IAM Flashcards
What are the core concepts of IAM
Identity management
Authentication
Authorisation
Access management
Governance and compliance
Monitoring and intelligence
Life cycle management
It’s crucial for securing the organisation’s resources and implementing least privilege access. Helps protect sensitive information, streamline user access and enhance overall security posture.
Explain identity management
Creation, maintenance and deletion of accounts, each user or app has a unique identity, which can self serve for profile updates and password resets
What is authentication
Verifying the identity of users, devices or systems. Verifying that a party is who they say they are. Includes MFA, SSO, biometrics, certificates etc.
What is authorisation
Determines what a user is allowed to do. RBAC and ABAC (attribute) and policy based control mechanisms. Conditional access for example.
What is access management
Ensuring users have access to appropriate resources. Should be able to request access using workflow/automation. PIM controls privileged access, is a form of PAM.
Governance and compliance
Adhering to regulatory requirements, internal policies and industry standards. Auditing, reporting, policy management, and risk management.
What are monitoring and intelligence
Involve continuously analysing user activities to detect and respond to anomalies and security threats.
In Entra ID examples are Identity protection, built in logs that can be sent to SIEM or SOAR for correlation.
What is lifecycle management.
Covers the entire identity lifecycle, initial provisioning and de-provisioning/account cleanup. Includes lifecycle events, department moves, promotions, long term absence etc.
Entra identity governance
Additional licence
Inbound, outbound and sync provisioning
Identity lifecycles
Entitlement management
PIM
Access reviews
Entra identity governance
Additional licence
Inbound, outbound and sync provisioning
Identity lifecycles
Entitlement management
PIM
Access reviews
