Module 1: IAM Foundations
Identity as the New Perimeter
For many years organisations protected themselves the way a shop protects stock: lock the building, guard the door, and trust anyone already inside. In IT terms, the "building" was the office network and the "door" was the firewall. That model has weakened. Staff work from home and on mobile data, company email lives in the cloud, accounting runs as a web application, and suppliers log in to shared portals. Much of what you need to protect is no longer behind your firewall at all. What remains constant in every one of those situations is a person or a system proving who it is and then being allowed to do certain things. That is why security professionals now say that identity is the new perimeter.
What changed and why it matters
Think about a typical Nairobi company with 40 staff. Five years ago, its files sat on a server in the office. Today the same company might use a cloud email suite, a cloud accounting package, an online banking portal, a customer relationship tool and a shared drive. A sales manager can open customer records from a phone in a matatu. The firewall in the office never sees that connection. The only control standing between an attacker and that data is the login: the username, the password, any second factor, and the permissions attached to the account.
Attackers have noticed. Rather than breaking through firewalls, many attacks now start with stolen or guessed credentials, phishing pages that capture logins, or abuse of accounts that have far more access than they need. Once inside with a valid account, an attacker looks like a normal user, which makes detection harder.
What Identity and Access Management covers
Identity and Access Management (IAM) is the set of processes, policies and technology that answers four questions for every person, device and application:
- Who are you? Identification and authentication: proving you are the account owner.
- What are you allowed to do? Authorisation: permissions, roles and policies.
- Is that still true? Lifecycle and governance: granting access when people join, changing it when they move, removing it when they leave, and reviewing it regularly.
- What did you actually do? Accountability: logs that tie actions to a specific identity.
Identities are not only people. Service accounts that run backups, API keys used by a payment integration, and devices such as laptops all have identities and need the same discipline. These are often called non-human identities, and in many organisations they outnumber human accounts.
Worked example: one stolen password
Consider a hypothetical accounts assistant, Wanjiru, at a distribution company. She receives an email that looks like it comes from the company's cloud email provider, warning that her mailbox is full. She clicks the link and enters her password on a fake page.
| Control in place | What happens next |
|---|---|
| Password only, shared admin rights | The attacker logs in, reads invoices, changes supplier bank details and sends fraudulent payment instructions. Because Wanjiru's account was also an administrator, the attacker creates a new hidden account to keep access. |
| Password plus MFA | The attacker has the password but cannot complete the second step, so the login fails. A good setup alerts IT to the failed attempt. |
| MFA plus least privilege plus logging | Even if the attacker gets in (for example by tricking her into approving a prompt), her account cannot change supplier bank details or create users, and unusual activity is logged and reviewed. |
Notice that none of these controls involve the office firewall. Every useful defence in this story is an identity control. This is the core idea of the lesson.
Zero Trust in plain terms
You will often hear IAM discussed together with Zero Trust. The idea is simple: do not trust a request just because it comes from inside the network. Instead, verify the identity, check the device and context, grant only the access needed for this task, and keep checking. Zero Trust is a strategy, not a product you can buy in one box, and strong IAM is its foundation.
Common mistakes to avoid
- Treating the firewall as enough. A firewall does nothing for a cloud application accessed with a stolen password.
- Forgetting non-human identities. Old API keys and service accounts with no owner are a favourite way in for attackers.
- Giving everyone admin "to save time". Convenience today becomes a breach tomorrow.
- Thinking IAM is only an IT tool. IAM depends on HR telling IT when people join and leave, and on managers deciding what access their teams need.
Throughout this course you will build on this picture: how to prove identity strongly, how to decide access precisely, and how to keep both accurate over time.
Exercise
List every online system you use for work or business in a normal week, including email, banking, accounting, chat and file sharing. For each one, write down how you log in (password only, password plus code, app approval, or single sign-on) and whether your account has admin rights. Circle the two systems where a stolen password would cause the most damage; you will improve these in later lessons.
Key points
- Most company data now sits outside the office network, so the login is the main line of defence.
- IAM answers who you are, what you may do, whether that is still true, and what you did.
- Non-human identities such as service accounts and API keys need the same care as staff accounts.
- Zero Trust means verifying every request rather than trusting network location.