Lesson 4: Identity and Access Management (IAM)

Authentication verifies identity before granting access. Common methods include passwords (something you know), smart cards or tokens (something you have), and biometrics (something you are). Multi-factor Authentication (MFA) requires two or more of these factors, greatly improving security. For example, accessing a bank account might require a password plus a one-time code sent to a mobile phone. In practice, implementing strong password policies (length and complexity) and adding MFA (like authenticator apps or SMS codes) prevents unauthorized access even if credentials are compromised.

Authorization determines what resources a user can access. A common model is Role-Based Access Control (RBAC): users are assigned roles (e.g., "manager", "clerk") and each role has specific permissions. Less commonly, Attribute-Based Access Control (ABAC) uses attributes (such as department, clearance level, time of day). The principle of Least Privilege means giving users only the permissions they need to do their job. For example, a regular user account should not have administrator rights. Auditing and regular review of permissions ensure that old or unused accounts are disabled to prevent abuse.