Cybersecurity area
Identity and Access Mgmt
Identity and Access Mgmt manages, verifies, and audits digital identities and access for users, administrators, services, applications, and cloud roles.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- IAM
- Identity and Access ManagementManagement of digital identities, authentication, authorization, and access policies.
- MFA
- Multi-Factor AuthenticationUser verification with multiple factors such as password plus app, token, or biometric factor.
- PAM
- Privileged Access ManagementControl and protection of privileged accounts, administrator access, and sensitive operations.
- PIM
- Privileged Identity ManagementManagement of privileged identities, entitlements, roles, and temporary access to sensitive systems.
- IGA
- Identity Governance and AdministrationGovernance of identities, roles, entitlements, recertifications, and auditable access lifecycle.
- SSO
- Single Sign-OnA sign-on model that allows users to access multiple applications through one controlled identity point.
- SCIM
- System for Cross-domain Identity ManagementA standard for automated provisioning, updating, and deprovisioning of user accounts in applications.
- RBAC
- Role-Based Access ControlAccess control based on roles where permissions follow the user's job function or responsibility.
- ABAC
- Attribute-Based Access ControlDynamic access decisions based on attributes of the identity, device, resource, environment, and requested action.
- PBAC
- Policy-Based Access ControlAccess control through central policies combining identity, resource, action, conditions, and approval.
- ReBAC
- Relationship-Based Access ControlAccess control based on the identity's relationship to a specific object, team, owner, or managed service.
- JIT
- Just-in-Time AccessTemporary access granted only when justified and automatically removed after the task or approved time window ends.
- JEA
- Just Enough AdministrationDelegation of only the necessary administrative tasks, commands, and targets without granting full privileges.
What This Area Covers
Identity and Access Mgmt defines who or what can access systems, applications, data, and administrative functions. Identity today is not only a username in a directory. It includes employees, contractors, administrators, service accounts, cloud roles, API access, devices, and application identities.
Why It Matters
Because many attacks begin with a compromised identity or abused privilege, IAM is one of the most important areas of security architecture. MFA reduces password misuse risk, SSO centralizes access, PAM protects privileged accounts, PIM reduces standing administrative privileges, and IGA governs access and certifications. RBAC, ABAC, PBAC, and ReBAC define the basis for authorization, while JIT and JEA limit its duration and scope.
How To Navigate This Area
Identity is now a primary security control point. When choosing technologies, it is necessary to separate authentication, authorization, identity lifecycle, governance, privileged access, privileged identities, technical secrets, and integrations with directories, SaaS applications, and cloud platforms. Authorization may be based on roles, attributes, policies, or relationships and should be reinforced by least privilege, just-in-time, and just-enough access. Phishing-resistant MFA, IGA, and continuous access risk evaluation are also increasingly important.
IAM solutions should be selected by separating authentication, authorization, governance, privileged identities, technical secrets, and lifecycle management. An organization may have strong MFA but weak access removal processes or overly broad roles. RBAC alone may be insufficient in dynamic environments where context, attributes, or a relationship to the protected object matters. Privileged access should combine policies, approvals, JIT, JEA, session audit, and reliable removal of elevated privileges.
The technology list below works as a map of the Identity and Access Mgmt area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which identities are the riskiest: regular users, administrators, contractors, or service accounts?
- Is the problem authentication, permission assignment, recertification, or access removal?
- Does the environment require integration with HR, AD, Entra ID, SaaS apps, or cloud roles?
- Are critical accesses protected with phishing-resistant MFA or only by passwords and push approval?
- Are privileged accounts, cloud roles, and technical secrets managed separately and auditably?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Credential theftAn adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- BFLA – Broken Function Level AuthorizationA regular or unauthenticated user invokes an administrative or privileged API function that should not be available to them.
- Broken API authentication and token abuseAn adversary bypasses login, password recovery, or token validation and assumes the identity of a user or service.
- Sensitive business flow and bot abuseAn automated adversary abuses legitimate functionality such as purchasing, booking, registration, voting, commenting, or account recovery.
- Credential stuffing and password sprayingAn adversary automatically tests leaked username-password pairs or a small set of common passwords against many accounts.
- MFA fatigue, push bombing, and interceptionAn adversary floods a user with MFA prompts, intercepts a code, or uses social engineering to make the user approve an unauthorized sign-in.
- Session and access-token hijackingAn adversary steals a cookie, OAuth token, or another session artifact and accesses a service without re-entering a password or MFA.
Relevant ATT&CK techniques
- T1003 · OS Credential DumpingDetect, Prevent, Respond
- T1069 · Permission Groups DiscoveryDetect, Prevent, Respond
- T1078 · Valid AccountsDetect, Prevent, Respond
- T1098 · Account ManipulationDetect, Prevent, Respond
- T1110 · Brute ForceDetect, Prevent
- T1111 · Multi-Factor Authentication InterceptionDetect, Prevent
- T1133 · External Remote ServicesDetect, Prevent, Respond
- T1136 · Create AccountDetect, Prevent, Respond
- T1484 · Domain or Tenant Policy ModificationDetect, Prevent, Respond
- T1528 · Steal Application Access TokenDetect, Prevent, Respond
- T1539 · Steal Web Session CookieDetect, Prevent
- T1550 · Use Alternate Authentication MaterialDetect, Prevent, Respond
- T1552 · Unsecured CredentialsDetect, Prevent, Respond
- T1555 · Credentials from Password StoresDetect, Prevent, Respond
- T1556 · Modify Authentication ProcessDetect, Prevent, Respond
- T1621 · Multi-Factor Authentication Request GenerationDetect, Prevent