Access management
Managing access to information systems is one of the most integral parts of information security. The following four principles are the pillars of robust access management and are also known as IAAA:
- Identification: Identification is the process of identifying an individual attempting to access a resource, information, or application. This is done by providing a unique ID such as a username, an email address, a user ID, or a similar attribute that can be easily remembered by the user. A risk practitioner should verify that the process of issuing this unique ID is secure and not shared with multiple users unless warranted for legitimate use such as a system/service account.
- Authentication: After the identity of the user is verified, authentication is the process of verifying that they are who they claim to be. This is typically done by providing using one of the three factors—something you know (such as PIN, password), something you have (a security...
