Identity and Access Management: Concepts and Policies

Identity and Access Management: Concepts and Policies

Identity and Access Management (IAM) is the discipline of ensuring that the right people have the right access to the right resources — and that nothing more is granted than is necessary. Every major security framework, including NIST guidelines and the CompTIA Security+ exam blueprint, treats IAM as foundational. Understanding IAM starts with four core concepts often called IAAA.

The IAAA Framework

Identification is the act of claiming an identity. When you type a username into a login screen, you are identifying yourself. The system does not yet know whether you are who you claim to be.

Authentication is the process of proving that claim. Passwords, smart cards, biometrics, and one-time codes are all authentication mechanisms. Authentication factors fall into three categories: something you know (password or PIN), something you have (token or smart card), and something you are (fingerprint or retina scan). Using two or more factors together is called multi-factor authentication (MFA) and is a widely recommended control.

Authorization determines what an authenticated identity is permitted to do. Even after proving who you are, the system consults its access control rules to decide which files you may read, which systems you may reach, and which actions you may perform. Authorization should always follow the principle of least privilege: grant only the permissions needed to perform a job function, nothing more.

Accounting (also called auditing) records what authenticated users do after they gain access. Logs of login times, files accessed, and commands executed are the primary product of accounting. These records support forensic investigation, compliance reporting, and anomaly detection.

Access Control Models

Organizations implement authorization through access control models. Four models appear consistently on industry exams and in real-world policy.

Discretionary Access Control (DAC)

In DAC, the owner of a resource decides who may access it. A user who creates a file can share it with colleagues as they see fit. Most consumer operating systems (Windows NTFS permissions set by file owners, for example) use DAC. DAC is flexible but risky: a careless or compromised owner can grant excessive access without IT oversight.

Mandatory Access Control (MAC)

In MAC, a central authority — not the resource owner — sets access rules based on classification labels. Data is labeled (for example, Unclassified, Secret, Top Secret) and users hold a clearance level. The operating system enforces the policy and users cannot override it. MAC is common in government and military environments where information sensitivity is formally classified. It provides strong control but is administratively demanding.

Role-Based Access Control (RBAC)

In RBAC, permissions are assigned to roles, and users are assigned to roles rather than receiving permissions directly. A "Payroll Clerk" role might include read access to salary records; an "HR Manager" role might add write access. RBAC scales well in organizations because role definitions are reused across many users. It is the most widely deployed model in corporate environments today.

Attribute-Based Access Control (ABAC)

ABAC grants access based on attributes of the user, the resource, and the environment evaluated together. A policy might say: "Allow access if the user's department is Finance AND the resource is labeled Budget AND the time is between 0800 and 1800 on a weekday." ABAC is highly flexible and can enforce context-aware policies, but it is also the most complex to configure and troubleshoot.

Key Policies: Least Privilege and Separation of Duties

Two policy principles reinforce every access control model.

Least privilege means every user, process, and service account holds only the minimum permissions required for its function. Reviewing and trimming permissions periodically — often called access recertification or access review — is a required control in frameworks such as NIST SP 800-53.

Separation of duties (SoD) means that no single person should control all steps of a sensitive process. In financial systems, the person who requests a payment should not also be the person who approves and executes it. In IT, the administrator who deploys code should not also be the person who approves the change. SoD limits the damage any single compromised or dishonest account can cause.

Physical and Logical Safety Considerations

While IAM is primarily a logical (software) control, physical access control integrates with it. Badge readers, biometric turnstiles, and key card systems are physical implementations of the same IAAA principles. When working in data centers or server rooms, follow site safety rules: never prop doors open (defeating physical access control), escort all visitors, and report tailgating immediately. Logical controls and physical controls must be aligned — a strong password policy is weakened if an unauthorized person can walk up to an unlocked console.

Applying the Models

Choosing the right model depends on the organization's risk tolerance, regulatory requirements, and operational complexity. Government agencies handling classified data typically mandate MAC. Large enterprises commonly use RBAC as a baseline and layer ABAC on top for cloud or zero-trust architectures. Smaller organizations or shared workstations often rely on DAC, accepting the tradeoff in control for simplicity.

When analyzing any access control policy, look for accounts with more privilege than their role requires, shared accounts (which break accountability), and critical processes controlled entirely by one person. These are the gaps that attackers exploit and that auditors flag.