grades but only for their own classes.
🎭
Separation of Duties (SoD)
Critical tasks are split between multiple people to prevent fraud or errors.
Example: The person who creates a purchase order cannot be the same person who approves the payment.
🔄
Defense in Depth
Multiple layers of security controls, so if one fails, others still protect.
Example: Password + MFA + Device Trust + Network Location = Multiple barriers.
👁️
Zero Trust
"Never trust, always verify" - assume breach and verify every request.
Example: Even inside the network, every access request is authenticated and authorized.
⏱️
Time-Based Access
Access rights that automatically expire after a set period.
Example: Contractor accounts automatically disable after project end date.

🎮 Access Control Models

💡
Key Insight: Organizations typically use a combination of these models, not just one.
👥
RBAC (Role-Based Access Control)
Access based on your job title or role in the organization. Instead of giving permissions to "Alex," give permissions to the "Editor" role.
Example: All "Developers" can access the code repository. All "Accountants" can access the financial system.
🏷️
ABAC (Attribute-Based Access Control)
The smartest model - looks at the context: WHO you are, WHAT you're accessing, WHEN, WHERE, and HOW.
Example: You can access the server (Role), but ONLY between 9 AM-5 PM (Time) from a company laptop (Device) in the office (Location).
🏛️
MAC (Mandatory Access Control)
Government/military style - strict levels like "Top Secret," "Secret," "Confidential," "Unclassified."
Example: Someone with "Secret" clearance cannot access "Top Secret" documents, period.
📝
DAC (Discretionary Access Control)
The owner of a resource decides who can access it.
Example: You create a document and choose to share it with specific teammates.
Model Best For Complexity Flexibility
RBAC Medium to large organizations with defined roles Medium Moderate
ABAC Complex environments needing fine-grained control High Very High
MAC Government, military, high-security environments High Very Low
DAC Small teams, collaborative environments Low High

👑 Privileged Access Management (PAM)

The Crown Jewels of Security

Some accounts are more dangerous than others. Privileged accounts (like "Admins") have the power to delete the whole system. PAM keeps them on a tight leash.

⏰
Just-In-Time (JIT) Access
Admins don't walk around with "God Mode" on all day. They "check out" privileges only when needed.
Example: Need to fix a server? Request admin access for 30 minutes. After that, it automatically expires.
📹
Session Recording
Every action taken with privileged access is recorded like a security camera.
Example: Admin sessions are recorded so you can replay exactly what commands were run.
🔑
Vault Management
Passwords for privileged accounts are stored in a secure vault and rotated automatically.
Example: Database admin password changes every hour, and only the vault knows the current one.
🚨
Privilege Escalation Detection
Detect when a hacker tries to "level up" from a regular user to admin.
Example: Alert when a normal user account suddenly tries to run admin commands.
✅
Approval Workflows
High-risk actions require approval from multiple people.
Example: Deleting a production database requires approval from both IT Manager and Security team.
🔄
Break-Glass Procedures
Emergency access process for critical situations, with heavy auditing.
Example: System is down at 3 AM? Use break-glass account, but expect a security review tomorrow.

🔄 The IAM Lifecycle

👶
Provisioning
🎯
Authentication
🔐
Authorization
📊
Monitoring
🔄
Re-certification
💀
Deprovisioning
⚠️
Critical: Deprovisioning is the most important step! When someone is fired or leaves, their digital identity must be "killed" instantly to prevent revenge attacks.

⚖️ Checks and Balances

👥
Two-Person Control
Like a bank vault with two keys - certain actions require two different people.
Example: Transferring $1 million requires both the CFO and CEO to approve.
🔄
Job Rotation
Regularly rotate people through sensitive positions to prevent long-term fraud.
Example: The person managing wire transfers changes every 6 months.
🏖️
Mandatory Vacations
If someone is hiding illegal activity, they usually need to be present to cover it up.
Example: Financial controllers must take 2 consecutive weeks off annually - fraud often surfaces when they're gone.
🔍
Regular Audits
Periodic review of who has access to what and whether they still need it.
Example: Quarterly review: "Does Bob from marketing still need access to the customer database?"

⚠️ Real-World Security Hazards

📋
Due Care vs Due Diligence
Due Care = Doing the right thing. Due Diligence = Verifying it was done right.
Example: Due Care: Setting up passwords. Due Diligence: Checking if they've been leaked.
✈️
Travel Security
Hackers love travelers - free WiFi, hotel rooms, and tired people make easy targets.
Example: Always use VPN on hotel WiFi, never leave devices unattended, use privacy screens.
📦
Asset Management
You can't protect what you don't know you have.
Example: That forgotten test server from 2019? It's probably unpatched and vulnerable.
🚪
Fail-Safe vs Fail-Secure
Fail-Safe: Opens on failure (fire exits). Fail-Secure: Locks on failure (bank vault).
Example: Emergency exits fail-safe (unlock). Server rooms fail-secure (stay locked).
👻
Shadow IT
Unauthorized apps and services that employees use without IT approval.
Example: Marketing using personal Dropbox for customer data instead of approved storage.
🎣
Social Engineering
The human is often the weakest link - hackers exploit trust and helpfulness.
Example: "Hi, I'm the new IT guy. Can you give me your password to fix your email?"

🎮 Test Your Security Brain!

💡
Challenge: You're the Lead Security Architect for a major video game company. Apply the right security concept to each scenario!
1
The "God Mode" Problem

The Lead Developer needs to update the game's main server. This requires "Superuser" powers that can delete the entire player database. You don't want them to have this power active while they're just checking email or chatting on Discord.

❓ Which security concept should you apply?
💡 Hint: Think about temporary access that expires automatically...

✅ Answer: Just-In-Time (JIT) Access / PAM

The developer should request elevated privileges only when needed, receive them for a limited time (like 30 minutes), and have them automatically revoked when the time expires. All actions during this period should be logged and monitored.

Implementation: Use a PAM solution where the developer "checks out" admin credentials from a vault, which automatically expire and rotate.

2
The "Remote Sneak" Attack

A hacker stole the password of a Customer Support rep. The hacker is trying to log in at 3:00 AM from a country where the company doesn't even have offices. Usually, this rep only logs in from Los Angeles during the day.

❓ Which Access Model would automatically block this?
💡 Hint: It's not just about the role; it's about the context...

✅ Answer: ABAC (Attribute-Based Access Control)

ABAC evaluates multiple attributes: WHO (support rep), WHEN (3 AM vs business hours), WHERE (foreign country vs Los Angeles), and WHAT (trying to access customer data). The unusual time and location would trigger automatic denial.

Additional Defense: This should also trigger alerts for potential account compromise and require MFA re-authentication.

3
The "Fake Refund" Fraud

You want to make sure an employee can't secretly send $1,000 refunds to their own bank account. You decide that the person who requests a refund cannot be the same person who approves and sends the payment.

❓ What security principle is this?
💡 Hint: It's about splitting power between people...

✅ Answer: Segregation/Separation of Duties (SoD)

By requiring different people to initiate and approve refunds, you prevent a single person from committing fraud. This is a classic implementation of SoD.

Best Practice: Implement a workflow where: Person A requests refund → Person B reviews and approves → System automatically processes (or Person C executes).

4
The "New Hire" Setup

A new intern just started in the Art Department. Instead of manually picking 50 different folders they need access to, you just put them into the "Artist" group, and the system automatically gives them all the right permissions.

❓ Which Access Model are you using?
💡 Hint: It's based on their job title...

✅ Answer: RBAC (Role-Based Access Control)

By assigning the intern to the "Artist" role, they automatically inherit all permissions associated with that role. This is much more efficient than individual permission assignment.

Benefits: Easy to manage, scalable, reduces errors, and when the intern's role changes or they leave, you just remove them from the group.

✅ Knowledge Check - Are You Ready for Labs?
  • I understand the difference between authentication and authorization
  • I can explain Need-to-Know and Least Privilege principles
  • I know when to use RBAC vs ABAC
  • I understand what PAM is and why it's critical
  • I can explain Just-In-Time access
  • I understand Separation of Duties
  • I know the IAM lifecycle stages
  • I understand the importance of deprovisioning
  • I can identify security hazards like Shadow IT
  • I understand Fail-Safe vs Fail-Secure
📋 Quick Reference Cheat Sheet
RBAC
Access based on your Job Title
ABAC
Access based on Time, Location, Device, and more
PAM
Special locks for "Superuser" accounts
SoD
Splitting one job between two people
Least Privilege
Minimum power needed to do the job
JIT Access
Temporary privileges that auto-expire
Zero Trust
Never trust, always verify
MFA
Multiple factors to prove identity
Deprovisioning
Removing all access when someone leaves
🚀 Ready for Hands-On Labs!

Now that your Security Brain understands the concepts, you're ready to implement them in real environments!

Your Learning Path:

  1. ✅ IAM Foundations (You are here!)
  2. → Microsoft Security Labs
  3. → Zero Trust Implementation
  4. → Privileged Access Management
  5. → Identity Governance