In this lesson,
we will learn about access management.
Access management is used to continuously verify
and control user and device access to resources based
on policies and contextual factors.
This is more secure than systems that assume trust based
on a network location.
Access management concepts include,
subject-object relationships, continuous authorization,
and context-based reauthentication.
Let's learn more about these access management concepts.
First, we have subject-object relationships.
Defining subject-object relationships
is the foundation of access management,
because it establishes clear boundaries
for who or what can access specific resources.
Defining subject-object relationships
involves setting up rules that determine how subjects,
such as users, devices, or applications,
can interact with objects like data, files, or systems.
These rules are based on permissions, roles,
and access levels defined within an access control system.
This approach ensures
that access is both appropriate and secure.
For example, imagine a library
where books are the objects and readers are the subjects.
In this scenario, access management means specifying
who can check out which books based
on established rules and permissions.
A librarian with higher permissions can access all books,
including restricted or rare collections.
In contrast, a regular reader
might only be allowed to access general
or publicly available books,
such as fiction or non-restricted non-fiction.
This clear definition
of subject-object relationships ensures
that each subject can only interact
with objects they are authorized to access,
maintaining security and control over the resources.
Second, we have continuous authorization.
Continuous authorization involves the ongoing evaluation
of access permissions throughout a user's session,
rather than checking access rights only once.
Then, continuous monitoring can adapt to changes in context
or security posture, enforcing policies dynamically
as user behavior or circumstances shift.
In a Windows domain, continuous authorization
is implemented using tools like Group Policy
and Active Directory,
which continuously evaluate user permissions,
monitors activities, and enforces access rules in real time.
For example, in a workplace with continuous authorization,
we can imagine
a finance team member accessing financial reports
as part of their normal permissions.
If this person suddenly attempts
to access unrelated or restricted files,
such as human resources records
or executive-level financial data,
the system which continuously evaluates their actions
will detect this deviation from expected behavior.
In response, the system might dynamically adjust
the user's access permissions,
restricting their ability to view sensitive data
or temporarily limit access to specific resources.
The system can also log suspicious activity
and notify security administrators,
allowing them to investigate further.
This ongoing evaluation ensures
that access rights are continually adapted
to the user's behavior, maintaining security
and ensuring that access remains appropriate based
on the user's role and current actions.
Third and finally, we have context-based reauthentication.
Context-based reauthentication enhances access management
by adding an extra layer of security
when certain contextual factors change.
It involves prompting users to reauthenticate
when certain conditions or changes are detected,
such as location shifts or altered security settings.
This helps maintain security
by verifying that the right person
is still accessing the resources.
In a Windows environment, context-based reauthentication
can be implemented using tools
like Conditional Access policies
in Azure Active Directory and Microsoft Endpoint Manager.
These tools allow administrators
to set rules that trigger reauthentication based
on various contextual factors,
such as accessing resources from a new geographical location
or switching from a secure to an insecure connection.
For example, if an employee is working in the office
and then moves to a coffee shop,
the system detects this change in location and network.
Since accessing company resources from a public place
is more vulnerable,
the system might ask the employee to log on again
just to confirm their identity.
This adaptive approach ensures
that access remains appropriate and secure,
especially in new or potentially risky situations.
So remember, access management is a security approach
that continuously verifies and controls access
to resources based on policies and contextual factors,
making it more secure
than simply trusting access by location.
Access management includes,
defining subject-object relationships,
which set clear rules about how users and devices
can interact with resources, while continuous authorization
keeps evaluating access permissions throughout a session,
adapting to changes in behavior or context
to maintain security.
Finally, context-based reauthentication
may require users to confirm their identity again
when specific conditions change,
such as location or security settings.
Together, these concepts ensure access remains secure,
dynamic, and appropriate for any given situation.