NISTISOOWASP

🔑 IAM & IGA

Identity & Access Management and Governance — authentication, authorization, MFA, SSO, RBAC/ABAC, PAM, access certification, role management, SOD policies, and compliance.

Vani

Choose a section to learn

Overview

Identity & Access Management (IAM) is the framework of policies and technologies to ensure the right individuals access the right resources at the right time for the right reasons. IAM covers authentication (proving you are who you say), authorization (what you can do), and governance (managing the lifecycle). It's the foundation of zero trust and cloud security.

Key Concepts

Authentication (AuthN)

Verifying identity — passwords, MFA (TOTP, FIDO2, biometrics), passwordless, certificate-based, and risk-based adaptive authentication.

Authorization (AuthZ)

Determining access rights — RBAC (Role-Based), ABAC (Attribute-Based), PBAC (Policy-Based), and ReBAC (Relationship-Based) models.

SSO (Single Sign-On)

One authentication event grants access to multiple applications. Protocols: SAML 2.0, OAuth 2.0, OpenID Connect (OIDC).

MFA (Multi-Factor Authentication)

Combining two or more factors: something you know (password), something you have (token/phone), something you are (biometrics).

PAM (Privileged Access Management)

Securing, controlling, and monitoring privileged accounts. Includes session recording, just-in-time access, password vaulting, and privilege elevation.

Identity Lifecycle

Joiner-Mover-Leaver processes. Automated provisioning, role changes, and de-provisioning tied to HR systems and identity governance.

Access Certification (IGA)

Periodic access reviews where managers certify or revoke user entitlements. Ensures compliance with SOX, HIPAA, and regulatory requirements.

Segregation of Duties (SOD)

IGA policy preventing conflicts of interest — e.g., same person cannot both create and approve purchase orders. Enforced through preventive and detective controls.

IAM Architecture Flow

👤 User Request (Login / Access Resource)

↓

🔐 Authentication (MFA / SSO / Passwordless)

↓

📋 Authorization (RBAC / ABAC Policy Engine)

↓

✅ Access Granted / Denied + Session Token

↓

📊 Audit Logging + Anomaly Detection

IAM Authentication & Authorization Flow

From user request through authentication, authorization, to audit

Interview Preparation

💡 Interview Question

What is the difference between RBAC and ABAC?

RBAC (Role-Based Access Control) assigns permissions based on predefined roles (e.g., 'Admin', 'Editor', 'Viewer'). It's simple, well-understood, but can lead to role explosion. ABAC (Attribute-Based Access Control) evaluates attributes (user department, resource classification, time of day, location) against policies to make dynamic access decisions. ABAC is more flexible and granular — e.g., 'allow access if user.department == resource.owner AND time is business hours AND location is corporate network'. Best practice: use RBAC for broad permissions and layer ABAC for fine-grained context-aware access.