1 00:00:00,000 --> 00:00:01,650 [Instructor] In this lesson, we're going to discuss 2 00:00:01,650 --> 00:00:03,750 identity and access management. 3 00:00:03,750 --> 00:00:06,720 Identity and access management, also known as IAM 4 00:00:06,720 --> 00:00:09,840 is a critical component of any enterprise security plan 5 00:00:09,840 --> 00:00:11,820 as it is linked to both the cybersecurity 6 00:00:11,820 --> 00:00:14,190 and productivity of an organization. 7 00:00:14,190 --> 00:00:16,470 IAM refers to the systems and processes 8 00:00:16,470 --> 00:00:18,870 used to manage access to information 9 00:00:18,870 --> 00:00:20,400 and the organization to ensure 10 00:00:20,400 --> 00:00:22,110 that the right individuals have access 11 00:00:22,110 --> 00:00:23,040 to the right resources 12 00:00:23,040 --> 00:00:25,260 at the right times for the right reasons. 13 00:00:25,260 --> 00:00:27,510 Identity and access management evolves 14 00:00:27,510 --> 00:00:30,660 around the four main processes of identification, 15 00:00:30,660 --> 00:00:33,990 authentication, authorization, and accounting. 16 00:00:33,990 --> 00:00:36,060 First, we have identification. 17 00:00:36,060 --> 00:00:37,950 Identification is the process where a user 18 00:00:37,950 --> 00:00:40,260 claims an identity to a system. 19 00:00:40,260 --> 00:00:42,120 Typically using a unique identifier 20 00:00:42,120 --> 00:00:44,160 like a username or an email. 21 00:00:44,160 --> 00:00:46,290 For example, when you log into any computer, 22 00:00:46,290 --> 00:00:48,270 the user will typically enter their username 23 00:00:48,270 --> 00:00:51,570 as identification by either creating an account 24 00:00:51,570 --> 00:00:54,240 or an ID that uniquely represents that user, 25 00:00:54,240 --> 00:00:56,310 device or process on the network. 26 00:00:56,310 --> 00:00:57,780 Identification also ensures 27 00:00:57,780 --> 00:01:00,570 that your users are considered legitimate by the system. 28 00:01:00,570 --> 00:01:03,750 For example, when operating an e-commerce website, 29 00:01:03,750 --> 00:01:05,670 you might need to ensure that the billing 30 00:01:05,670 --> 00:01:08,910 and delivery addresses match what the user has stated 31 00:01:08,910 --> 00:01:11,640 that they are, so that the user does not try to use 32 00:01:11,640 --> 00:01:13,350 a fraudulent payment method. 33 00:01:13,350 --> 00:01:15,480 Next up, we have authentication. 34 00:01:15,480 --> 00:01:17,940 Authentication is the process of verifying 35 00:01:17,940 --> 00:01:20,430 the identity of a user, device or system, 36 00:01:20,430 --> 00:01:23,730 and this often involves validating the credentials provided 37 00:01:23,730 --> 00:01:26,550 by the user against a database of authorized users. 38 00:01:26,550 --> 00:01:28,980 For example, after entering a username, 39 00:01:28,980 --> 00:01:31,170 a user will be prompted to enter their password 40 00:01:31,170 --> 00:01:32,880 or other form of authentication 41 00:01:32,880 --> 00:01:35,520 like biometric characteristics or the combination 42 00:01:35,520 --> 00:01:38,640 of multifactors during the authentication process. 43 00:01:38,640 --> 00:01:40,620 Third, we have authorization. 44 00:01:40,620 --> 00:01:43,200 Now, once the user's authenticated, 45 00:01:43,200 --> 00:01:45,990 the authorization process determines what permissions 46 00:01:45,990 --> 00:01:48,330 or levels of access the user has. 47 00:01:48,330 --> 00:01:51,090 For example, an employee in a human resources department 48 00:01:51,090 --> 00:01:53,940 should have access to personnel files while an employee 49 00:01:53,940 --> 00:01:56,940 in finance might only have access to financial data. 50 00:01:56,940 --> 00:01:59,940 Fourth, we have accounting. Accounting, also known 51 00:01:59,940 --> 00:02:02,160 as auditing is a process of tracking 52 00:02:02,160 --> 00:02:04,440 and recording these user activities. 53 00:02:04,440 --> 00:02:07,470 Accounting can include logging when a user is logging in 54 00:02:07,470 --> 00:02:10,410 and out, what actions they perform while they're 55 00:02:10,410 --> 00:02:13,050 using the system, and any changes they might make 56 00:02:13,050 --> 00:02:14,760 on the system or the network. 57 00:02:14,760 --> 00:02:18,300 Accounting helps organizations to detect potential security 58 00:02:18,300 --> 00:02:21,210 incidents, find vulnerabilities, and provide evidence 59 00:02:21,210 --> 00:02:22,980 in the case of a security breach. 60 00:02:22,980 --> 00:02:25,980 Now that we have the understanding of the basic four steps 61 00:02:25,980 --> 00:02:28,530 of the identity and access management process 62 00:02:28,530 --> 00:02:31,560 of identification, authentication, authorization, 63 00:02:31,560 --> 00:02:35,280 and accounting, we need to look at some other IAM concepts 64 00:02:35,280 --> 00:02:37,380 including the provisioning and deprovisioning 65 00:02:37,380 --> 00:02:40,770 of user accounts, identity proofing, interoperability 66 00:02:40,770 --> 00:02:42,150 and attestation. 67 00:02:42,150 --> 00:02:45,227 First up, let's discuss provisioning and deprovisioning 68 00:02:45,227 --> 00:02:46,080 of user accounts. 69 00:02:46,080 --> 00:02:48,990 Provisioning is a process of creating new user accounts, 70 00:02:48,990 --> 00:02:50,760 assigning them with appropriate permissions 71 00:02:50,760 --> 00:02:52,830 and providing users with access to system. 72 00:02:52,830 --> 00:02:54,690 For example, if you just hired a new employee 73 00:02:54,690 --> 00:02:56,850 at the organization, that employee's account 74 00:02:56,850 --> 00:02:59,670 must be created and provisioned with an email account, 75 00:02:59,670 --> 00:03:02,100 access to the company's internal network and other systems 76 00:03:02,100 --> 00:03:04,230 that they need to perform their job functions. 77 00:03:04,230 --> 00:03:06,330 Deprovisioning, on the other hand, is the process 78 00:03:06,330 --> 00:03:08,490 of removing an individual's access rights 79 00:03:08,490 --> 00:03:09,780 when they no longer need them 80 00:03:09,780 --> 00:03:11,850 such as when the employee leaves the company. 81 00:03:11,850 --> 00:03:14,160 This is crucial to prevent unauthorized access 82 00:03:14,160 --> 00:03:17,130 to sensitive information or to prevent revenge 83 00:03:17,130 --> 00:03:19,110 by an ex-employee who has now turned 84 00:03:19,110 --> 00:03:21,300 into an insider threat against your company. 85 00:03:21,300 --> 00:03:23,490 Second, we have identity proofing. 86 00:03:23,490 --> 00:03:26,670 Identity proofing is a process of verifying the identity 87 00:03:26,670 --> 00:03:29,370 of a user before the account is created. 88 00:03:29,370 --> 00:03:31,650 This can involve checking the user's personal details 89 00:03:31,650 --> 00:03:33,390 against a trusted source of data 90 00:03:33,390 --> 00:03:35,790 or asking the user to provide some form of identification 91 00:03:35,790 --> 00:03:37,770 like a driver's license or a passport. 92 00:03:37,770 --> 00:03:40,170 Third, we need to cover interoperability. 93 00:03:40,170 --> 00:03:43,650 Interoperability refers to the ability of different systems, 94 00:03:43,650 --> 00:03:45,810 devices and applications to work together 95 00:03:45,810 --> 00:03:47,340 and share information. 96 00:03:47,340 --> 00:03:49,650 When it comes to identity and access management, 97 00:03:49,650 --> 00:03:53,070 interoperability can involve using standards like SAML 98 00:03:53,070 --> 00:03:56,400 or OpenID Connect to allow for secure, seamless 99 00:03:56,400 --> 00:03:59,670 authentication and authorization between different systems. 100 00:03:59,670 --> 00:04:02,100 Fourth and finally, we have attestation. 101 00:04:02,100 --> 00:04:04,872 in a world of identity and access management, 102 00:04:04,872 --> 00:04:07,380 attestation is a process of validating that user accounts 103 00:04:07,380 --> 00:04:10,080 and access rights are correct and up-to-date. 104 00:04:10,080 --> 00:04:12,000 This typically involves regular reviews 105 00:04:12,000 --> 00:04:14,460 and audits of user accounts and their access rights 106 00:04:14,460 --> 00:04:16,769 to ensure that users have the minimal access 107 00:04:16,769 --> 00:04:19,800 that is necessary to complete their role or job functions. 108 00:04:19,800 --> 00:04:22,950 So remember, identity and access management 109 00:04:22,950 --> 00:04:25,470 is a critical component of information security 110 00:04:25,470 --> 00:04:29,130 and an essential for managing risk related to the use, 111 00:04:29,130 --> 00:04:32,220 processing, storage and transmission of information. 112 00:04:32,220 --> 00:04:34,170 Identity and access management involves 113 00:04:34,170 --> 00:04:38,190 four main processes: identification, authentication, 114 00:04:38,190 --> 00:04:40,380 authorization, and accounting. 115 00:04:40,380 --> 00:04:42,870 Other important IAM concepts include provisioning 116 00:04:42,870 --> 00:04:44,760 and deprovisioning of user accounts, 117 00:04:44,760 --> 00:04:48,840 identity proofing, interoperability, and attestation. 118 00:04:48,840 --> 00:04:50,970 Each of these elements plays a crucial role 119 00:04:50,970 --> 00:04:53,070 in ensuring that only the right individuals 120 00:04:53,070 --> 00:04:55,443 have access to your organization's resources.