Identity and Access Management

Have you ever thought about any of the following questions?

1. How can we uniquely identify the different system users?
2. How can a user prove who they are to the system?
3. How can we help prevent an attacker from pretending to be a legitimate user?
4. How can we decide what a user should access? How can we enforce such a decision?
5. How can we know what a user is doing after logging in so that we can hold them accountable for their actions?

In this room, we answer the above questions and others using formal technical terms. If you are curious, the answers to the questions above lie in the following concepts and processes:

1. Identification
2. Authentication
3. Strong passwords and Multi-Factor Authentication (MFA)
4. Authorisation and Access Control
5. Logging and Auditing

This room introduces the reader to key concepts related to managing identities and authorisations. It starts with identification and authentication and proceeds to accountability before it concludes with access control models.

Prerequisites

Although this room has no strict prerequisites, it is recommended that you first finish the Security Principles to make the best use of this room.

Learning Objectives

By the end of this room, you should have gained a solid understanding of the following processes and concepts:

• Identification
• Authentication
• Authorisation
• Accountability
• Access Control Models
• Single Sign-On