Introduction to Identity and Access Management

 

You are at the airport with your e-boarding pass. The security personnel at terminal entry gate checks it, and asks you to show an identity card. You decide to present your Aadhaar card.

In the e-boarding pass the security personnel scans certain attributes related to you and your travel – name, date, port of origin and flight. She or he then cross-checks your name on the e-boarding pass with that on your Aadhaar card and also verify your picture on it. Only satisfied with these checks, they let you in the departure terminal.

Let’s say you are carrying only cabin baggage. On the next gate, the security hold area (SHA). Here, the security personnel repeats what the security personnel at the terminal entry gate did. Satisfied with the results, she allows you to proceed for cabin baggage and personal check.

Frisking done, you are now at the departure gate to board the flight. The airline staff runs your e-boarding pass under a scanner that reads the QR code on it. If the scan is successful, the airline personnel asks you to proceed for boarding.

You see what happened? In a tiered 𝐢𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐚𝐧𝐝 𝐚𝐜𝐜𝐞𝐬𝐬 𝐦𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐩𝐫𝐨𝐜𝐞𝐬𝐬, the airport security and airline staff established the validity of your e-boarding pass and your identity and then allowed you access past the gates.
The first security personnel would not let you in if you were at the wrong terminal, or your travel date was in the past or the future, no matter your identity. The second one would not let you in for security check if you were carrying extra luggage. The third one would not let you in the SHA if you were carrying anything objectionable. The airline staff would not let you board if you were at the wrong gate.

Every successful check grants you only as much access as you need, whether you enter the terminal or the SHA, or even the boarding gate. You only board the flight you are supposed to. You only occupy your seat, not someone else’s, or the cabin crew’s.
You see where we are going with this. Identity is the distinguishing character or personality of an individual, in this case verified by UIADI issued Aadhaar card. And access is the means or opportunity to approach or enter a place.

In the context of IT systems in an organisation, a verified digital identity is the condition to gain access to those systems. Any identity can get only the access meant for the requirements of that identity. The CEO and the CXOs have access to decision making dashboards. The network head has access to the network of the company.

𝐈𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭, therefore, is managing the attributes related to the identity that requires certain access over a period. And 𝐀𝐜𝐜𝐞𝐬𝐬 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 is about evaluating those attributes and providing the right amount of access.