KyberScore

Knowledge hub

Identity and Access Management

IAM is how an organization manages who users are (identity), how they prove it (authentication), and what they can do (authorization).

Why it exists

Stolen credentials are a common way in. Strong identity controls are a foundation for Zero Trust.

How it works

  1. 1Central directory of users
  2. 2Single sign-on (SSO) to applications
  3. 3Multi-factor authentication (MFA)
  4. 4Role-based access and regular reviews

Real-world example

Employees sign in once with SSO plus phishing-resistant MFA, and leavers lose access to every app when their directory account is disabled.

Common misconceptions

  • “Any MFA is equal.” Phishing-resistant methods are stronger than SMS codes.

Benefits

  • Fewer passwords
  • Faster on/offboarding

Limitations

  • Legacy apps may not support SSO

How it differs from related technologies

IAM manages identities; Zero Trust uses identity as one input to every access decision.

Questions a buyer should ask

  1. Which MFA methods are supported?
  2. How is access reviewed?

Learning path

beginner

  • • Read CISA's MFA guidance

intermediate

  • • Learn SSO protocols at a high level

advanced

  • • Read NIST SP 800-63

Authoritative sources