Educator: Identity and Access Management. 2 2
In this lesson, we're going to start to examine 3 3
the idea of identity and access management. 4 4
When I talk about identity and access management, 5 5
this is also called IAM. 6 6
This is a security process that provides the identification, 7 7
authentication, and authorization mechanisms 8 8
for users, computers, and other entities 9 9
to work with organizational assets like networks, 10 10
operating systems, and applications. 11 11
Essentially, when you log onto your computer, 12 12
you're taking place inside of the IAM process 13 13
because you're presenting a username and a password, 14 14
and that's going to authenticate you, 15 15
and that gives you authorization 16 16
to certain things within your network. 17 17
Now, every unique subject in the organization 18 18
is identified and associated with an account. 19 19
Now, when I talk about the term, a unique subject, 20 20
what does that really mean? 21 21
Well, a unique subject could be personnel, 22 22
it could be endpoints, it could be servers, 23 23
it could be softwares, or it could be roles. 24 24
When I'm talking about personnel, 25 25
this is the most common type of IAM that's defined. 26 26
This is people and employees, 27 27
those who have user accounts 28 28
and log onto the system to do stuff with them. 29 29
Now, this is really important 30 30
because most computers aren't there just to be a computer. 31 31
They're there to get some kind of value from it. 32 32
And to get that value from the computer, 33 33
you need people to use it. 34 34
When my computer is just sitting here, it's a paperweight, 35 35
but when I log onto my computer 36 36
and I access the internet to answer your questions, 37 37
I'm providing value. 38 38
And that's why personnel are so important in terms of IAM. 39 39
Now, another thing you have to think about 40 40
when you're talking about personnel with IAM 41 41
is that personnel is also a huge risk area 42 42
because people write down their usernames and passwords, 43 43
and that's a risk. 44 44
People log into places carelessly 45 45
and let their credentials get out, and that's a risk. 46 46
So these are things you have to think about. 47 47
The next area we want to talk about for IAM is endpoints. 48 48
Now, we talk about endpoints, 49 49
these are desktops and laptops and tablets and cell phones, 50 50
and all of these things are endpoints. 51 51
They're devices that people use to gain access 52 52
to a network and be able to do their job. 53 53
So, the personnel is going to have credentials 54 54
to log onto the computer, 55 55
and that computer is going to have credentials 56 56
to log onto the network. 57 57
And sometimes those are the same credentials 58 58
but it's still different from an IAM perspective. 59 59
Because the computer has its own set. 60 60
Because it is a unique subject in the case of IAM. 61 61
Now, the next area we're going to talk about is servers. 62 62
Now, servers are a little bit different than endpoints. 63 63
Endpoints are devices that users are going to log onto, 64 64
but servers are sitting in the back, 65 65
and a lot of times, 66 66
servers are there for machine to machine communication. 67 67
So each server also 68 68
is going to have its own IAM credentials. 69 69
These servers might have mission critical systems 70 70
and encryption schemes 71 71
and other things that are all going on, 72 72
and all of that trust and identity that happens 73 73
behind the scenes happens on these servers. 74 74
So servers are another big part of IAM. 75 75
Another area we have to think about with IAM is software. 76 76
Just like servers, there are different applications 77 77
that can take and feed requests to and from users, 78 78
and that's going to require IAM. 79 79
And so, software can also be a subject 80 80
that has its own unique way, 81 81
and usually this is going to be done using certificates 82 82
like digital certificates to be able to allow 83 83
or disallow a client from doing certain things 84 84
with a certain piece of software. 85 85
And finally, we have roles. 86 86
This is the fifth type of unique subject. 87 87
Roles are going to support the identities of various assets 88 88
by defining the resources an asset has permission to access 89 89
based on the function that the asset is going to fulfill. 90 90
So, when we talk about roles, 91 91
these roles can actually be assigned to servers 92 92
or to people or to endpoints, 93 93
and based on those roles, 94 94
they're going to have different permission sets. 95 95
Now, the great thing here with roles 96 96
is that they're not limited to just people 97 97
or just servers or just endpoints or just software. 98 98
All of those can be roles. 99 99
So while we have those other four categories, 100 100
they can all be rolled down into roles as well 101 101
if we configure ourself that way. 102 102
Now, when you're dealing with roles, 103 103
a lot of times we're going to do this inside of Windows 104 104
by assigning people to different groups 105 105
and then give those groups permissions. 106 106
That's what you probably learned in A+ or Security+. 107 107
So just keep that in mind when we talk about roles, 108 108
that's usually the way things are going to be done. 109 109
Now, when we talk about IAM tasks, 110 110
there's lotsa different tasks that the system is going to do. 111 111
Your roles is that they're not limited to just people 112 112
or just servers or just endpoints or just software. 113 113
IAM system is going to contain technical components, 114 114
like directory services and repositories, 115 115
access management tools, 116 116
and systems that are going to do auditing 117 117
and reporting on ID management capabilities. 118 118
All of these things contain tasks that need to be done 119 119
for an IAM system to function properly. 120 120
Now, in addition to that, 121 121
a lot of different things that might happen 122 122
as part of the IAM system 123 123
is things like creating and deprovisioning accounts. 124 124
So if I'm going to create a new user, 125 125
that's a creation or provisioning of an account. 126 126
If I'm going to disable or delete a user, 127 127
that's deprovisioning. 128 128
When I talk about managing accounts, 129 129
this includes things like resetting somebody's passwords, 130 130
updating their digital certificates, 131 131
managing their permissions and their authorizations, 132 132
and other things of that nature. 133 133
When I talk about auditing accounts, 134 134
this is when I start looking at the activity 135 135
that that account has done through the different logs 136 136
and figure out was that legitimate or not? 137 137
This is a big function 138 138
inside the cybersecurity analyst role. 139 139
You're going to do a lot of account auditing 140 140
as you go through those systems, 141 141
and this is going to be a big part of your IAM management. 142 142
Another thing we're going to do 143 143
is evaluate identity-based threats. 144 144
Now what this means is we're going to do 145 145
a lot of different things to identify any threats 146 146
as a cybersecurity analyst to our IAM systems. 147 147
For instance, 148 148
you might run password checks across your network 149 149
to see if there's any weak passwords. 150 150
That is evaluating the security 151 151
of your identity-based threats. 152 152
You want to make sure those passwords are strong 153 153
and so an attacker can't break into them. 154 154
And the last thing we do is we want to maintain compliance. 155 155
And to maintain compliance, 156 156
we're going to go through checks and balances, 157 157
we're going to go through audits, 158 158
and we're going to make sure that we're meeting 159 159
the requirements that we have set up 160 160
for our system to run securely. 161 161
And in the final part of this lesson, 162 162
I want to talk about risk. 163 163
What risks exist within IAM? 164 164
Well, the biggest risk is really the risk 165 165
caused by our accounts. 166 166
And there are three main types 167 167
of accounts that we're going to cover. 168 168
There are user accounts, 169 169
and these are your standard accounts 170 170
that all your users are going to have. 171 171
Now, these are the least risky for us 172 172
because they just have basic user permissions, 173 173
but they are still a risk. 174 174
The second type of account we have are privileged accounts, 175 175
and this is even more risky. 176 176
The reason it's more risky 177 177
is because this type of account has more permissions. 178 178
As a privileged account, 179 179
this is an administrator, a root user, or a super user. 180 180
And so, they have permission to install software 181 181
and uninstall software, 182 182
and they can change passwords on other users, 183 183
and they can create new accounts, 184 184
and do all sorts of things making it a much more risky area, 185 185
so it's an area you want to have additional auditing 186 186
and additional compliance checks 187 187
to make sure those accounts are safe. 188 188
And finally, we have shared accounts. 189 189
Now, shared accounts are typically used 190 190
in small office, home office environments. 191 191
You may have one account 192 192
that everybody uses to log in to do some certain function. 193 193
Now, this is a really dangerous practice 194 194
because everybody has that shared password, 195 195
and so you lose the ability to audit 196 196
who actually did something 197 197
because everybody's logging in as that user. 198 198
I can't just go to the logs and say, 199 199
"Ah, the shared account was on this system at this time. 200 200
They must have done it." 201 201
Well, who was the shared account? 202 202
It could've been any of 10 different employees. 203 203
We don't know. 204 204
And so this is another area that's very risky, 205 205
so it's not recommended to use shared accounts. 206 206
Instead, you should have people using user accounts 207 207
and put them into a role-based permissions group 208 208
to allow them to do the functions they need.