Identity and Access Management (IAM)

🔑 Key Takeaway: IAM answers who can act on which systems, with least privilege, strong authentication, and fast revocation when roles change.

Identity and Access Management (IAM) is how teams control who reaches systems and data, and how that access stays appropriate over time. Weak IAM enables account takeover, privilege abuse, and lingering access after people leave — common failure modes for Web3 projects that move fast across many SaaS tools and shared admin paths.

Basics

IAM has three linked concerns:

• Identity: proving who a person or service is
• Authentication: verifying that identity (passwords, MFA, SSO)
• Authorization and access lifecycle: what that identity may do, for how long, and when access ends

What this framework covers

1. Role-Based Access Control: define roles with minimum permissions and separation of duties.
2. Secure Authentication: MFA (prefer hardware keys), SSO hygiene, and password practices.
3. Access Management: JIT access, reviews, onboarding/offboarding, and access logging.

Related frameworks

• OpSec — Multi-Factor Authentication
• OpSec — Password Management
• Guides — Account Management
• DPRK IT Workers: insider and hiring-path risks
• Infrastructure: platform IAM overlays

Further Reading

• NIST SP 800-63 Digital Identity Guidelines
• OWASP Authentication Cheat Sheet