Identity and Access Management

What It Is and Why It Matters

Identity and Access Management (IAM) is the framework of policies, processes, and technologies that ensures the right individuals have appropriate access to the right resources at the right times for the right reasons. For the CISA exam, IAM is a foundational topic because controlling access to information systems is one of the most critical security controls an organization can implement.

Poor IAM practices lead to unauthorized access, data breaches, privilege abuse, and regulatory noncompliance. As an IS auditor, you must evaluate whether IAM controls are properly designed, implemented, and operating effectively. This includes reviewing how identities are created, how authentication is performed, how authorization decisions are made, and how access rights are maintained over time.

IAM spans the entire user lifecycle: from initial provisioning (granting access when someone joins the organization or changes roles) through ongoing access management (periodic reviews and adjustments) to deprovisioning (revoking access when someone leaves or no longer requires it).

Key Concepts and Terminology

Authentication

Authentication is the process of verifying that a user or system is who they claim to be. Authentication factors include:

• Something You Know: Passwords, PINs, security questions.
• Something You Have: Smart cards, hardware tokens, mobile devices.
• Something You Are: Biometric characteristics such as fingerprints, facial recognition, or iris patterns.
• Multi-Factor Authentication (MFA): Requires two or more different factor types. MFA significantly reduces the risk of unauthorized access compared to single-factor authentication.

Authorization and Access Control Models

• Discretionary Access Control (DAC): The resource owner decides who can access their resources. Common in general-purpose operating systems but difficult to manage consistently at scale.
• Mandatory Access Control (MAC): Access decisions are based on security labels and clearance levels. The system enforces access rules; users cannot override them. Common in military and government environments.
• Role-Based Access Control (RBAC): Access permissions are assigned to roles, and users are assigned to roles based on their job functions. RBAC simplifies access management and is the most widely used model in commercial environments.
• Attribute-Based Access Control (ABAC): Access decisions are based on attributes of the user, the resource, the action, and the environment. ABAC provides fine-grained, context-aware access control.

Access Provisioning and Deprovisioning

Provisioning is the process of creating user accounts and granting access rights. It should follow a formal approval workflow, with access granted based on the principle of least privilege. Deprovisioning is equally important: when employees leave the organization, change roles, or no longer need access, their accounts and privileges must be promptly revoked or adjusted. Delayed deprovisioning is a common audit finding and a significant security risk.

Privileged Access Management

Privileged accounts (such as system administrators, database administrators, and root accounts) have elevated access that can bypass normal controls. These accounts require additional safeguards, including stronger authentication, session monitoring, time-limited access, and regular review. Privileged access management (PAM) tools help organizations control and monitor the use of privileged accounts.

Access Reviews and Recertification

Periodic access reviews (also called access recertification) verify that users' current access rights are still appropriate and necessary. Managers or data owners review the access assigned to their personnel and confirm or revoke permissions as needed. Auditors frequently check whether access reviews are conducted regularly and whether the results are acted upon.

Single Sign-On (SSO) and Federated Identity

Single Sign-On allows users to authenticate once and gain access to multiple systems without re-entering credentials. SSO improves user experience and reduces password fatigue but introduces a single point of failure. Federated identity management extends SSO across organizational boundaries using standards such as SAML, OAuth, and OpenID Connect.

How This Appears on the CISA Exam

IAM is tested extensively across the CISA exam, particularly in Domain 5. Expect questions about:

• Identifying the correct access control model for a given scenario.
• Understanding the principle of least privilege and its application.
• Evaluating provisioning and deprovisioning processes for completeness and timeliness.
• Recognizing the risks of shared accounts and the importance of individual accountability.
• Understanding MFA and its advantages over single-factor authentication.
• Assessing the effectiveness and frequency of access reviews.

Study Tips

• Know the three authentication factor categories and examples of each.
• Memorize the access control models (DAC, MAC, RBAC, ABAC) and their distinguishing characteristics.
• Understand that least privilege and separation of duties are key principles that underpin all access management decisions.
• Remember that timely deprovisioning is critical, especially for terminated employees.
• Review the risks and benefits of SSO and how it relates to federated identity management.

Related Subtopics

• Directory services (LDAP, Active Directory)
• Password policies and credential management
• Multi-factor authentication technologies
• Identity governance and administration
• Separation of duties enforcement
• Zero trust architecture principles