IAM Principles
Learn the fundamental principles that govern effective identity and access management systems.
Authentication
Authorization
Accountability
IAM is built on three core pillars: Authentication (proving who you are), Authorization (determining what you can access), and Accountability (tracking what you do). These form the foundation of all IAM systems.
# IAM Core Principles
iam_principles = {
"authentication": {
"definition": "Verification of claimed identity",
"methods": ["Something you know", "Something you have", "Something you are"],
"factors": {
"knowledge": "Passwords, PINs, security questions",
"possession": "Tokens, smart cards, mobile devices",
"inherence": "Biometrics, behavioral patterns"
},
"best_practices": ["Multi-factor authentication", "Strong password policies", "Regular credential updates"]
},
"authorization": {
"definition": "Granting or denying access to resources",
"models": ["RBAC", "ABAC", "DAC", "MAC"],
"principles": {
"least_privilege": "Minimum necessary access",
"need_to_know": "Access based on business requirement",
"separation_of_duties": "No single person controls entire process"
},
"implementation": ["Role assignments", "Policy evaluation", "Access decisions"]
},
"accountability": {
"definition": "Tracking and auditing user activities",
"components": ["Audit logs", "Monitoring", "Reporting", "Forensics"],
"requirements": ["Non-repudiation", "Tamper-proof logs", "Compliance reporting"],
"benefits": ["Incident investigation", "Compliance proof", "Risk detection"]
}
}
Identity Lifecycle
Understand the complete lifecycle of digital identities from creation to deletion.
Identity Lifecycle Stages:
• Provisioning: Creating new identities and initial access
• Management: Ongoing maintenance and updates
• Monitoring: Continuous oversight and compliance
• Modification: Changes in roles, permissions, attributes
• Suspension: Temporary deactivation of access
• De-provisioning: Permanent removal of identity and access
Lifecycle Automation:
Manual identity lifecycle management is error-prone and inefficient. Automated workflows triggered by HR systems, directory changes, or business events ensure consistent and timely identity management.
# Identity Lifecycle Management
identity_lifecycle = {
"provisioning": {
"triggers": ["New hire", "Role change", "System onboarding"],
"activities": [
"Create user account",
"Assign initial roles and permissions",
"Set up authentication credentials",
"Configure access to required systems"
],
"validation": ["Manager approval", "Security review", "Compliance check"]
},
"management": {
"activities": [
"Password resets",
"Profile updates",
"Permission modifications",
"Role assignments"
],
"governance": ["Access reviews", "Certification campaigns", "Policy compliance"]
},
"deprovisioning": {
"triggers": ["Termination", "Role change", "System retirement"],
"activities": [
"Disable accounts",
"Revoke access permissions",
"Transfer data ownership",
"Archive identity records"
],
"timeline": "Immediate for security, grace period for data access"
}
}
Access Control Models
Explore different access control models and their appropriate use cases in organizations.
Common Access Control Models:
• RBAC (Role-Based): Access based on organizational roles
• ABAC (Attribute-Based): Access based on attributes and policies
• DAC (Discretionary): Resource owners control access
• MAC (Mandatory): System-enforced security classifications
• PBAC (Policy-Based): Rule-driven access decisions
Model Selection Criteria:
Choose access control models based on organizational structure, compliance requirements, security needs, and operational complexity. Many