>> Welcome back. We have made it to the last chapter.
Here, we'll be talking about
identity and access management,
which is a field that is exploding and
evolving today. It's exciting.
We'll start out by covering what
Identity and Access Management, or IAM is.
The four main areas of IAM are Identification,
Authentication, Authorization, and Auditing.
These all relate to how we manage the users or
entities who are going to access our network.
Let's define what Identity and Access Management is.
Like I said, you'll hear it called IAM.
It specifies the processes for giving access to users.
These processes fall into the four I
triple A categories of Identification,
Authentication, Authorization, and Auditing.
Anytime a subject,
such as a person,
wants access to an object
such as a folder and a directory,
the subject needs to
identify and make a claim of who they are,
then they should have to
authenticate to prove their identity.
Then we should check their authorization
and see if their account is
authorized to access that folder
before allowing them to access it.
Finally, auditing means having a record and
accountability of the actions
a user has taken on the network.
That's the whole access management set of processes.
Now, we start off with identification.
But even before the identification process happens,
typically a company will have done
some identity proofing to confirm
a person is who they say they are
before they are hired and given access to the system.
For example, you provide
human resources with a social security card,
a passport, and so forth to prove who you are.
Then after the person is hired,
a new user account will be provisioned for that person.
That provisioning process also
includes giving the user access to
particular systems or parts of
the system with specific permissions and so forth.
The account will include identifier for the user,
typically in the form of a username.
The organization should use
a standardized naming convention
for each person's identifier.
A lot of times it's last name first initial,
or first initial last name, that type of thing.
The identifier for each person should be unique.
You don't want to have any cases where
a single account is shared by multiple people
because then you don't have
the auditing capability to keep
track of what each individual does.
There are also other scenarios
where identification takes place.
What I've been talking about so far is a person
logging in and gaining access to a network.
But it can also apply when
my computer system makes
a connection to a port on a switch.
Maybe that switch has MAC filtering enabled
and my system has to provide its MAC address,
and that's how it identifies,
or some policies are set up based on IP address.
Sometimes this identification process is
happening underneath the surface and you and I,
as users, don't even see it.
But when a subject accesses an object,
that first step is still going
>> to involve identification.
>> Now, the problem is,
unless the person provides some proof,
then identification is easily spoofed,
I can claim to be a network administrator,
but that doesn't make it true.
What we'll follow up identification with is
authentication and that's what we'll cover next.