Identity and Access Management Introduction

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Time
7 hours 50 minutes
Difficulty
Beginner
CEU/CPE
8
Video Transcription
00:00
>> Welcome back. We have made it to the last chapter.
00:00
Here, we'll be talking about
00:00
identity and access management,
00:00
which is a field that is exploding and
00:00
evolving today. It's exciting.
00:00
We'll start out by covering what
00:00
Identity and Access Management, or IAM is.
00:00
The four main areas of IAM are Identification,
00:00
Authentication, Authorization, and Auditing.
00:00
These all relate to how we manage the users or
00:00
entities who are going to access our network.
00:00
Let's define what Identity and Access Management is.
00:00
Like I said, you'll hear it called IAM.
00:00
It specifies the processes for giving access to users.
00:00
These processes fall into the four I
00:00
triple A categories of Identification,
00:00
Authentication, Authorization, and Auditing.
00:00
Anytime a subject,
00:00
such as a person,
00:00
wants access to an object
00:00
such as a folder and a directory,
00:00
the subject needs to
00:00
identify and make a claim of who they are,
00:00
then they should have to
00:00
authenticate to prove their identity.
00:00
Then we should check their authorization
00:00
and see if their account is
00:00
authorized to access that folder
00:00
before allowing them to access it.
00:00
Finally, auditing means having a record and
00:00
accountability of the actions
00:00
a user has taken on the network.
00:00
That's the whole access management set of processes.
00:00
Now, we start off with identification.
00:00
But even before the identification process happens,
00:00
typically a company will have done
00:00
some identity proofing to confirm
00:00
a person is who they say they are
00:00
before they are hired and given access to the system.
00:00
For example, you provide
00:00
human resources with a social security card,
00:00
a passport, and so forth to prove who you are.
00:00
Then after the person is hired,
00:00
a new user account will be provisioned for that person.
00:00
That provisioning process also
00:00
includes giving the user access to
00:00
particular systems or parts of
00:00
the system with specific permissions and so forth.
00:00
The account will include identifier for the user,
00:00
typically in the form of a username.
00:00
The organization should use
00:00
a standardized naming convention
00:00
for each person's identifier.
00:00
A lot of times it's last name first initial,
00:00
or first initial last name, that type of thing.
00:00
The identifier for each person should be unique.
00:00
You don't want to have any cases where
00:00
a single account is shared by multiple people
00:00
because then you don't have
00:00
the auditing capability to keep
00:00
track of what each individual does.
00:00
There are also other scenarios
00:00
where identification takes place.
00:00
What I've been talking about so far is a person
00:00
logging in and gaining access to a network.
00:00
But it can also apply when
00:00
my computer system makes
00:00
a connection to a port on a switch.
00:00
Maybe that switch has MAC filtering enabled
00:00
and my system has to provide its MAC address,
00:00
and that's how it identifies,
00:00
or some policies are set up based on IP address.
00:00
Sometimes this identification process is
00:00
happening underneath the surface and you and I,
00:00
as users, don't even see it.
00:00
But when a subject accesses an object,
00:00
that first step is still going
00:00
>> to involve identification.
00:00
>> Now, the problem is,
00:00
unless the person provides some proof,
00:00
then identification is easily spoofed,
00:00
I can claim to be a network administrator,
00:00
but that doesn't make it true.
00:00
What we'll follow up identification with is
00:00
authentication and that's what we'll cover next.
Up Next