- BY PRAVIN SHINDE

IAM

(General User Accounts & applications)

PAM

(Privileged Accounts)

AGENDA: -

• IAM
• Traditional IAM model
• Modern IAM model
• Realm/Security Domain
• Federation
• PAM
• Working of PAM systems
• Working model of PAM
• PAM vs IAM

​

​

WHAT IS IAM?

• Identity and Access management (IAM), is a framework of policies and technologies for ensuring that the proper people in an enterprise have the appropriate access to technology resources.
• IAM  defines and manage the roles and access of individual network users and the circumstances in which users are granted access(or denied) to applications.
• So right individuals access right resources at the right time for right reason.
• IAM ensures secure & suitable access to resources distributed across diverse technology, environment & meet severe compliance requirement in an organization.

​

TRADITIONAL MODEL: -�LOCAL IAM

​

​

​

In early days, developers created authentication & authorization logic for each applications: -

​

Complex Work for: -

• End Users
• Administrators.

Roles & Rights User Database

​

​

Application Authentication Logic

Roles & Rights User Database

​

​

Application Access Authentication Logic

Roles &Rights User Database

​

​

Application Authentication Logic

User

MODERN IAM MODEL

• In modern IAM, Trust is established between the application & IAM identity provider. Users never authenticate directly into the application, but applications may still have user database for access rights.
• The user authenticate into the IAM Identity provider instead and when users wants to access the application, access token is generated by the IAM identity provider and sent to the application.
• Trust is built between Applications & IAM identity provider with the help of Certificates, Login & Logout URLS, Supported parameters & standards of each system.
• Users can be authenticated once & gain access to all applications.
• Simplified work for admin.

​

Login

Prove who you are

Proof

Attributes

User

Applications

Modern IAM Model: - SSO

Trust

HR Management

User Database

Access Token

IAM IN SECURITY DOMAIN

• A Realm is a security domain with circle of trust.
• Each component in a Security Domain trust other component & access tokens are used to provide access to the systems.
• No trust between two security domains.
• User in Security Domain B cannot use of their access tokens which are issued by their local IAM identity provider to gain access to applications in Security Domain A.

​

• Solution: - Federation

​

​

Realm/Security Domain

Trust

Trust

No Trust

Security Domain A

Security Domain B

FEDERATION

• Trust is established between two different Security Domains.
• Users can use their own local IAM identity provider for authentication & access applications in other security domain.
• User administration is handled within each security domain.
• Level of Assurance(LOA) is level of trust on other security domain’s processes, systems, users & administrators.

​

Trust

Security Domain A

Security Domain B

Federation

PRIVILEGED ACCESS MANAGEMENT�(PAM)

• Privileged Access Management (PAM) refers to systems that securely manage the accounts of users who have elevated permissions to critical, corporate resources. These may be human administrators, devices, applications, and other types of users.
• Privileged user accounts are high value targets for cyber criminals. That’s because they have elevated permissions in systems, allowing them to access highly confidential information and/or make administrative-level changes to mission critical applications and systems.
• Privileged accounts exist everywhere( on-premises & on cloud).
• Examples: - root account on a Linux machine, Firewall admin.

HOW DO PAM SYSTEMS WORK?

• A PAM administrator define methods, policies to access the privileged account across various applications and enterprise resources.
• PAM system accepts incoming IAM user & then according to the policies assigns user to Privileged account.
• Privileged account access is logged and remains till completion of tasks.
• Sometimes manager approval is required for the access of privileged accounts like Sysadmins, DevOps, Firewall admin.
• PAM ensures that passwords are frequently changed either at regular intervals or after each use.

​

PAM System

Database Admin

Firewall Admin

Domain Admin

PAM Model

PAM & IAM BENEFITS

PAM: -

• Easily manage privileged user access from one central location.
• PAM systems record logging activities that will help in audit trail.
• PAM helps organizations comply with regulations like HIPAA, ISO 27002, PCI DSS & many more.

​

IAM Benefits: -

• Reduced IT costs.
• IAM centralizes and automates the identity and access management lifecycle, creating automated workflows for scenarios like a new hire or a role transition. 
• Easy of use for application owners, end-users, admins.

HOW IS PAM DIFFERENT FROM IAM?

• IAM focuses on authenticating and authorization all types of users for an organization, often including employees, vendors, customers.
• IAM manages general access to applications and resources, including on-premise & cloud and usually integrates with directory systems such as Microsoft Active Directory.

​

• PAM focuses on privileged users, administrators in the organization.
• PAM systems are specifically designed to manage & secure the access of these users to critical resources.