Identity, Monitoring, and Detection

Identity and access management (IAM) encompasses the systems and processes an organization uses to establish who its users are and to control what they can access throughout the lifetime of their relationship with the organization. This includes provisioning accounts when someone joins, adjusting access as their role changes, and, a step organizations frequently handle poorly, promptly deprovisioning access when someone leaves or changes roles, since orphaned accounts belonging to former employees represent a persistent and often overlooked risk. Multi-factor authentication (MFA), which requires a user to present two or more independent forms of evidence of identity — typically something they know, such as a password, combined with something they have, such as a phone-based authenticator app or a hardware security key — has become a baseline IAM control specifically because passwords alone are so frequently phished, reused, or leaked in breaches of unrelated services. A mature IAM program treats identity as a security perimeter in its own right, since in cloud and remote-work environments a compromised identity is often a more direct path to sensitive data than compromising the network itself.