IAM Best Practices: What They Are and How to Use Them

The average number of cyberattacks and data breaches increased by 15.1 percent from 2020 to 2021, and that number is still on the rise. To protect your organization against security threats, it’s critical that you prioritize identity and access management (IAM) best practices.

Table of contents

1. What is Identity and Access Management?
2. Why is IAM important?
3. What are IAM best practices?
4. How is IAM used in AWS?

What is Identity and Access Management?

Back to top ↑

Identity and access management (IAM) is a framework of cybersecurity policies that allows organizations to make sure that the right people have access to the appropriate technologies and information. Also known as Identity management (IdM), IAM systems include two-factor authentication, sign-on systems, multi-factor authentication, and privilege access management. These types of technologies grant organizations the ability to store identity and profile data securely.

IAM includes the following components:

• The way individuals are identified in a system
• How roles are identified and assigned to individuals in the system
• Assigning type of access to individuals or groups
• Adding, updating, and removing individuals and roles in a system
• Protecting sensitive information in the system and securing the system itself

Why is IAM important?

Back to top ↑

It’s important for IT departments and business leaders to protect access to corporate information and resources. With increased regulatory and organizational pressure to protect sensitive data, they can no longer rely on manual, error-prone processes to track and assign user privileges and access. IAM automates these types of tasks and allows access control and auditing of all company assets both on prem and in the cloud.

What are IAM best practices?

Back to top ↑

Now that we understand what IAM is and why it’s necessary, let’s take a look at some of the IAM best practices.

1. Centralized security system

Centralizing your IAM operations makes it easier to access all functionalities and configurations in one place. This centralization will grant you better visibility to all the different security configurations of your system. Centralized security systems allow users to access both cloud and on-prem resources through a common digital identity. It’s particularly important to maintain a centralized system when you have a hybrid scenario, so that you can manage accounts from one location.

2. Utilize multi-factor authentication

Making multi-factor authentication mandatory for all user accounts is a great way to improve security. It adds a layer of protection to the sign in process that can help ensure that whoever is trying to access the account is a legitimate person. Even if a hacker were to compromise login credentials, multi-factor authentication will restrict them from gaining invalid access to the account.

3. Establish single sign-on (SSO) authentication

SSO is an authentication method that enables users to log in with a single ID to any of several related, but independent, systems. This type of authentication reduces the challenge of remembering multiple passwords and organizations, but still secures passwords and sensitive information securely. SSO services like Intermedia Cloud Communications make implementing this type of authentication easy.

4. Enforce strong password policies

An easily implemented IAM best practice is creating and enforcing strong password policies. In creating a strong password, keep in mind the most secure password is one you can’t remember. It’s difficult to keep track of unique passwords for multiple different accounts, which is why using password managers like 1Password, Dashlane, and Bitwarden can help you stay organized across accounts. 1Password even has a free secure password generator tool that can help you come up with strong passwords.

The National Institute of Standards and Technology (NIST) recommends setting up a password expiration policy, so that users regularly change their password to avoid breaches. Typically, setting password expirations to 45 to 60 days makes for the strongest, safest passwords. Regularly renewing your password secures employee accounts from credential stuffing, identity theft, and other password compromise attacks.

5. Make sure the privileged accounts are properly managed

With IAM, follow the principle of least privilege. This means a person should only have the minimum access privileges necessary to perform a specific task or job and nothing more. It’s best practice to assign a minimum permission level to accomplish a given task and maintain complete monitoring and logging of the role.

6. Regularly review and remove orphan accounts

Employees regularly come and go from organizations, so it’s important to perform regular reviews of user accounts and their privileges. Offboarded employees leave behind orphan accounts, which attackers can misuse. Therefore, it’s important to periodically check on orphan accounts and either delete them or withdraw their privileges and roles. This improves security and decreases the chances of a security breach or attack.

7. Get rid of high-risk systems

Another best practice for IAM is to eliminate third party-integrations and high-risk software. Many software and integrations no longer support patches and updates by their vendors, so these applications with no security updates could pose a security threat to your IAM solution.

8. Operate with a zero trust approach to security

It’s always best to assume that nobody is trustworthy, unless you have verification. Taking a zero trust approach, all users, whether they’re in or outside the organization, should have to repeatedly validate who they are in order to maintain their access to the organization’s information. Operating with this mindset also makes it easier to identify breaches, abnormal behaviors, or violations of the law.

How is IAM used in AWS?

Back to top ↑

AWS implements cloud IAM practices in order to help organizations securely control access to AWS resources.

When you create an AWS account, you begin with one sign-in identity that gives you complete access to all AWS services and resources within the account. This ID is called the AWS account ‘root user’ and can be accessed by signing in with the email address and password created for this account. AWS recommends not using the root user for everyday tasks, but instead only using it to perform the tasks that the root user can perform.

IAM features within AWS include general IAM best practices, as well as AWS-specific features. Some of these features include:

• General permissions
• Shared access to your AWS account
• Multi-factor authentication
• Secure access to AWS resources for applications that run on Amazon EC2
• Integration with AWS services
• Identity federation
• Identity information for assurance
• PCI DSS compliance

To learn more about AWS-specific IAM, check out this AWS IAM guide. AWS even offers a free course called Introduction to AWS Identity and Access Management for you to deepen your understanding of how to use IAM in AWS.

Related articles