Concept Maps

Access Certification

Access certification is a formal review where managers, system owners, or data owners confirm whether users should keep specific access.

Access Certification Campaign Design

Access certification campaign design is the process of deciding what access will be reviewed, who will approve it, how exceptions are handled, and how results will be tracked.

Access Review Implementation

Access review implementation is the practical work of running access reviews, collecting decisions, applying removals, and keeping evidence.

Account Merging

In customer identity systems, the process of combining two or more identity records that belong to the same real person into a single account, for example when a user who signed up with a password later logs in with Google. Done carelessly, it can let one identity take over another.

Active Directory Security

The practice of protecting Microsoft Active Directory, the on-premises identity service that authenticates users and controls access across most enterprise networks. Because nearly everything trusts it, compromising AD often means compromising the whole environment.

Active Directory Security Architecture

The structural design choices that make Active Directory defensible, such as administrative tiering, forest and domain trust boundaries, privileged access workstations, and the placement of controls that limit how far an attacker can move after a foothold.

AD Attack Surfaces

The parts of an Active Directory environment that an attacker can target or abuse, including privileged accounts, service accounts and their tickets, group memberships, domain controllers, trusts, and misconfigured permissions.

AD Compromise Response

The specialized response to an incident where an attacker has gained control of Active Directory itself, which often means assuming every credential and trust is suspect and may require rebuilding or restoring the directory from a clean state.

AD Privileged Account Hardening

Securing the high-power accounts in Active Directory, such as Domain Admins and service accounts, by limiting their number and rights, restricting where they can log in, enforcing strong authentication, and monitoring their use closely.

App Registration Security

Securing application registrations in Microsoft Entra ID (Azure AD), the entries that let apps authenticate and request permissions. Over-permissioned or stale registrations and their secrets are a common cloud-identity attack path.

Authentication Protocols

The standardized methods systems use to verify identity and exchange authentication information, such as Kerberos, SAML, OAuth, OpenID Connect, and RADIUS. Each has its own trust model and security considerations.

Automated Provisioning Implementation

Building the systems and workflows that automatically create, update, and remove user access as people join, change roles, or leave, replacing manual account setup with rules driven by an authoritative identity source.

Azure AD Privileged Hardening

Securing the high-privilege roles and identities in Microsoft Entra ID (Azure AD), such as Global Administrators, by limiting their number, enforcing strong and phishing-resistant MFA, and using just-in-time elevation through Privileged Identity Management.

Azure AD Security

Protecting Microsoft Entra ID (Azure AD), the cloud identity service that authenticates users to Microsoft 365 and many other apps. Because it is the front door to cloud resources, securing its authentication, conditional access, and privileged roles is essential.

Behavioral Anomaly Detection

In identity governance, detecting access behavior that deviates from a user's or peer group's norm, such as accessing systems they never use or acting outside their role, to surface risky or compromised identities.

Bot Protection in CIAM

Defenses in customer identity systems against automated abuse such as credential stuffing, fake account creation, and scraping. Because CIAM faces the open internet, distinguishing real users from bots is a core security need.

CI/CD Credential Management

Securing the secrets, API keys, tokens, and credentials, used by continuous integration and deployment pipelines. Because pipelines are powerful and automated, their credentials are a prime target and must be vaulted, scoped, and rotated.

CIAM Build vs Buy

The decision of whether to build a custom customer identity system or adopt a commercial CIAM platform. It weighs control and customization against the cost, time, and security burden of building and maintaining identity in-house.

CIAM Consent Management

Capturing, recording, and honoring customers' choices about how their personal data is collected and used, in a customer identity system. It is essential for privacy compliance and for maintaining customer trust.

CIAM Data Subject Rights

The mechanisms a customer identity system provides to fulfill individuals' privacy rights, such as accessing, correcting, deleting, or exporting their personal data, as required by privacy regulations.

CIAM Distinct from IAM

The recognition that customer identity (CIAM) differs fundamentally from workforce identity (IAM): it serves millions of external, untrusted users who self-register, demands privacy and consent handling, and prioritizes a low-friction experience over administrative control.

CIAM Evaluation Criteria

The factors used to compare and select a customer identity platform, such as scalability, authentication options, fraud and bot defense, privacy and consent features, developer experience, and total cost. They turn a vague 'which CIAM?' into a structured decision.

CIAM Fraud Integration

Connecting a customer identity platform with fraud-detection signals and systems so that risk, device intelligence, behavior, and reputation, can shape authentication and account decisions in real time, blocking abuse without burdening legitimate customers.

CIAM Platform Landscape

The range of available customer identity platforms and their differing strengths, from full-featured commercial suites to developer-focused services and open-source options. Understanding the landscape is the starting point for choosing or benchmarking a CIAM solution.

CIAM Threat Landscape

The specific threats facing customer identity systems, including credential stuffing, account takeover, fake-account creation, bot-driven abuse, and fraud. Because CIAM is internet-facing and serves untrusted users, it absorbs attacks that workforce IAM rarely sees.

CIAM Use Cases

The customer-facing scenarios a CIAM platform must support, such as self-service registration and login, social and passwordless sign-in, profile and consent management, and progressive profiling. They define what the system actually has to do.

Conditional Access Configuration

The detailed setup of conditional access policies in a directory service like Microsoft Entra ID, defining the conditions, signals, and controls that govern sign-ins, with attention to avoiding gaps, lockouts, and misconfigurations attackers exploit.

Continuous Access Evaluation

A zero-trust capability that re-checks a session's validity in near real time rather than only at login, so that if conditions change, a token is revoked, risk rises, or a device falls out of compliance, access is cut off promptly.

Credential Checkout

In privileged access management, the process by which a user or system retrieves a privileged credential from a vault for temporary use, with the credential tracked, time-limited, and often rotated after use so it is never freely held.

Cross-System SoD

Separation of duties enforced across multiple systems, ensuring that a combination of access spread over different applications does not let one person complete a sensitive process alone, even when no single system shows a conflict.

DCSync Detection

Detecting the DCSync attack, in which an adversary with sufficient privilege abuses Active Directory replication to request password hashes from a domain controller as if it were one, a powerful credential-theft technique against AD.

Device Compliance Integration

Tying access decisions to a device's compliance state in zero trust, so that only devices meeting security requirements (patched, encrypted, managed, healthy) are allowed access, and non-compliant ones are blocked or restricted.

Device Trust in ZTA

The zero-trust principle that a device's identity and security posture must be established and continuously verified before it is trusted to access resources, so access depends on the device, not just the user.

Group Policy Hardening

Using Active Directory Group Policy to enforce secure configuration across many Windows systems at once, applying hardened settings, restrictions, and security baselines centrally rather than configuring each machine individually.

IAM Architecture

The overall design of an organization's identity and access management, how identities, authentication, authorization, directories, and access controls fit together across systems, so access is secure, consistent, and manageable at scale.

IAM Architecture Patterns

Reusable, proven design approaches for structuring identity and access management, such as hub-and-spoke identity, centralized versus federated models, or standard provisioning and SSO designs, that engineers adapt rather than designing from scratch.

IAM Career Path

The progression of roles in identity and access management, from analyst or administrator through IAM engineer to architect and program leadership, with specializations like cloud IAM, IGA, or privileged access.

IAM Career Reflection

A capstone reflection on the identity-and-access-management career journey, consolidating what an IAM practitioner has learned and how the pieces, technical, program, and governance, fit into a coherent professional path.

IAM Design Principles

The guiding principles for sound identity and access management design, such as least privilege, single identity, separation of duties, defense in depth, and automation, that shape secure, maintainable IAM architectures.

IAM Detection for Meridian

A capstone exercise applying identity threat detection to a fictional organization (Meridian), designing detections for identity-based attacks as part of building that organization's identity program end to end.

IAM Gap Analysis

Assessing an organization's current identity and access management against a desired target state to identify gaps, weaknesses, missing capabilities, and risks, that the identity program needs to close.

IAM Program Assessment

Evaluating an entire identity and access management program, its capabilities, controls, maturity, and risks, to judge how well it is working and where it needs improvement, as a capstone view of an identity program.

IAM Program Design

Designing the overall identity and access management program, its capabilities, processes, controls, roadmap, and governance, so identity is managed coherently across the organization rather than as disconnected tools and tasks.

IAM Program Governance

The oversight structures that keep an identity program aligned, accountable, and effective, ownership, policies, access reviews, metrics, and decision-making, so identity management is governed rather than left to drift.

IAM Threat Detection

Detecting attacks against identity and access systems, anomalous logins, privilege escalation, suspicious entitlement changes, and credential abuse, since identity is a primary target and effective perimeter in modern environments.

Identity Analytics Capabilities

Analytical functions in identity governance that examine access and behavior data to surface risk, such as detecting outlier access, separation-of-duties conflicts, dormant accounts, and risky entitlements, turning identity data into actionable insight.

Identity Federation

Establishing trust between identity systems so a user authenticated in one can access another without a separate account, the mechanism an IAM engineer builds, via standards like SAML and OIDC, to enable single sign-on across organizations and clouds.

Identity Outlier Detection

An identity-governance analytic that finds identities whose access is unusual compared to their peers, flagging people with more or different entitlements than similar roles, a strong signal of excessive or inappropriate access.

Identity Provisioning

Creating and granting access to identities, setting up accounts and assigning the right entitlements when someone joins or needs new access, ideally automated so access is timely, accurate, and based on role.

Identity Risk Scoring

Assigning each identity a risk score based on factors like its access, behavior, anomalies, and policy conflicts, so governance and detection can prioritize the riskiest identities for review, monitoring, or remediation.

Identity-Centric ZTA

A zero-trust architecture that treats identity as the primary control point, making strong authentication and continuous, context-aware authorization of identities the foundation of access decisions rather than network location.

IGA Implementation Patterns

Proven approaches for rolling out identity governance and administration, such as phased deployment, starting with high-risk applications, or focusing first on access certification, that help an IGA program succeed rather than stall.

IGA Implementation Realities

The practical challenges of implementing identity governance and administration, messy data, complex application integrations, organizational resistance, and scope creep, that make IGA projects hard and often longer than expected.

IGA Platform Functions

The core capabilities an identity governance and administration platform provides, access request and provisioning, access certification, role management, separation-of-duties enforcement, and identity analytics, that automate and govern access at scale.

IGA Platform Landscape

The market of identity governance and administration products and their differences, helping practitioners understand the available platforms, their strengths, and how to choose one suited to the organization's needs.

IGA Program Metrics

The measures used to track an identity governance program's health and value, such as certification completion rates, access-request turnaround, orphaned-account counts, and separation-of-duties violations, showing whether governance is working.

IGA Program Operations

The ongoing running of an identity governance program, executing access certifications, processing requests, maintaining roles, resolving violations, and reporting, so governance is sustained day to day rather than a one-time setup.

Meaningful Certification Practice

Running access certification campaigns that actually drive correct access decisions, rather than rubber-stamping exercises, by providing context, focusing on risk, and following through on revocations identified.

MFA Implementation

How an organization actually deploys MFA, choice of factors, coverage of users and apps, enrollment and recovery, fallback, and protection of the MFA system itself, so MFA delivers real security rather than gaps and friction.

Microsegmentation Principles

The principles behind microsegmentation in zero trust, granular, identity-aware segmentation between workloads so each can only reach what it needs, with default-deny and continuous policy enforcement.

NIST SP 800-207

NIST Special Publication 800-207, the influential definition of zero-trust architecture from NIST, laying out core principles, components, and deployment models that have become the reference for understanding zero trust.

Perimeter Model Failure

The recognition that the traditional 'trust the inside, defend the perimeter' security model no longer works, since cloud, mobile, and remote work erase a clear boundary and once inside, attackers move freely. It is the motivation for zero trust.

Privileged Access Management

Processes and tools for controlling and monitoring powerful accounts.

Progressive Microsegmentation

Rolling out microsegmentation gradually in stages rather than all at once, starting with monitoring, then enforcing in narrow scopes and expanding, so the transition succeeds without breaking applications.

Role Engineering Value

The benefits of designing roles deliberately, simpler administration, cleaner audits, stronger least privilege, that justify investing in role engineering rather than letting access grow ad hoc.

Role Mining Methodology

Systematically deriving role definitions from existing access data and job-function information, top-down (from organization roles) or bottom-up (from entitlements analysis), producing roles grounded in real use.

Role Mining Tools

Software tools that automate role mining, clustering entitlements, identifying candidate roles, and presenting them for review, making large-scale role engineering practical for sizeable organizations.

Role Model Implementation

Putting a designed role model into operation, defining roles in the IGA system, migrating users to them, and managing day-to-day, so the engineered roles actually drive access in practice.

SCIM Protocol

System for Cross-domain Identity Management: a standard for provisioning users, groups, and identity attributes between systems, the protocol modern IAM uses to keep accounts in sync across applications.

Segregation of Duties Modeling

Modeling segregation-of-duties (SoD) constraints in IGA, identifying which combinations of access shouldn't be held by the same person, so the access model enforces SoD rather than relying on after-the-fact review.

SoD Enforcement Approaches

The mechanisms used to enforce segregation of duties in IGA, preventive blocking at provisioning, detective alerting in reviews, compensating controls, applied per situation to keep SoD real.

SSO Implementation

Operating single sign-on in practice, choosing protocols, integrating applications, managing trust, that an IAM engineer handles to deliver SSO reliably and securely across an organization's apps.

Unmanaged Device Policy

Zero-trust policy that limits or denies access from devices the organization doesn't manage, BYO, contractor, personal, since unmanaged devices can't be trusted to enforce security baselines.

VPN Limitations

Limitations of traditional VPNs that drive zero-trust adoption, perimeter trust on connect, lateral movement once inside, weak device posture, that ZTA replaces with continuous, per-request verification.

Zero Trust Roadmap

A planned, phased path to adopt zero-trust architecture, identity first, then device, network, applications, that recognizes ZTA is multi-year and best implemented incrementally rather than all at once.

ZTA Logical Components

The logical building blocks of a zero-trust architecture as defined by NIST SP 800-207, Policy Engine, Policy Administrator, Policy Enforcement Point, that describe how access decisions and enforcement work together.

ZTA Maturity Model

A model describing stages of zero-trust adoption, typically CISA's traditional / initial / advanced / optimal across pillars, that gives organizations a structured way to assess progress and plan next steps.

ZTA Migration Pitfalls

The common traps organizations hit while moving to zero-trust, treating ZTA as a product, breaking productivity with overzealous controls, neglecting identity foundations, that derail ZTA programs.

ZTA Privilege Escalation Controls

Zero-trust controls that limit privilege escalation, just-in-time elevation, strong MFA at elevation, device-trust requirements for admin actions, scoped tokens, that reduce what an attacker can do with a foothold.

ZTNA Architecture

Zero Trust Network Access architecture: the design pattern that replaces VPN with identity- and device-aware brokered access to specific applications, granting only what's needed per session.