Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Identity and Access Management
Identity is the new perimeter
With cloud services, remote working and SaaS, there’s no single network edge to defend. Most attacks now start with a stolen, weak or over-privileged account. That makes identity and access management (IAM) one of the program’s most important control areas. CISA covers IAM mechanics in depth; this article takes the security manager’s view.
The parts of IAM
| Component | Key controls |
|---|---|
| Identity life cycle | Joiner, mover and leaver processes driven by HR |
| Authentication | MFA everywhere; phishing-resistant MFA for admins and remote access |
| Authorisation | Role-based access, least privilege, need-to-know, segregation of duties |
| Privileged access | Vaulting, just-in-time access, session recording |
| Access reviews | Owners recertify access regularly |
| Federation and SSO | One identity across cloud and SaaS, so controls apply everywhere |
Joiners, movers, leavers
- Joiners get access based on their role, approved by the information owner.
- Movers lose old access when they change roles, or access creeps up over time.
- Leavers are disabled promptly, ideally automatically from the HR system.
- Recertification: owners regularly confirm that access is still needed.
Privileged access
Administrators can bypass controls and erase evidence, so their access gets the tightest control: few accounts, separate admin and everyday accounts, vaulted and rotated credentials, just-in-time elevation, phishing-resistant MFA, session recording, and logs that admins can’t alter.
Example. Ransomware operators usually hunt for domain admin credentials. A company that vaults admin passwords, issues them just-in-time for four hours and requires phishing-resistant MFA makes that hunt far harder, and every privileged session is recorded.
Governance of access
- Information owners approve access and recertify it.
- Access requests and approvals are recorded.
- Leavers are disabled within hours, triggered by HR.
- Machine identities (service accounts, API keys) have owners and rotated credentials.
- Metrics: MFA coverage, orphan accounts, review completion, time to remove leavers.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who approves access to data? | The information owner |
| Best control over administrator accounts | Privileged access management |
| Best way to detect access creep | Periodic access reviews by owners |
| Trigger for removing a leaver’s access | HR notification, automated where possible |
| Strongest MFA for administrators | Phishing-resistant MFA (FIDO2 or smart card) |
In short
- IAM makes sure the right people (and machines) have the right access, for the right reasons, at the right time, and that it's removed when no longer needed.
- The identity life cycle (joiner, mover, leaver) should be driven by HR, with access approved by information owners.
- MFA is a baseline control; phishing-resistant MFA (FIDO2, passkeys, smart cards) is expected for privileged and remote access.
- Authorisation follows least privilege and need-to-know, typically through role-based access.
- Privileged access management (PAM) vaults admin credentials, grants just-in-time access and records sessions.
- Regular access reviews by owners catch access creep and orphan accounts; results are evidence for auditors.
Exam traps
- Access is approved by the information owner, not by IT or the security administrator.
- Access reviews done only by IT don't confirm business need.
- Service accounts and API keys are identities too, and are often forgotten.
- SSO without MFA concentrates risk in one password.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The parts of IAM
Joiners, movers, leavers
Privileged access
ExampleRansomware operators usually hunt for domain admin credentials. A company that vaults admin passwords, issues them just-in-time for four hours, and requires phishing-resistant MFA makes that hunt far harder, and every privileged session is recorded.
1 / 9