User authentication and authorization
At the core of IAM is delivering a life-cycle process for the authentication and authorization of identities. In the past, the focus may have been on identities specifically tied to a human user. However, as companies rely more on automations, API integrations, device-to-device integrations, and other dynamic digital services, attention should be given to proper authentication and authorization of non-human identities as well. These non-human identities include things such as devices, service accounts, and workload identities, which should be considered as part of the audit, and in Chapter 1, Cloud Architecture and Navigation, we discussed the importance of understanding the end-to-end IT infrastructure and landscape prior to starting an audit, which should include these items.
In the case of user authentication and authorization, it’s important to understand the source of identities and where those are managed. Cloud providers offer...
