Identity and Access Management (IAM)

IAM covers people and also service and system accounts. In enterprise IT, identity management means establishing and managing the roles and access privileges of individual network users. IAM systems carry out credential management, authentication, and authorization, functions that are foundational to security.

CISA and NSA guidance groups IAM practice into identity governance, environmental hardening, identity federation and single sign-on, multi-factor authentication, and IAM auditing and monitoring. Identity governance manages the lifecycle of each identity through join, move, and leave events: creating accounts for new staff, granting and removing entitlements when a role changes, and promptly ending accounts and privileges when someone leaves.

Attackers target IAM because access through legitimate accounts mimics legitimate activity and is harder to detect. Common techniques include creating new accounts to maintain persistence, taking over accounts of former employees that were not suspended, forging authentication assertions, and compromising passwords through phishing, MFA bypass, credential stuffing, and password spraying.

IAM products are software and have vulnerabilities of their own, so they must be patched, updated, and managed. A vulnerable IAM solution can open access to many systems and data across an organization, which is why the guidance treats securing IAM infrastructure as critical.