Identity became the perimeter
When applications and data live across multiple clouds and SaaS platforms, the question “is this request coming from inside our network?” stops being useful. The meaningful question becomes “who is making this request, and are they allowed to?” That makes identity the control plane most other security decisions hang from.
What IAM covers
Identity and Access Management is the discipline of managing accounts and their permissions across the full lifecycle: creating them when someone joins, adjusting them when a role changes, and removing them promptly when someone leaves. The last is where most organisations quietly fail. Dormant accounts belonging to former staff and contractors are a recurring finding in breach reports.
Core practices include single sign-on to reduce password sprawl, multi-factor authentication to make stolen credentials less useful, and role-based access so permissions follow job function rather than accumulating over a career.
Why PAM is treated separately
Privileged Access Management is a stricter regime for accounts that can cause disproportionate damage: domain administrators, cloud root accounts, database owners, and service accounts with broad permissions. These are the accounts attackers work toward, so they warrant controls that would be impractical everywhere.
- Just-in-time elevation, so privilege is granted for a task and expires afterwards
- Credential vaulting so administrators never handle raw passwords
- Session recording for high-impact administrative work
- Separate administrative identities, distinct from day-to-day user accounts
The habit that matters most
Permissions accumulate. Someone moves from finance to operations and keeps both sets of access. Over years, a workforce quietly acquires far more privilege than any job requires. Scheduled access reviews, where a manager confirms each person still needs what they hold, is unglamorous work that removes a genuine amount of risk.
Related in the Knowledge Base
- Zero Trust Explained: Why the Perimeter Stopped Working
- Social Engineering: Why People Remain the Reliable Attack Path
- Cloud and Hybrid Security: Understanding Shared Responsibility
Know what an attacker sees before they do.
A practical exposure checklist covering the gaps that cause most breaches, plus what POPIA actually requires you to have in place.
Free PDF · No spam · Unsubscribe anytime