Identity and Access Management (IAM)

A broad term for the policies, processes, and technologies that manage digital identities and regulate user access to resources. IAM covers things like creating or removing user accounts, managing roles and permissions, handling authentication methods, and auditing who did what.

‍

In essence, it's about making sure the right people (or systems) have the appropriate access to the right resources at the right time - and no more. Even without a dedicated IAM team, SMBs engage in basic IAM when they onboard new hires (creating accounts, setting their access rights) or revoke access for departures.

‍

Good IAM practices include regularly reviewing user access, enforcing least privilege), and quickly revoking access that's no longer needed, to prevent "leftover" accounts from becoming entry points for attackers.