Identity & Access Management
Who are you? Kya tumhe yahan rehne ka haq hai? Yeh sab IAM decide karta hai.
Login ke liye 2 cheezein chahiye: kuch tum jaante ho (password) + kuch tumhare paas hai (phone OTP) ya kuch tum ho (fingerprint). Password chori bhi ho to koi faida nahi attacker ko.
SMS OTP (weakest — SIM swap possible), Authenticator App (better — Google Auth, Authy), Hardware Key (strongest — YubiKey), Biometric.
ATM — PIN (kuch tum jaante ho) + ATM card (kuch tumhare paas hai). Sirf PIN nahi, sirf card nahi — dono chahiye. 2FA yahi concept online.
2023 mein MGM Resorts hack mein — social engineering se employee credentials mili. Agar proper MFA hota to hack fail ho jaata. $100M+ loss directly 2FA missing ki wajah se.
2FA specifically 2 factors. MFA = 2 ya zyada factors. Three categories: Knowledge (password), Possession (phone/token), Inherence (biometric). Mix karo — harder to breach.
🧠Know: Password, PIN, security question
📱 Have: Phone, security key, smart card
ðŸ‘ï¸ Are: Fingerprint, face, iris, voice
📠Where: Location-based (bonus layer)
Framework aur tools jo define karte hain ki kaun user kaun sa resource access kar sakta hai. User accounts banao, permissions assign karo, review karo. Okta, Microsoft Azure AD popular tools.
Least Privilege: Har user sirf woh access mile jo kaam ke liye absolutely zaroori hai — extra nahi. Agar DB admin ko billing system access nahi chahiye, nahi milega.
IAM ka subset jo specifically privileged accounts (admins, root, service accounts) ko protect karta hai. These accounts are highest risk — inka control matlab full system control.
Just-in-time access (sirf jab zaroori), session recording (admin ne kya kiya), password vaulting (auto-rotate passwords), MFA enforcement.
Ek baar login karo (Google ya company account se), sab apps automatically accessible. "Sign in with Google" = SSO. Token exchange hota hai behind the scenes (OAuth, SAML).
SSO account compromise = sab apps compromise. Isliye SSO account pe strong MFA absolutely zaroori. "Single point of failure" bhi ho sakta hai.
Traditional model: network ke andar ho to trusted. Zero Trust: andar ya bahar koi fark nahi — har request verify karo, least privilege do, assume breach. "Trust but verify" → "Never trust, always verify."
Remote work, cloud era mein "corporate network" ka concept gone. Employees anywhere se kaam karte hain. Zero Trust ke bina insider threats aur compromised accounts devastating hote hain.
Google ka BeyondCorp — industry ka pehla large-scale Zero Trust implementation (post-Operation Aurora 2010 China hack). Now industry standard recommendation.
DAC: Owner decide karta hai (files on your PC)
MAC: System decide karta hai (military, classified)
RBAC: Role-based (employees, managers, admins)
ABAC: Attribute-based (time, location, device)
HR role = employee data access. Finance role = payroll access. Developer role = code repo access. Mix nahi hota. Role change karo, permissions automatically change.
Identity verify karna — prove karo tum wahi ho jo tum claim karte ho. Password, biometric, token — sab authentication methods hain.
Authentication = WHO are you? (Passport check)
Authorization = WHAT can you do? (Visa allows entry to certain areas)
Authenticated user ko kya resources access karne ki permission hai. Login ke baad — "can this user read/write/delete this file?" Authorization decide karta hai.
Broken Access Control — OWASP Top 10 mein #1. User A ki ID change karke User B ka data access karna (IDOR). Horizontal aur vertical privilege escalation.
Login ke baad server ek token deta hai (string of characters). Agle requests mein password ki jagah token bhejo. Limited time ke liye valid. JWT (JSON Web Token) most common.
Header.Payload.Signature — 3 parts dot se separated. Payload mein user info (encrypted nahi, base64 encoded!). Signature server verify karta hai.
Movie ticket. Counter pe ID dikhaya (login), ticket mila (token). Ab har movie hall mein token dikhao — baar baar ID nahi dikhani. Ticket expire hoti hai (token expiry).