Identity and Access Management (IAM) Fundamentals
Explore IAM fundamentals including identity lifecycle management, access provisioning, and audit strategies essential for CISA exam preparation.
Introduction to Identity and Access Management
Identity and Access Management (IAM) is a framework of policies, processes, and technologies that ensures the right individuals have appropriate access to technology resources. For CISA candidates, IAM is a foundational topic because access control weaknesses are among the most common findings in IS audits. Understanding IAM helps auditors evaluate whether organizations effectively manage who can access what, when, and under what conditions.
IAM encompasses the entire lifecycle of digital identities, from creation through modification to eventual deactivation. A well-implemented IAM program reduces security risks, supports regulatory compliance, and improves operational efficiency.
Identity Lifecycle Management
Provisioning
Identity provisioning is the process of creating user accounts and assigning initial access rights. Key controls in the provisioning process include:
- Formal access request procedures: Documented processes requiring manager approval before accounts are created
- Role-based provisioning: Assigning access based on predefined role templates rather than individual requests
- Segregation of duties verification: Ensuring that new access does not create conflicts with existing permissions
- Unique identification: Each user receives a unique identifier that cannot be shared or reassigned
Modification and Review
As users change roles or responsibilities, their access rights must be updated accordingly. This includes adding new permissions for new duties and removing permissions that are no longer needed. Periodic access reviews (recertification) verify that all assigned access remains appropriate. Auditors should evaluate the frequency and rigor of these reviews.
Deprovisioning
Timely deprovisioning of access when employees leave the organization or change roles is critical. Auditors should verify that termination procedures include prompt disabling of all accounts, revocation of remote access, collection of physical access tokens, and removal from distribution lists and shared resources. Delays in deprovisioning represent a significant security risk.
Access Control Principles
Several fundamental principles guide effective access management:
- Least privilege: Users receive only the minimum access necessary to perform their duties
- Need to know: Access to information is restricted to those who require it for legitimate business purposes
- Separation of duties: Critical functions are divided among multiple individuals to prevent fraud or error
- Dual control: Certain high-risk actions require two authorized individuals to complete
IAM Technologies
Modern IAM solutions include directory services (such as Active Directory or LDAP), identity governance and administration (IGA) platforms, privileged access management (PAM) tools, and multi-factor authentication (MFA) systems. Auditors should understand how these technologies work together to enforce access policies and generate audit trails.
Audit Approach for IAM
When auditing IAM, IS auditors should review access provisioning workflows, test deprovisioning timeliness by comparing termination dates with account disable dates, evaluate the completeness and frequency of access reviews, assess password policies and authentication mechanisms, and verify that administrative access is appropriately restricted and monitored. Sampling user accounts across departments helps identify systemic control weaknesses.