Identity and Access Management: The Foundation of Modern Security

The Identity-First Security Paradigm

For decades, enterprise security was built around the network perimeter. Cloud adoption, remote work, and the SaaS explosion have invalidated this model. Identity has replaced the network as the primary security boundary.

The question security controls must answer has changed from "is this traffic inside the corporate network?" to "is this request from an authenticated, authorised identity with a legitimate purpose, using a compliant device, under circumstances consistent with legitimate use?"

Failures in IAM are directly implicated in a majority of significant security incidents. A mature IAM programme is the highest-leverage security investment available to most organisations.

Core IAM Capabilities

Identity Governance and Administration

In most organisations without dedicated governance: access accumulates over years without review, employees retain permissions from roles they left years ago, and no one has a complete picture of who can access what.

Access certification — periodic reviews by resource owners and reporting managers — confirms which users should retain specific access and identifies access for revocation. Certifications should be risk-tiered: privileged access reviewed quarterly, standard access annually.

Role-based access control (RBAC) replaces individual access assignment with role-based provisioning, making access management scalable and review meaningful.

Automated provisioning and deprovisioning tied to HR system events ensures access is granted on day one and revoked within hours of offboarding notification.

Authentication: Moving Beyond Passwords

The password problem is well understood. MFA blocks more than 99.9% of account compromise attacks according to Microsoft's telemetry.

Not all MFA is equal:

SMS OTP — vulnerable to SIM swapping and SS7 attacks. Not recommended for corporate authentication.

TOTP apps — not vulnerable to SIM swapping but still vulnerable to real-time phishing where attackers capture codes before expiry.

FIDO2/WebAuthn (passkeys and hardware security keys) — the current gold standard. Authentication is cryptographically bound to the specific application origin and cannot be used by a fake site — phishing-resistant by design.

Privileged Access Management

Privileged accounts represent the most valuable targets. PAM addresses their management through:

Credential vaulting — encrypted, audited storage of privileged credentials. Access to the vault requires authentication and is fully logged.

Just-in-time (JIT) privileged access — elevated permissions granted only for the duration of a specific task, automatically revoking afterward. Even a compromised administrator session has limited time window for elevated access.

Privileged session recording — administrative sessions recorded for forensic purposes and accountability.

Single Sign-On

SSO centralises authentication through an identity provider. Benefits: MFA enforced centrally applies to all connected applications; deprovisioning the identity provider immediately revokes access to all connected applications; authentication events visible in a single audit log.

Zero Trust Architecture and IAM

Zero Trust operationalises the identity-first paradigm:

Continuous verification — risk-based authentication challenges triggered by anomalous behaviour: unusual access pattern, new device, unexpected location.

Least-privilege access — permanent standing access progressively replaced by JIT access.

Device health as access condition — unpatched or compromised devices don't receive the same access as healthy, compliant ones.

Building IAM Maturity

Foundation: MFA for all users. SSO for the primary application portfolio. Automated provisioning and deprovisioning.

Intermediate: PAM for privileged accounts. RBAC for major systems. Regular access certification.

Advanced: JIT privileged access. Risk-based authentication with step-up for high-risk access. Device health integrated into access decisions.

Mature: Continuous verification. Behavioural anomaly detection. Automated remediation of policy violations.

Every major security framework — NIST CSF, ISO 27001, CIS Controls — prominently features IAM controls because the evidence for their effectiveness is overwhelming.