Identity and access management: the control everything else leans on

Identity has become the practical perimeter. Applications are distributed, staff work from anywhere, and network location says little about whether a request should be permitted. What remains is the question of who is asking and what they should be allowed to do.

The inventory problem

Access control begins with knowing which accounts exist. Human accounts are usually tracked. Service accounts, API keys, integration credentials, machine identities and accounts created for a project that ended are frequently not — and they tend to hold broad permissions with no owner and no expiry.

An identity inventory that covers non-human accounts, and names an owner for each, is unglamorous work that makes everything after it possible.

Authentication that resists phishing

Multi-factor authentication is not uniform in strength. One-time codes and push notifications can be defeated by relay and fatigue techniques; phishing-resistant methods bound to the origin cannot be relayed in the same way. Where the standard requires multi-factor authentication, the choice of factor is a meaningful decision rather than a formality.

Legacy authentication protocols deserve particular attention, because they commonly bypass conditional access policy entirely. A carefully built policy set can be circumvented by a protocol nobody remembered was still enabled.

Least privilege in practice

Permissions accumulate. People change roles and keep the old access, projects end and leave their grants behind, and temporary elevation quietly becomes permanent. The result is an estate where the blast radius of any single compromised account is far larger than intended.

Two mechanisms help more than periodic cleanups: role definitions that grant what a job requires rather than what a person accumulated, and just-in-time elevation so that administrative rights are requested, time-bounded and logged instead of standing.

Reviews that mean something

Access reviews sent to managers with hundreds of entries produce approvals, not scrutiny. Reviews scoped to high-privilege access, routed to the owner of the system rather than the line manager, and defaulting to removal when unanswered, produce actual reductions.

Joiners, movers, leavers

The movers case is the one that is usually broken. Joining and leaving are visible events with a process attached. Changing role internally often adds new access without removing the old, and repeated over years that is how ordinary accounts end up able to reach almost everything.