Security Fundamentals

Identity and Access Management

IAM is the discipline of ensuring the right people and systems can access the right resources — and nothing more.

Core concepts

Identity

Who or what is making a request — a user, service, or device uniquely identified in the system.

Authentication

Proving the identity is genuine, via passwords, tokens, biometrics, or certificates.

Authorization

What an authenticated identity is allowed to do — read, write, delete, or administer.

Audit

Logging who did what and when — essential for compliance and detecting threats.

How a request is evaluated
User / Service
Authenticate
Check policy
Access resource
Auth fails
Deny
or policy has no matching allow rule
Key components

Identities

Users Groups Roles Service accounts API keys

Policy types

RBAC ABAC ACL Resource-based

Protocols & standards

OAuth 2.0 OIDC SAML LDAP SCIM

MFA methods

TOTP app Hardware key Push notification Passkey
Guiding principles
01

Least privilege

Grant only the permissions needed to do the job — nothing extra. Reduces blast radius if an account is compromised.

Zero Trust
02

Separation of duties

No single person or system should be able to perform a sensitive action alone — requires two parties.

Compliance
03

Just-in-time access

Elevated permissions are granted temporarily when needed, then automatically revoked.

Modern IAM
04

Continuous verification

Trust is never assumed — identity and context are re-evaluated on every request, not just at login.

Zero Trust