.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Identity security
Also called identity-first security, identity and access security, ICAM
Identity security is the discipline of protecting every human and machine identity, together with its credentials and entitlements, across its lifecycle, so that only verified identities gain the access they need and misuse of that access is detected quickly.
Identity security treats the account, not the network, as the thing to defend. It asks four questions about every identity: who or what is it, what can it reach, how are its credentials protected, and is it behaving as expected. The answers span people, service accounts, API keys and cloud roles, on-premises and in the cloud.
How it works
Identity security usually combines these layers:
| Layer | What it covers | Related term |
|---|---|---|
| Proofing and authentication | Verifying who someone is and how strongly they signed in | NIST SP 800-63-4 |
| Entitlements | What each identity may reach, kept to the minimum | Least privilege |
| Privileged access | Brokered, time-bound, recorded admin access | PAM |
| Machine identities | Service accounts, keys, tokens and workload roles | Non-human identity |
| Visibility | Which accounts can log in where, and attack paths | CAASM |
| Detection | Behaviour against a baseline, alerts and response | DAM |
NIST SP 800-63-4 sets out assurance levels for identity proofing (IAL), authentication (AAL) and federation (FAL). Those levels decide how much trust a sign-in deserves; identity security then governs what that trusted session may do.
Why it matters
In a zero trust architecture, identity is the main input to every access decision. NIST SP 800-207 bases resource access on dynamic policy that includes the client identity, and CISA’s Zero Trust Maturity Model makes Identity the first of its five pillars, with access management maturing towards just-in-time and just-enough access. Machine identities widen the problem: OWASP’s Non-Human Identities Top 10 lists risks such as secret leakage, long-lived secrets and improper offboarding.
Identity security vs network security
Network security limits which hosts can talk to each other. Identity security limits what each account can do once connected, and follows that account across networks, clouds and SaaS. Both are needed; identity controls matter more as more access happens outside the corporate network.
Examples
- Discovering that a decommissioned contractor account is still a member of a nested group with local admin rights on a database server.
- Replacing a shared root password with brokered sessions that inject the credential.
- Flagging an application account that reads a sensitive table at an hour it has never used.
How SWOT supports it
SWOT covers several layers. SWOT Radar resolves directory, local and cloud identities into one model and shows who can log in to each host, following nested Active Directory groups. SWOT PAM and SWOT Cloud PAM control privileged access with time-bound grants, and SWOT DAM scores each database identity against its own 30-day baseline. See zero standing privileges.
Questions
- How is identity security different from IAM?
- Identity and access management is the operational system that creates accounts, signs users in and assigns entitlements. Identity security is the protective view across it: finding overprivileged or orphaned accounts, protecting credentials, controlling privileged access, and detecting identities that behave abnormally. It uses IAM data but adds risk analysis, monitoring and response.
- Which identities should be covered first?
- Start with identities that can change systems or reach sensitive data in bulk: domain and cloud administrators, database owners, and the service accounts and API keys behind production workloads. These carry the most risk per account, are often the least reviewed, and are the ones attackers try to reach after an initial compromise.
In SWOT
Sources
Related terms
- Privileged access management (PAM)Privileged access management (PAM) is the set of controls and tools that decide who may use administrative access to critical systems, for how long and under what conditions, while keeping the credentials protected and every privileged session on record.
- Non-human identity (NHI)A non-human identity (NHI) is an account or credential used by software rather than a person, such as a service account, API key, workload role, bot or certificate, that lets applications, scripts and services authenticate to other systems.
- Zero trustZero trust is a security model that grants no implicit trust based on network location or asset ownership, and instead authenticates, authorises and evaluates every request to a resource on its own merits, with least privilege, before and during each session.
- Least privilegeLeast privilege is the security principle that every user, process and system should hold only the access rights it needs to perform its assigned tasks, and nothing more, so that a mistake or compromise affects as little as possible.
- Cyber asset attack surface management (CAASM)Cyber asset attack surface management (CAASM) is the practice of continuously discovering an organisation's devices, workloads and identities, reconciling them into one accurate inventory, and showing how they connect, so that unmanaged assets, excess access and attack paths can be found and fixed.