Identity and Access Management (IAM) Best Practices
Identity and Access Management (IAM) is the framework for ensuring the right people have the right access to the right resources — and no more. Poor IAM is a leading cause of security incidents: over-privileged accounts, orphaned accounts, and credential sharing all create exploitable weaknesses.
Core IAM Principles
- Principle of least privilege: Every user, service, and system should have the minimum permissions required to perform its function — nothing more
- Just-in-time access: For privileged operations, access should be granted temporarily and on-demand rather than permanently assigned
- Separation of duties: Critical operations should require multiple people — preventing any single person from completing a sensitive action alone
- Account lifecycle management: Access should be provisioned, modified, and deprovisioned promptly as roles change — especially on departure
Technical IAM Controls
- Strong authentication: MFA for all users, especially administrators
- Centralised identity provider: Single sign-on (SSO) through a centralised identity provider (Okta, Azure AD, Google Workspace) — reducing credential sprawl
- Role-based access control (RBAC): Assign permissions to roles, assign users to roles — not individual permission grants
- Service accounts: Each service has its own non-human identity with minimal permissions — no shared credentials between services
- Regular access reviews: Periodically review who has access to what — remove access that is no longer justified