Learning Objectives:

  • Understand the principles of identity and access management.

  • Implement multi-factor authentication (MFA) and strong authentication.

  • Apply privilege access management (PAM) to protect sensitive systems.

  • Recognise the importance of identity governance and administration.

6.1 Identity and Access Management (IAM) Principles

IAM is the framework of policies and technologies for ensuring that the right individuals have the appropriate access to technology resources. The ECB’s SREP methodology requires that financial entities grant access to ICT assets only to properly identified, authenticated and authorised individuals . The Regulation on Information Systems and Cyber Risk Management requires that financial institutions have adequate protection measures in place to safeguard ICT systems .

Key IAM Components:

Identification: Establishing the identity of a user or system.

Authentication: Verifying the identity of a user or system.

Authorisation: Determining what resources a user or system can access.

Accountability: Tracking user actions and providing audit trails.

6.2 Authentication and Multi-Factor Authentication (MFA)

Authentication is the process of verifying the identity of a user or system. The IT Security Controls book includes Multi-Factor Authentication as a key control for unmanaged devices.

Types of Authentication Factors:

Knowledge Factors: Something you know (password, PIN).

Possession Factors: Something you have (token, smart card, mobile device).

Inherence Factors: Something you are (biometrics, such as fingerprints or facial recognition).

Multi-Factor Authentication (MFA): MFA requires the use of two or more authentication factors, significantly improving security.

6.3 Privileged Access Management (PAM)

Privileged Access Management is the management of accounts with elevated access privileges, such as system administrators and IT staff. The IT Security Controls book includes Privileged Access Management as a key control for managed devices.

Key PAM Controls:

Privileged Account Discovery: Identifying all privileged accounts.

Privileged Account Management: Managing access to privileged accounts.

Session Recording: Recording privileged user sessions for audit purposes.

Just-in-Time Access: Granting privileged access only when needed and for a limited time.

6.4 Identity Governance and Administration (IGA)

Identity Governance and Administration is the governance framework for managing digital identities and access rights. The IT Security Controls book includes Directory Service Integration as a key control.

Key IGA Controls:

Access Reviews: Regularly reviewing user access rights.

Segregation of Duties: Ensuring that no single individual has conflicting access rights.

Role-Based Access Control: Granting access based on job roles.

Lifecycle Management: Managing user identities throughout their lifecycle, from onboarding to offboarding.

PreviousNext