Identity and Access Management

Identity and Access Management (IAM) – CIPT Guide: Data Collection, Use, Dissemination and Destruction

Identity and Access Management (IAM): A Complete CIPT Study Guide

1. Introduction
Identity and Access Management (IAM) is a core topic in the IAPP Certified Information Privacy Technologist (CIPT) Body of Knowledge. It sits within the domain covering the data lifecycle: collection, use, dissemination and destruction. IAM decides who can reach personal information, what they can do with it, when, and under what conditions. For a privacy technologist, IAM is one of the main technical ways to turn privacy principles into working controls. Those principles include purpose limitation, data minimization, confidentiality and accountability.

2. Why IAM Is Important
Privacy by Design in practice: Privacy policies mean little if anyone in the organization can open any record. IAM puts limits on use and disclosure into the systems themselves.
Purpose limitation: Linking access to job roles and business purposes makes it more likely that data is used only for the purposes it was collected for.
Data minimization at the access layer: Users see only the attributes they need. For example, a customer service agent may see a masked credit card number rather than the full number.
Regulatory compliance: Several laws require access controls. GDPR Article 5(1)(f) covers integrity and confidentiality, and Article 32 covers security of processing. HIPAA's Security Rule requires access controls, unique user identification and audit controls. PCI DSS requires restricting access on a need-to-know basis. GLBA and many state data security laws contain similar requirements.
Reducing breach risk and impact: Compromised credentials are a leading cause of breaches. Strong authentication and least privilege limit how far an attacker can move inside a network and how much data is exposed.
Insider threat mitigation: IAM limits curious, careless or malicious employees, for example staff who look up celebrity medical records.
Accountability and auditability: Logs of who accessed what support investigations and breach notification decisions. They also help show compliance to regulators.
Supporting data subject rights: Strong identity verification is needed before a data subject access request (DSAR) is fulfilled. Otherwise the organization may disclose data to an impostor.

3. What IAM Is: Core Concepts
IAM is the set of policies, processes and technologies that manage digital identities and control their access to resources. Its key parts are:

a) Identification
A user, device or process claims an identity, usually with a username, account ID or certificate. Identification alone proves nothing. It is only an assertion.

b) Authentication
Authentication verifies that the claimed identity is genuine. The classic authentication factors are:
- Something you know: passwords, PINs, security questions
- Something you have: smart cards, hardware tokens, mobile authenticator apps, one-time passcodes
- Something you are: biometrics such as fingerprint, face, iris or voice
- Sometimes added: somewhere you are (location) and something you do (behavioral patterns such as typing rhythm)
Multi-factor authentication (MFA) combines two or more different factor types. A password plus a security question is NOT MFA, because both are 'something you know'.

c) Authorization
Once a user is authenticated, authorization decides what that user may do: read, write, modify, delete, export or share.

d) Accountability / Auditing
Activity is logged and monitored so actions can be traced back to individual identities. This is why shared or generic accounts are a privacy and security problem.

These elements are often summarized as IAAA: Identification, Authentication, Authorization, Accountability. Some frameworks use AAA: Authentication, Authorization, Accounting.

4. Key Principles
Least Privilege: Give users only the minimum access needed for their job, and no more.
Need-to-Know: Even when a user holds the right clearance or role, access to specific data requires a legitimate business need.
Segregation (Separation) of Duties: Split critical tasks among several people so that no single person can commit and conceal misuse. For example, the person who requests a payment should not also approve it.
Default Deny: Access is denied unless it has been explicitly granted.
Privacy by Default: The most privacy-protective access settings are the starting point.

5. Access Control Models
Discretionary Access Control (DAC): The data owner decides who can access a resource, as when a user shares a file in Google Drive. It is flexible but hard to govern centrally, and it carries a higher risk of oversharing.
Mandatory Access Control (MAC): A central authority enforces access based on security labels or classifications, such as Top Secret or Confidential, and user clearances. Users cannot change permissions. It is common in military and government settings.
Role-Based Access Control (RBAC): Permissions are assigned to roles, such as Nurse, HR Manager or Billing Clerk, and users are assigned to those roles. It is easy to administer and works well with least privilege. It can suffer from 'role explosion' when too many roles are created.
Attribute-Based Access Control (ABAC): Decisions are made dynamically from attributes of the user (department, clearance), the resource (sensitivity, owner), the action, and the environment (time, location, device). It is very granular and context-aware, which suits complex privacy rules. An example rule: 'Doctors can view records only of patients currently under their care, during shifts, from hospital devices.'
Rule-Based Access Control: Access follows predefined rules set by administrators, such as firewall rules or time-of-day restrictions.
Context-aware / Risk-adaptive access: Requirements change with risk signals. For example, step-up authentication may be required for a login from a new country.

6. How IAM Works: The Identity Lifecycle
Step 1 – Identity proofing / enrollment: The organization verifies a person's real-world identity before creating a digital identity. NIST SP 800-63 defines Identity Assurance Levels (IAL), Authenticator Assurance Levels (AAL) and Federation Assurance Levels (FAL). Privacy tip: collect only the identity evidence you need, because proofing itself creates sensitive data.
Step 2 – Provisioning: Accounts and entitlements are created according to role and need. They should be automated and tied to HR systems where possible.
Step 3 – Authentication at use: Users log in with the required factors. Single Sign-On (SSO) lets one authentication grant access to many systems.
Step 4 – Authorization enforcement: Policy enforcement points check each request against the access policy.
Step 5 – Monitoring and logging: Access events are recorded and reviewed, often through SIEM tools. Anomalies trigger alerts.
Step 6 – Access review / recertification: Managers periodically confirm that each user's access is still appropriate. This prevents 'privilege creep', where users build up permissions as they change roles.
Step 7 – Modification: Access is adjusted promptly when roles change. This is the 'movers' part of the 'joiners, movers, leavers' model.
Step 8 – Deprovisioning: Access is revoked immediately when a person leaves or no longer needs it. Orphaned accounts are a major risk.

7. Supporting Technologies and Standards
Single Sign-On (SSO): One login gives access to many applications. It improves usability and reduces password reuse, but it creates a single point of failure. Pair it with MFA.
Federated Identity: Trust relationships between organizations let an identity provider (IdP) vouch for users to service providers (SPs). An example is 'Log in with Google'.
SAML (Security Assertion Markup Language): An XML-based standard for exchanging authentication and authorization assertions, widely used for enterprise SSO.
OAuth 2.0: An authorization framework that grants limited, delegated access through tokens without sharing passwords. An example is letting an app read your calendar. OAuth is about authorization, not authentication.
OpenID Connect (OIDC): An identity (authentication) layer built on top of OAuth 2.0.
Kerberos: A ticket-based network authentication protocol, common in Windows Active Directory environments.
LDAP / Directory Services: Central repositories of identities and attributes, such as Active Directory.
Privileged Access Management (PAM): Specialized controls for administrators and high-risk accounts, including password vaulting, session recording and just-in-time access.
Passwordless authentication and FIDO2/WebAuthn: Public-key cryptography tied to a device, which resists phishing.
Zero Trust Architecture: 'Never trust, always verify.' No user or device is trusted by default based on network location. Every access request is authenticated, authorized and continuously evaluated.
Identity Governance and Administration (IGA): Tools for access reviews, policy enforcement, segregation-of-duties checks and reporting.

8. Privacy Considerations Specific to IAM
IAM systems themselves process personal data. Directories, logs, biometrics and behavioral analytics are personal data and must be protected, minimized and retained only as long as needed.
Biometrics are high-risk. They cannot be changed if compromised and are often classed as sensitive or special category data. Examples include GDPR Article 9, Illinois BIPA, and the Texas and Washington biometric laws. Consent, notice and retention schedules often apply. Store templates rather than raw images, and store them locally on the device where possible.
Federation and tracking risk. Identity providers can see every service a user logs into, which raises linkability concerns. Privacy-enhancing approaches include pairwise or pseudonymous identifiers, selective disclosure, and minimal attribute release ('attribute-based credentials').
Employee monitoring. Heavy logging and behavioral analytics can become workplace surveillance, so use must be proportionate and transparent.
Authentication vs. identification. Many transactions only require proof of an attribute, such as being over 18, and not full identity. Collecting full identity when it is not needed breaches data minimization.
Password practices. NIST SP 800-63B recommends:
- longer passphrases
- screening passwords against known-breached lists
- no forced periodic changes unless there is evidence of compromise
- no composition rules or knowledge-based hints
- secure storage using salted, slow hashing such as bcrypt, scrypt, PBKDF2 or Argon2
Account recovery. Recovery processes are often the weakest link, because social engineering attackers target help desks.
Data destruction link. Deprovisioning is part of the 'destruction' phase. Delete or disable accounts, revoke tokens and keys, and apply retention limits to logs.

9. IAM Across the Data Lifecycle
Collection: Verify the identity of the people providing data where needed. Restrict who can configure collection forms. Minimize identity attributes gathered at enrollment.
Use: Enforce RBAC/ABAC so data is used only for authorized purposes. Use masking or tokenization for users who do not need full values.
Dissemination: Control sharing permissions and external access, such as third-party vendors or federated partners. Use OAuth scopes to limit what third-party apps can reach. Apply data loss prevention (DLP).
Retention and destruction: Restrict who can delete or alter data. Revoke access when data is archived. Deprovision accounts. Destroy credentials and keys (crypto-shredding).

10. Common Threats IAM Addresses
- Credential stuffing and brute-force attacks: countered by MFA, rate limiting and breached-password checks
- Phishing: countered by phishing-resistant MFA such as FIDO2
- Privilege escalation and privilege creep: countered by least privilege, access reviews and PAM
- Insider snooping: countered by need-to-know, ABAC and audit logs with alerts
- Orphaned accounts: countered by automated deprovisioning
- Session hijacking: countered by secure session management, timeouts and token binding
- Shared accounts: countered by unique IDs, which support accountability

11. Exam Tips: Answering Questions on Identity and Access Management

Tip 1 – Master the vocabulary distinctions. CIPT questions often test whether you can tell similar terms apart:
- Identification is claiming an identity.
- Authentication is proving it.
- Authorization is granting permissions.
- Accountability is tracing actions.
If a scenario describes checking a password, that is authentication. If it describes deciding whether a user may export a file, that is authorization.

Tip 2 – Know true MFA. MFA requires factors from different categories. A password plus a PIN is single-factor. A password plus an authenticator app code, or a smart card plus a fingerprint, is MFA. Expect trick answers built on this point.

Tip 3 – Match the access control model to the scenario.
- If owners share at their discretion, think DAC.
- If there are classification labels and clearances, think MAC.
- If permissions follow job functions, think RBAC.
- If decisions depend on context such as time, location, device or the relationship to the data subject, think ABAC.
When a question asks for the most granular or context-sensitive model, ABAC is usually correct.

Tip 4 – Default to least privilege and need-to-know. When a question asks for the BEST way to reduce unauthorized internal access to personal data, the answer is usually least privilege, RBAC/ABAC, or periodic access reviews. Answers such as 'more training' or 'stronger encryption' are less targeted for this problem.

Tip 5 – Recognize OAuth vs. SAML vs. OIDC.
- OAuth means delegated authorization with tokens and scopes, and no password sharing.
- OIDC means authentication on top of OAuth.
- SAML means XML-based enterprise SSO and federation.
A common trap is calling OAuth an authentication protocol.

Tip 6 – Think like a privacy technologist, not only a security engineer. CIPT answers often favor the option that achieves security while minimizing personal data. Examples include:
- verifying an age attribute instead of collecting a full ID
- storing biometric templates locally
- using pseudonymous identifiers in federation
- limiting retention of access logs

Tip 7 – Watch for lifecycle failures. Scenario questions often describe a former employee who still has access, or a long-tenured employee with excessive rights. These point to deprovisioning failures and privilege creep. The fix is automated joiner-mover-leaver processes and periodic recertification.

Tip 8 – Remember that IAM data is personal data. If a question asks about risks of an IAM deployment, consider these points:
- biometric sensitivity and consent laws such as BIPA
- employee monitoring concerns
- retention of logs
- linkability across services through SSO or federation

Tip 9 – Know the modern password guidance. Under NIST SP 800-63B, avoid mandatory periodic resets, use length rather than complexity, check against breached password lists, and use salted adaptive hashing. Answers recommending reversible encryption of passwords or forced 30-day changes are generally wrong.

Tip 10 – Identify segregation-of-duties scenarios. When one person can both create and approve, or both access and audit, the expected control is segregation of duties.

Tip 11 – Link IAM to DSARs. Before fulfilling an access or deletion request, the organization must verify the requester's identity in proportion to the sensitivity of the data. Over-verification breaches minimization. Under-verification risks unauthorized disclosure. The best answer balances the two.

Tip 12 – Use elimination on 'BEST', 'FIRST' and 'MOST' questions. Rule out answers that are too broad (for example, 'encrypt everything'), only detective when a preventive control is asked for, or that collect excess data. Then choose the preventive, proportionate, privacy-preserving control.

Tip 13 – Zero Trust keywords. Phrases like 'never trust, always verify', 'continuous verification', 'micro-segmentation' or 'no implicit trust based on network location' signal Zero Trust.

Tip 14 – Privileged accounts deserve special controls. For administrators and database superusers, look for PAM features: just-in-time access, session recording, credential vaulting and MFA.

12. Sample Practice Questions
Q1: A hospital wants physicians to view only the records of patients they are currently treating, and only from hospital-issued devices. Which access control model BEST supports this?
Answer: ABAC. It evaluates user, resource and environmental attributes together.

Q2: An application lets users grant a third-party service read-only access to their photos without sharing their password. Which technology is MOST likely used?
Answer: OAuth 2.0, which provides delegated authorization through scoped tokens.

Q3: Which of the following is a true multi-factor authentication method? (a) password and security question, (b) PIN and passphrase, (c) password and a fingerprint scan, (d) two different passwords.
Answer: (c). It combines something you know with something you are.

Q4: An audit finds that a long-time employee who has worked in four departments still has access to all four departments' systems. What is this called, and what is the BEST remedy?
Answer: Privilege creep. The remedy is periodic access reviews or recertification combined with mover processes that remove old entitlements.

Q5: A retailer wants to confirm customers are over 21 for online wine sales. Which approach BEST reflects privacy by design?
Answer: Verify the age attribute only, for example with a verified 'over 21' assertion, rather than collecting and storing a full copy of a government ID.

13. Quick Summary
- IAM enforces who can access what, when and how, and is central to confidentiality, purpose limitation and accountability.
- Know the IAAA sequence, the authentication factors and true MFA.
- Know the access models: DAC, MAC, RBAC, ABAC and rule-based.
- Know the core principles: least privilege, need-to-know, segregation of duties and default deny.
- Know the lifecycle: proofing, provisioning, authentication, authorization, monitoring, review and deprovisioning.
- Know the standards: SAML, OAuth 2.0, OIDC, Kerberos, LDAP, FIDO2 and NIST SP 800-63.
- Know the privacy risks of IAM itself: biometrics, logging, federation linkability and employee monitoring.
- In the exam, choose answers that are preventive, proportionate and minimize personal data while still achieving security.