Would you like to learn about Identity and Access Management? If so, this video is for you.
Hi, my name is Michael Gibbs, and I'm the founder and CEO of Go Cloud Architects, and
we're an organization dedicated towards building high-performance cloud computing and networking
careers. I've been working in tech now for over 25 years, and I've been coaching or mentoring others
to get their first tech job, or get promoted in tech, for two decades now, and it's my favorite
thing in the world. Today, we're going to talk about Identity and Access Management, otherwise
known as IAM, also named as Authentication Authorization Accounting, also known as Triple A.
Identity and Access Management is really the last line of defense to protect an organization. And
we're going to talk about these concepts so you really understand them, and the strength
and the weaknesses of every approach we going to use, but we want you to at least understand
why it's the last line of defense. The reason we're going to make this point of clarification
is many people think of IAM as primary security. It is not. It's the last line of defense.
I want you to think of security as a layered approach to protect
things. So for example, let's say you were going to secure a castle.
The walls of the castle would be these big, tall walls around the castle. That's called a firewall,
and that's how we keep unwanted traffic out of our organizations. And then typically speaking,
behind the firewall, we've got something called an intrusion detection, intrusion prevention.
See, when you have a castle, you've got this really high wall, and if somebody climbs the wall,
they fall into a moat, and it's filled with sharks and alligators, and there's typically
knights behind the moat. That's the intrusion detection, intrusion prevention system. And then
we use things like access control lists, and host based firewalls, to keep traffic out of our stuff.
But, what happens when the user is on our system? That's what IAM does. So let's say IAM,
for example, is what happens when someone knocks on the front door of your house. See,
if your house was that castle, they couldn't knock on the front door because there'd be the firewall,
or the big giant wall, and if they got past the firewall, they'd be blocked by the IDS,
those sharks, those alligators, those knights. And of course we have other filters,
like access lists to firewalls, but if somebody is knocking on your front door,
they've already bypassed it. So this is where IAM comes in, it's that last line of defense.
So, we're going to talk about how all of this works. Now, when we're talking about IAM,
we're really talking about the authentication, authorization,
and accounting. And people also refer to IAM, or Identity Access Management as basically
identity governance and administration. Now that's more of an accounting term,
and we'll talk about the Authentication Authorization Accounting, just realize
there's a lot of terms that are all bundled into this Identity and Access Management framework.
So let's talk about authentication. What is authentication? It is identification of the user.
Realistically speaking, it means making sure that user is who they claim to be,
that's it. Now we can do this via various methods, as simple as something like a username and
password, that's something you know. And we can use a combination of authentication methods to
really determine that you are you. We can basically use something you have,
like a device, something you are, like biometrics, and some place where you're at,
even geo locations. So we're going to talk about some of the ways we can do this.
The simplest and easiest thing to do is basically a password, something you know.
It's strength is, it's super simple. You just write down a password in your mind,
you remember the password in your mind, and then basically you enter it into the system
when you log in. Now that's great, until your password is compromised,
then this falls apart, so this is not really a robust security environment.
So the next movement up the chain for better authentication, but remember, more complexity,
is something you have and something you know.
So for example, you've got a username and password, and a multi-factor authentication.
So maybe you enter your username and password, and you get a text message, and you have to enter a
code. Maybe you're using RSA secure ID kind of thing, maybe you've got a Google authenticator
app on your phone. That's basically coming up with one-time passwords that are pre-synchronized to be
in existence, as well as your user name and password, so this is much stronger.
So that's its strength, it's strong. Now the weakness is, it gets complex. You've got to
train your users on making sure they understand how these multi-factor authentication work, or
things like that. So, it's a little more complex, but not overly complex, and it enhances security
very much, and we're going to see this for the most part moving everywhere.
As you can see, banks are starting to migrate this, your accounts online
are starting to use this, passwords are just not good enough in today's world.
Now, the next movement up is something you have, and something you are. Think about your passwords
and biometrics. This is much stronger because only you have your eye, or only you have your finger.
So, it's going to be much harder to fake this. Now, of course you can fake it,
but it's going to be much, much, much harder to fake it. So this is
the strongest of the approaches, but here's the weakness. There's a lot of complexity,
and if you've ever worked with biometric devices before, you know they're far from perfect and
they don't work all the time. So, great, great, great, but it's got its weaknesses.
So, since authentication is about who you are, let's talk about the next component,
which is authorization. What can you do? So, authorization is basically what are you allowed
to do on the system after someone knows who you are. So basically the way this typically works
is access is typically grouped into roles based upon organizational functions, or loosely defined
job roles. For example, administrators, finance, et cetera, et cetera, et cetera.
And what happens is authorization is going to outline what users can do after they'd
been authenticated. I mean, first you need to know who the user is before you give them
privileges [inaudible 00:05:54] everybody. So authentication, and then you authorize the user.
Now we can get pretty good and robust here too. We can basically have you as part of a group
that has certain privileges to do certain things, but you might need to escalate your privileges.
So think of the Linux Unix system, for example. Let's say you're logged in as your user,
and then you want to install something, or modify the kernel, and you have to do a super user or a
pseudo to increase your privileges. Well, we can do that same thing with regards to authorization,
we can have something, and then have a user that needs to escalate their
privileges to do some maintenance, and we can add multi-factor authentication and do this
for a temporary escalation. So we've got a lot of play that we can do with authorization.
So let's talk about the strengths of using authorization to limit traffic. It helps a lot,
it enforces the segregation of duties by separating job roles based upon functions.
It groups users with similar access. You basically give the user the access to whatever the minimum
thing is necessary to do their job, and no more. Information, at some point, can hurt you,
so give a limited amount of information, or least amount necessary for people to do their jobs.
Just the right access, no more. And the way this is going to work by default is, basically,
the way you set your systems up is, after someone's authenticated,
if you didn't give them any privileges, they should have none. So good, strong, robust system
find out who you are, make sure you're who you claim to be, and then after that, they determine
what you're allowed to do. So these are the strengths that are associated with authorization.
Now authorization can get fairly complex and we can create some problems. So some weaknesses
of the approach are, you can accidentally create users that have access to too much,
or lock a users permissions down so much that they can't access what you need,
and it's a constant call to tech support for help. So, other problems with this approach is,
let's say you're in one department in an organization, you move to another,
maybe you were in development and you needed a lot of privileges, and now you're in leadership
and don't. People often forget to change the access to people as they change job roles.
Hackers typically target the administrator accounts or the privileged access accounts
because that's where they can do the most damage, so lock these systems down as much as possible.
Now the last component of IAM, or Triple A, is accounting. So you'll recall,
first we authenticated you to make sure who you were,
and then we authorized you to determine what you have access to. Now, we've got to do accounting,
or keep track of it. So accounting basically ensures that after users have gained access,
that their actions and activities are tracked. So this is commonly known as
audit or account recertification. Basically what happens is this, users access something,
and then we can log and check the logs to make sure they didn't access more than they needed to.
So accounting audits are used to make sure that companies meet regulatory requirements,
especially for organizations such as health care and financial services,
but this exists in a wide variety of environments, so this accounting component is really critical.
So what are the strengths of using accounting in your IAM approach? Well, it identifies all
types of access, including unused access, so this is really great stuff. Strengths
include tracking and remediating of excessive or unauthorized access, and realistically speaking,
it could be set up or there's approval required for users that need access.
Now there's some weaknesses to this approach to.
Let's say, for example, in the accounting world, you're looking at things, is it good,
is it good, is it good, and you just rubber stamp all day long. And I've seen this, where
basically everybody just approves everything, and they're like, "Okay, users are good."
Now, you can have other people that are not really informed of what they're approving who can approve
things that are also wrong. So when you're dealing with accounting environments for your cloud,
or accounting for any type of Authentication, Authorization, Accounting, or Identity and Access
Management, you can put yourself in a position if the users don't know what they're doing. So,
Identity and Access Management is the last line of defense to protect an organization systems.
Basically, we authenticate the user, determine who they are. Then we authorize them to give them
access to what they need to be, and then we keep track of it. So let's pretend you are in a house,
let's say all the security systems, like the castle we talked about before, people bypass the
firewall, the wall around the castle, they bypass the IDS, IPS systems, which are basically the moat
around the castle. And let's say, we've got some packet filters, like access lists and
security groups. So now somebody is finally knocking on that door, the server. I'm here.
So, here's what happens, when somebody knocks on the door of your house, and they knock on
the door, you say, "Oh, Jeffrey, welcome in." And if you really like Jeffrey, you let Jeffrey
access all parts of your house. But if you don't trust Jeffrey, you can say, "Jeffrey, you may sit
here and the bathroom's here, and I'm come and get you when I'm ready." Same thing for Identity
and Access Management. People make these things complicated, but they're really simple in general.
So now you know what is Identity and Access Management, also known as Triple A,
and the benefits it can give an organization. I'd like to thank you for watching this video.
We hope we can do anything we can to help build your cloud computing career, whether you want
to be a cloud architect, whether you want to be a cloud engineer, or a network architect,
we want to give you all the skills to build the best technology career.
This is Michael Gibbs from Go Cloud Architects,
and I look forward to seeing you in another video very soon. Have a great day.
It was so nice having you join us for this video today. Let me tell you about
some free services we do for the cloud community. Twice per week, we have a free,
how to get your first cloud architect job webinar, where we tell you all the things you need to do,
and know, to get your first cloud architect job. In addition to that, once per week,
we actually have a free question and answer session, live on YouTube, where you can come and
ask us any questions you want about building your career related to cloud computing or networking,
and we'll answer them in real time for you, because we want to get you to your goals.
Several more times per week, we have guests from industry. Industry experts that I've
known for decades that are movers and shakers that have changed the world, that can give you
information so you can build the best career. I invite them periodically, they are on my show.
If there's a chance to do some free training on our channel, we'll do it live because we want
you to all to have the best skills for the best career. So please subscribe and hit the bell.
I look forward to seeing you and I look forward to assisting you in your technology career.
Thank you so much. This is Michael Gibbs from Go Cloud Architects.