LESSON 6.1: Foundations of Identity and Access Management – Principles, Frameworks, and the Identity Lifecycle

Introduction: The Gatekeeper of Digital Finance

In Modules 1 through 5, we established a comprehensive cybersecurity framework for financial institutions. We explored the threat landscape and regulatory environment (Module 1), analyzed cyber threats and attack vectors (Module 2), designed secure network architectures (Module 3), implemented robust cryptographic systems (Module 4), and secured applications through secure development practices (Module 5). Each of these components protects the infrastructure upon which financial services are built. However, there is a critical security domain that underpins all others: Identity and Access Management (IAM) .

IAM is the practice of managing digital identities and controlling access to resources. It is the gatekeeper of digital finance, ensuring that only authorized individuals, systems, and devices can access the right resources at the right time for the right reasons. Without robust IAM, even the most secure network architecture, the strongest cryptographic systems, and the most secure applications are vulnerable to unauthorized access, data breaches, and fraud.

In financial institutions, IAM is of paramount importance because:

Customer Trust: Financial institutions hold the most sensitive personal and financial information. Customers must trust that their identities and accounts are protected.
Regulatory Compliance: Regulations such as GLBA, GDPR, NYDFS, and PCI DSS mandate strong identity and access controls.
Fraud Prevention: IAM is the first line of defense against account takeover, identity theft, and financial fraud.
Operational Security: Employees, contractors, and partners need appropriate access to perform their roles without exposing the organization to unnecessary risk.

This lesson provides a comprehensive analysis of the foundations of Identity and Access Management. We begin by examining the Core IAM Concepts: Identity, Authentication, Authorization, and Accountability. We derive the IAM Security Model: IAM = {Identity, Authentication, Authorization, Accountability}.

We then examine the Identity Lifecycle: Registration → Proofing → Provisioning → Management → Deprovisioning. We derive the Identity Lifecycle Security Score: I_LS = R_egistration * P_roofing * P_rovisioning * M_anagement * D_eprovisioning.

We also examine the IAM Frameworks used in financial institutions, including NIST SP 800-63, ISO/IEC 24760, and the IAM Maturity Model. We derive the IAM Maturity Score: I_MS = G_overnance * T_echnology * O_perations.

By the end, you will have a complete understanding of the foundations of IAM and be able to design and implement IAM systems for financial institutions.

Learning Objectives

Upon completion of this lesson, you will be able to:

Define the core IAM concepts: Identity, Authentication, Authorization, and Accountability.
Derive the IAM Security Model: IAM = {Identity, Authentication, Authorization, Accountability}.
Analyze the Identity Lifecycle: Registration → Proofing → Provisioning → Management → Deprovisioning.
Derive the Identity Lifecycle Security Score: I_LS = R_egistration * P_roofing * P_rovisioning * M_anagement * D_eprovisioning.
Analyze the IAM Frameworks: NIST SP 800-63, ISO/IEC 24760, and the IAM Maturity Model.
Derive the IAM Maturity Score: I_MS = G_overnance * T_echnology * O_perations.

Part 1: Core IAM Concepts

1.1 The IAM Definition

Identity and Access Management (IAM) is the practice of managing digital identities and controlling access to resources.

IAM = {Identity, Authentication, Authorization, Accountability}

1.2 The Four Pillars of IAM

Pillar	Description	Key Activities
Identity	Who or what is requesting access	Identity creation, management, lifecycle
Authentication	Verifying the identity	Password, MFA, biometrics, certificates
Authorization	Determining what access is granted	RBAC, ABAC, policies, permissions
Accountability	Tracking and auditing access	Logging, monitoring, reporting

1.3 Identity

Definition: Identity is the unique representation of a user, system, or device within a digital system.

Identity = {Attributes, Credentials, Entitlements}

Identity Attributes:

Attribute Type	Description	Examples
Biometric	Physical characteristics	Fingerprint, face, iris
Demographic	Personal information	Name, date of birth, address
Role	Job function or role	Manager, teller, trader
System	System attributes	Device ID, IP address, MAC address
Behavioral	Behavioral patterns	Typing pattern, location

1.4 Authentication

Definition: Authentication is the process of verifying the identity of a user, system, or device.

Authentication = {Factors, Methods, Protocols}

Authentication Factors:

Factor Type	Description	Examples
Something You Know	Knowledge-based	Password, PIN, security questions
Something You Have	Possession-based	Smart card, token, mobile device
Something You Are	Biometric	Fingerprint, face, iris
Something You Do	Behavioral	Typing pattern, gait
Somewhere You Are	Location-based	GPS, IP address

1.5 Authorization

Definition: Authorization is the process of determining what access a verified identity is granted.

Authorization = {Policies, Permissions, Enforcement}

Authorization Models:

Model	Description	Use Case
RBAC	Role-Based Access Control	Employees based on job roles
ABAC	Attribute-Based Access Control	Dynamic policies based on attributes
DAC	Discretionary Access Control	Resource owner controls access
MAC	Mandatory Access Control	System-wide security labels

1.6 Accountability

Definition: Accountability is the ability to track and audit access and actions.

Accountability = {Logging, Monitoring, Auditing}

Accountability Components:

Component	Description	Implementation
Logging	Recording access and actions	Audit logs, access logs
Monitoring	Monitoring for anomalies	SIEM, UEBA
Auditing	Reviewing logs and actions	Internal audits, external audits

1.7 The IAM Security Model

The IAM Security Model defines the four pillars of IAM:

IAM = {Identity, Authentication, Authorization, Accountability}

Property	Description	Security Implication
Identity	Unique representation	Identity theft, impersonation
Authentication	Verification of identity	Unauthorized access
Authorization	Access control	Privilege escalation, data breach
Accountability	Tracking and auditing	Insider threats, fraud

IAM Security Model (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Identity                                                       ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Who or what is requesting access                               ║  |
|  ║  Attributes: Biometric, Demographic, Role, System, Behavioral  ║  |
|  ║  Security: Identity theft, impersonation                        ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Authentication                                                 ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Verifying the identity                                          ║  |
|  ║  Factors: Something You Know, Have, Are, Do, Where             ║  |
|  ║  Security: Unauthorized access                                  ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Authorization                                                 ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Determining what access is granted                            ║  |
|  ║  Models: RBAC, ABAC, DAC, MAC                                  ║  |
|  ║  Security: Privilege escalation, data breach                    ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Accountability                                                ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Tracking and auditing access                                  ║  |
|  ║  Components: Logging, Monitoring, Auditing                     ║  |
|  ║  Security: Insider threats, fraud                              ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 2: The Identity Lifecycle

2.1 The Lifecycle Definition

The Identity Lifecycle describes the stages of an identity from creation to destruction.

Identity Lifecycle = {Registration, Proofing, Provisioning, Management, Deprovisioning}

2.2 The Five Stages

Stage	Description	Key Activities	Security Considerations
1. Registration	Identity is created	Collect identity information	Identity verification, data protection
2. Proofing	Identity is verified	Verify identity documents	Identity fraud prevention
3. Provisioning	Access is granted	Assign roles, permissions	Least privilege, segregation of duties
4. Management	Identity is maintained	Password changes, role changes	Security maintenance, monitoring
5. Deprovisioning	Identity is destroyed	Revoke access, delete data	Timely revocation, data destruction

2.3 Stage 1: Registration

Definition: Registration is the process of creating a digital identity for a user, system, or device.

Registration = {Identity Collection, Identity Creation, Identity Storage}

Security Considerations:

Identity Verification: Verify that the identity is legitimate.
Data Protection: Protect collected identity data.
Privacy: Minimize data collection and storage.
Anti-Fraud: Detect and prevent fraudulent registrations.

2.4 Stage 2: Proofing

Definition: Proofing is the process of verifying the identity of an individual.

Proofing = {Identity Verification, Document Verification, Authentication}

Proofing Levels (NIST SP 800-63):

Level	Description	Requirements
IAL 1	Self-asserted identity	No verification required
IAL 2	Identity verified	Document verification, remote proofing
IAL 3	In-person proofing	Physical presence, biometrics

2.5 Stage 3: Provisioning

Definition: Provisioning is the process of granting access to resources.

Provisioning = {Access Assignment, Permission Granting, Role Assignment}

Provisioning Methods:

Method	Description	Use Case
Automated Provisioning	Automated access assignment	Enterprise systems
Manual Provisioning	Manual access assignment	Special cases, exceptions
Self-Provisioning	User-driven access assignment	Low-risk resources
Approval-Based Provisioning	Approval required	High-risk resources

2.6 Stage 4: Management

Definition: Management is the ongoing maintenance of identities and access.

Management = {Identity Maintenance, Access Maintenance, Monitoring}

Management Activities:

Activity	Description	Frequency
Password Management	Password changes, resets	Ongoing
Role Changes	Update roles and permissions	As needed
Access Reviews	Review and certify access	Quarterly/Annually
Monitoring	Monitor for anomalies	Continuous

2.7 Stage 5: Deprovisioning

Definition: Deprovisioning is the process of revoking access and destroying identity data.

Deprovisioning = {Access Revocation, Data Destruction, Identity Deletion}

Deprovisioning Best Practices:

Practice	Description	Benefit
Timely Deprovisioning	Revoke access immediately	Prevents unauthorized access
Data Destruction	Destroy identity data	Data protection, privacy
Verification	Verify access is revoked	Ensures deprovisioning is complete
Audit Trail	Record deprovisioning events	Accountability, compliance

2.8 The Identity Lifecycle Security Score

The Identity Lifecycle Security Score quantifies the security of the identity lifecycle:

I_LS = R_egistration * P_roofing * P_rovisioning * M_anagement * D_eprovisioning

Where:

R_egistration is the Registration Score (0-1)
P_roofing is the Proofing Score (0-1)
P_rovisioning is the Provisioning Score (0-1)
M_anagement is the Management Score (0-1)
D_eprovisioning is the Deprovisioning Score (0-1)

Component	Description	Scoring Factors
Registration (R)	Security of registration	Identity verification, data protection
Proofing (P)	Security of proofing	Verification level, document verification
Provisioning (P)	Security of provisioning	Least privilege, segregation of duties
Management (M)	Security of management	Access reviews, monitoring, password policies
Deprovisioning (D)	Security of deprovisioning	Timely revocation, data destruction

Identity Lifecycle (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Stage 1: Registration                                                │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Identity Collection                                         │  │
|  │  • Identity Creation                                            │  │
|  │  • Identity Storage                                             │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Stage 2: Proofing                                                   │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Identity Verification                                       │  │
|  │  • Document Verification                                       │  │
|  │  • Authentication                                               │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Stage 3: Provisioning                                              │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Access Assignment                                           │  │
|  │  • Permission Granting                                         │  │
|  │  • Role Assignment                                              │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Stage 4: Management                                                │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Identity Maintenance                                        │  │
|  │  • Access Maintenance                                          │  │
|  │  • Monitoring                                                   │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Stage 5: Deprovisioning                                            │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Access Revocation                                           │  │
|  │  • Data Destruction                                            │  │
|  │  • Identity Deletion                                           │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Formula: I_LS = R_egistration * P_roofing * P_rovisioning * M_anagement * D_eprovisioning │
└─────────────────────────────────────────────────────────────────────────┘

Part 3: IAM Frameworks

3.1 NIST SP 800-63

Overview: NIST SP 800-63 is a framework for digital identity management.

NIST SP 800-63 = {Identity Assurance, Authentication Assurance, Federation}

Components:

Component	Description	Levels
Identity Assurance Level (IAL)	Confidence in identity	IAL 1, 2, 3
Authentication Assurance Level (AAL)	Confidence in authentication	AAL 1, 2, 3
Federation Assurance Level (FAL)	Confidence in federation	FAL 1, 2, 3

3.2 ISO/IEC 24760

Overview: ISO/IEC 24760 is an international standard for identity management.

ISO/IEC 24760 = {Identity, Attributes, Lifecycle}

Components:

Component	Description	Key Elements
Identity	Digital identity representation	Identity attributes, identifiers
Attributes	Identity attributes	Biometric, demographic, role
Lifecycle	Identity lifecycle	Registration, management, deprovisioning

3.3 IAM Maturity Model

Overview: The IAM Maturity Model describes the evolution of IAM capabilities.

IAM Maturity Model = {Level 1, Level 2, Level 3, Level 4, Level 5}

Maturity Levels:

Level	Description	Characteristics
1. Initial	Ad hoc, reactive	No formal IAM processes
2. Repeatable	Basic, documented	Documented IAM processes
3. Defined	Standardized, consistent	Enterprise-wide IAM
4. Managed	Measured, controlled	IAM metrics, monitoring
5. Optimizing	Continuously improving	Adaptive IAM

3.4 The IAM Maturity Score

The IAM Maturity Score quantifies the maturity of IAM:

I_MS = G_overnance * T_echnology * O_perations