Instructor: In this lesson,
we will learn about management frameworks.
Management frameworks in the context
of troubleshooting identity and access management
are how identities and access controls
are managed, monitored, and maintained
within an organization.
Management framework concepts include identity proofing
as well as privileged identity management.
So authentication and authorization are core processes
where authentication verifies a user identity
and authorization determines
what resources the user can access.
Identity proofing is then the process
of verifying an individual's claimed identity is accurate.
Identity proofing is typically done
during the initial setup of user accounts.
Next, privileged identity management focuses
on managing and controlling access
to critical systems and information
by granting elevated permissions only when necessary.
It also involves closely monitoring privileged accounts.
Let's learn more about identity proofing
and privileged identity management.
First, we have identity proofing.
Identity proofing is all about confirming
a person's identity
by asking for additional proof.
This can happen when someone first joins an organization
or during a password reset.
For example, if you forget your password,
you might be asked to answer some security questions,
like where you went to high school
or the name of your first pet.
The assumption is that only you know these details.
However, this method is not always secure.
A well-known example of this
is Sarah Palin's Yahoo email hack in 2008
where the hacker correctly answered her security questions
using publicly available information.
So to enhance security,
experts suggest using an alternative persona
when answering these questions,
providing answers that are unique
and not easily guessed or found online.
For example, you might answer Argentina
when asked where you were born, even if that's not true.
In larger organizations,
identity proofing often requires presenting documentation,
such as a photo ID or passport,
either during onboarding or when resetting a password.
Some companies require employees
to visit the IT service desk with identification
to verify their identity before making changes.
This approach offers higher security,
but can slow down operations,
so organizations must consider the trade-off.
In any case, once a user's identity is verified,
it is passed to the other systems
through a process called identity propagation.
This means the verified identity is shared
across servers, devices, and resources within the network.
If a system handles its own authentication,
only the identity is passed.
With single sign-on,
both the identity and authentication details are transferred
to other systems.
Vendors use different methods for this.
For example, Microsoft Active Directory
uses the Kerberos ticketing system
to manage identity and authentication across its services.
When these proprietary systems
need to work with other third-party applications,
a centralized identity and authentication translation system
may be required.
This centralized identity
and authentication translation system
might handle different authentication methods,
like Microsoft tickets, single sign-on, or XML tokens.
Depending on the method used for identity propagation,
it might also send user credentials across the network.
For instance,
the Credential Security Support Provider protocol or CredSSP
allows the transmission of full user credentials.
But it's important to ensure that protocols like CredSSP
operate over secure, encrypted connections,
such as Secure Sockets Layer
or Transport Layer Security,
to protect the sensitive information
from unauthorized access.
Second, we have privileged identity management.
Privileged identity management or PIM is a security approach
that focuses on managing and controlling access
to critical systems and sensitive information.
It does this by granting elevated permissions
only when they are necessary.
In other words, it allows users like IT administrators
to have just enough access to perform their jobs
without permanently using high-level privileges
that could pose a security risk.
To better understand this,
imagine an IT administrator in an organization
needs to perform a task that requires special access,
such as updating a server or changing security settings.
Instead of always having these powerful permissions enabled,
the administrator requests temporary elevated access
through privileged identity management.
Then their elevated access is granted
only for the duration that they need to complete their task.
Once the task is finished,
their elevated permissions are removed,
reducing the risk of misuse or accidental errors.
Privileged identity management also involves
closely monitoring privileged accounts
to ensure they are used correctly.
Each time a user with elevated access performs an action,
it is logged and tracked.
For example, if an administrator makes changes
to a critical system,
those actions are recorded,
creating an audit trail.
This helps the organization detect unusual behavior,
such as unauthorized changes,
and then to respond quickly if something goes wrong.
So by only granting elevated access and permissions
when it is absolutely necessary
and then monitoring the use of those permissions,
privileged identity management reduces the risk
of internal threats
and protects the organization's most important resources.
Privileged identity management also ensures
that high-level permissions are not misused
and that those with access are accountable
for their actions.
So, remember, management frameworks
in identity and access management are essential
for managing, monitoring, and maintaining
how identities and access controls function
within an organization.
Core components include authentication,
which verifies a user's identity,
and authorization, which determines
what resources a user can access.
Next, identity proofing then ensures
that a person's claimed identity is accurate,
often done when setting up new user accounts
or resetting passwords.
Finally, privileged identity management or PIM
manages and controls access to critical systems
by granting elevated permissions only when necessary
and closely monitoring privileged accounts.
These management frameworks help protect sensitive data
and ensure that high-level access is used appropriately
and securely throughout the enterprise.