Identity & Access Management

The Joiners, Movers and Leavers (JML) process manages the lifecycle of user access within an organisation. It ensures that access rights are appropriately granted, modified, and revoked as employees join, move within, or leave an organisation. Typical controls include: Access Request and Approval: Ensuring that access requests are properly authorised by relevant managers or system owners. Role-Based Access Control (RBAC): Assigning access based on the user’s role within the organisation to enforce the principle of least privilege. Periodic Access Reviews: Regularly reviewing user access rights to ensure they are still appropriate. Automated Provisioning and De-provisioning: Using automated tools to grant and revoke access promptly as users join, move, or leave the organisation. Audit Logging and Monitoring: Keeping detailed logs of access changes and monitoring for any unauthorised access attempts. Segregation of Duties: Ensuring that critical tasks are divided among multiple users to prevent fraud and errors. Further reading What are Joiners-Movers-Leavers (JML)? - BeyondTrust

Role-Based Access Control (RBAC) is a method of managing access to computer or network resources by assigning permissions to predefined roles based on job functions or responsibilities within an organization. By linking users to roles rather than assigning permissions directly, RBAC simplifies permission management, reduces the risk of unauthorised access, and enhances scalability. For example, an accountant may have access to financial reporting but not HR systems. Widely used in enterprise technology environments, RBAC supports compliance with security policies and regulatory requirements while ensuring efficient and understandable access management. ...

A TOTP (Time-based One-Time Password) is a temporary passcode generated by an algorithm for authenticating access to computer systems. It is a form of 2FA (two-factor authentication) enhancing security by requiring not only a password but also a time-sensitive code. The code, typically generated on a mobile device, expires after a short window, reducing the risk of interception and reuse. From a risk management perspective, requiring TOTP for system access reduces the likelihood of credential-based attacks, such as phishing or brute force attempts. They are widely used to secure remote access, privileged accounts, and are becoming commonplace for everyday authentication. ...

IAM, or Identity & Access Management, is a method that ensures people have the appropriate access to technology resources and data. It protects sensitive information by managing user identities and their permissions. For example, it ensures employees can only access files and systems needed for their job.

Machine identity or Non-human identity (NHI) security is the process of managing and securing the digital identities of non-human entities, such as applications, APIs, and devices - to control their access to resources and prevent unauthorised activity. In modern IT environments, where machines and software increasingly interact with each other on their own, machine identity security provides the framework for authenticating these non-human entities and managing their access to critical resources. ...

Further reading What is OAuth 2.0? - Okta What is OAuth - Microsoft Security What the Heck is OAuth? - Okta Developer

Further reading Least privilege - NIST Glossary Enhance security with the principle of least privilege - Microsoft Learn Minimise the privilege and reach of applications - NCSC Principle of least privilege - Wikipedia