identity and access management

What is identity and access management?

Identity and access management (IAM) is a framework of policies and technologies to ensure that the right users (in an enterprise) have the appropriate access to technology resources.

Identity and access management (IAM) ensures that the right people and job roles in your organization (identities) can access the tools they need to do their jobs. Identity management and access systems enable your organization to manage employee apps without logging into each app as an administrator. .

Why do you need IAM?

Companies need IAM to provide online security and to increase employee productivity.

·         Security. Traditional security often has one point of failure - the password. If a user's password is breached - or worse yet, the email address for their password recoveries - your organization becomes vulnerable to attack. IAM services narrow the points of failure and backstops them with tools to catch mistakes when they're made.

·         Productivity. Once you log on to your main IAM portal, your employee no longer has to worry about having the right password or right access level to perform their duties. Not only does every employee get access to the perfect suite of tools for their job, their access can be managed as a group or role instead of individually, reducing the workload on your IT professionals.

 

What is AWS identity and access management?

Amazon Web Services (AWS) identity and access management is simply the IAM system that is built into AWS. By using AWS IAM, you can create AWS users and groups and grant or deny them access to AWS services and resources. AWS IAM is available free of charge.

AWS IAM service provides:

·         Fine-grained access control to AWS resources

·         AWS multi-factor authentication

·         Analysis features to validate and fine tune policies

·         Integration with external identity management solutions.

How Does IAM Work?

The IAM workflow includes the following six elements:

1.    A principal is an entity that can perform actions on an AWS resource. A user, a role or an application can be a principal.

2.    Authentication is the process of confirming the identity of the principal trying to access an AWS product. The principal must provide its credentials or required keys for authentication.

3.    Request: A principal sends a request to AWS specifying the action and which resource should perform it.

4.    Authorization: By default, all resources are denied. IAM authorizes a request only if all parts of the request are allowed by a matching policy. After authenticating and authorizing the request, AWS approves the action.

5.    Actions are used to view, create, edit or delete a resource.

6.    Resources: A set of actions can be performed on a resource related to your AWS account.

 

What tools do I need to implement identity and access management?

The tools needed to implement IAM include password-management tools, provisioning software, security-policy enforcement applications, reporting and monitoring apps and identity repositories. IAM tools can include, but are not limited to:

·         MFA
Multi-factor authentication means that your IAM provider requires more than one type of proof that you are who you say you are. A typical example is requiring both a password and a fingerprint. Other MFA choices include facial recognition, iris scans, and physical tokens like a Yubi key.

·         SSO
SSO stands for single sign-on. If your IAM solution provides single sign-on, that means your users can sign in only once and then treat the identity and access management tool as a "portal" to the other software suites they have access to, all without signing in to each one.

Components of IAM

·         Users ---An IAM user is an identity with an associated credential and permissions attached to it

·       Groups-- A collection of IAM users is an IAM group

·       Policies-- An IAM policy sets permission and controls access to AWS resources. Policies are stored in AWS as JSON documents

·       Roles-- An IAM role is a set of permissions that define what actions are allowed and denied by an entity in the AWS console

 What is the difference between identity management and access management?

Identity management confirms that you are you and stores information about you. An identity management database holds information about your identity - for example, your job title and your direct reports - and authenticates that you are, indeed, the person described in the database.

Access management uses the information about your identity to determine which software suites you're allowed access to and what you're allowed to do when you access them. For example, access management will ensure that every manager with direct reports has access to an app for timesheet approval, but not so much access that they can approve their own timesheets.

IAM technologies

An IAM system is expected to be able to integrate with many different systems. Because of this, there are certain standards or technologies that all IAM systems are expected to support: Security Access Markup Language, OpenID Connect, and System for Cross-domain Identity Management.

·         Security Access Markup Language (SAML)
SAML is an open standard used to exchange authentication and authorization information between an identity provider system such as an IAM and a service or application. This is the most commonly used method for an IAM to provide a user with the ability to log in to an application that has been integrated with the IAM platform.

·         OpenID Connect (OIDC)
OIDC is a newer open standard that also enables users to log in to their application from an identity provider. It is very similar to SAML, but is built on the OAuth 2.0 standards and uses JSON to transmit the data instead of XML which is what SAML uses.

·         System for Cross-domain Identity Management (SCIM)
SCIM is standard used to automatically exchange identity information between two systems. Though both SAML and OIDC can pass identity information to an application during the authentication process, SCIM is used to keep the user information up to date whenever new users are assigned to the service or application, user data is updated, or users are deleted. SCIM is a key component of user provisioning in the IAM space.