Identity Access Management: The Four A’s
Key Points
- Traditional network security focused on a perimeter firewall separating “good guys” inside from “bad guys” outside, but the rise of insider threats and remote workers has made that model obsolete.
- Modern security must shift the defense line to the end‑user level, emphasizing Identity and Access Management (IAM) to control who can access what, wherever they are.
- IAM is built around the “four A’s”: **Administration** (provisioning and de‑provisioning accounts), **Authentication** (verifying a user’s identity, often with multi‑factor methods), **Authorization** (determining what actions the user is permitted to perform), and **Audit** (ensuring the previous steps were correctly executed and logged).
- Proper de‑provisioning is critical because lingering access rights can create serious security exposures, underscoring the need for continuous governance of identities and permissions.
Full Transcript
# Identity Access Management: The Four A’s **Source:** [https://www.youtube.com/watch?v=aNj36g7fSsU](https://www.youtube.com/watch?v=aNj36g7fSsU) **Duration:** 00:03:33 ## Summary - Traditional network security focused on a perimeter firewall separating “good guys” inside from “bad guys” outside, but the rise of insider threats and remote workers has made that model obsolete. - Modern security must shift the defense line to the end‑user level, emphasizing Identity and Access Management (IAM) to control who can access what, wherever they are. - IAM is built around the “four A’s”: **Administration** (provisioning and de‑provisioning accounts), **Authentication** (verifying a user’s identity, often with multi‑factor methods), **Authorization** (determining what actions the user is permitted to perform), and **Audit** (ensuring the previous steps were correctly executed and logged). - Proper de‑provisioning is critical because lingering access rights can create serious security exposures, underscoring the need for continuous governance of identities and permissions. ## Sections - [00:00:00](https://www.youtube.com/watch?v=aNj36g7fSsU&t=0s) **From Perimeter to Identity Management** - The speaker explains how security has evolved from edge firewalls to pervasive identity and access management, emphasizing the need to protect both internal and remote users and outlining the first of the four A’s—administration of accounts. ## Full Transcript
in the early days of the internet
security was basically about creating a
first line of defense at the edge of the
network
because we had an internal network where
we kept all the good guys an external
network where we assumed all the bad
guys were and so our main job in this
case was basically trying to create
this first line of defense at the edge
of the network
we put in a firewall good guys on the
inside bad guys on the outside
the problem with that is as we've moved
along we've realized that in fact
sometimes bad guys are on the inside
and also as we have more and more remote
workers we've got good guys that are on
the outside
so now it's not as simple as good guys
in bad guys out
what does that mean it means that we're
going to have to move our line of
defense
not to just the perimeter and edge of
the network it's got to be more
pervasive in fact we've got to push it
all the way to the level of the end user
and what that is about is this area of
identity and access management
if you'd like to see more videos like
this in the future please hit the
subscribe button
identity and access management if you
want to simplify it it's really about
four a's
and what are those four a's well the
first one
is administration
administration is basically creating an
account for you
updating it as we need to change the
characteristics of it over time and then
getting rid of that account and deleting
it we call that
identity management
in general that's a traditional term
that has been used here sometimes people
refer to it as identity governance now
but it's basically about provisioning
which is the creation of those accounts
and ultimately deprovisioning those
accounts
and de-provisioning is really important
from a security standpoint because if we
leave your access rights around when
you're no longer permitted to use them
we can end up with an exposure
so the first day a is administration the
next one
is authentication
authentication is basically answering
the question
of who are you
trying to establish in a trustworthy way
that you are in fact the user you claim
to be it's not always easy to do and we
use a lot of different technologies like
multi-factor authentication and things
like that that we can talk about later
in addition to this
the third a
is authorization
authorization is answering the question
are you allowed to do what it is that
you're trying to do
so i first have to know if you're who
you claim to be
then i try to find out if you're allowed
to do that
this is the area that collectively we
know is access management so here's the
identity here's the access
and then the fourth a
this business down here is about audit
audit is really all about trying to make
sure that i did the previous three a's
correctly
so identity and access management
administration authentication
authorization and audit it's all about
the four a's if you'd like to learn more
about this look at the links down below
thanks for watching please remember to
like this video and subscribe to this
channel so we can continue to bring you
content that matters to you