Access & identity (IAM): auditability and control in infrastructure
IAM is the foundation of both security and operations. If it is not clear who has what permissions, for how long and how it is controlled, the infrastructure remains unauditable and risky.
IAM is the backbone of both security and operations.
Without MFA, audit logs and removal of shared access rights, changes are unauditable and incidents are more expensive.
Key questions
- Manage privileged accounts: who has admin/root, where are the "break-glass" accounts and how are they used?
- Lifecycle access: how are authorizations created and terminated (joiner/mover/leaver)? Is it tied to HR/IDP?
- Least privileges: are roles and permissions designed according to responsibilities, or "all things to all people"?
- MFA and strong authentication: is MFA mandatory for privileged roles, VPN, admin consoles and critical systems?
- Audit and traceability: do we have centralized audit logs (who changed what, when, from where) and can we find them in the event of an incident?
- Secrets & certificates: where are secrets stored (API keys, tokens, certificates), who rotates them and how often?
- Suppliers: are the access just-in-time (JIT), with revisions and separation from internal accounts?
Typical risks in practice
- Shared accounts and passwords: there is no attribution of changes and incidents cannot be explained retrospectively.
- Permanent admin rights: privileged roles are "default", with no approval and no expiration time.
- Non-existent revisions: entitlements don't move for years, even if the team or supplier changes.
- Secrets in repositories: keys in code or in non-rotating and ownerless configurations.
- Audit logs out of reach: logs are not centralized or are kept too short for investigation.
The biggest shift will often come from the "minimum standard": personal accounts, MFA, separate privileged roles, centralized audit logs and regular revisions of authorizations.
Related:
Do you need help?
To design or stabilize access and identity in your infrastructure, get in touch with us – we will advise you how to do it.
Contact WOV Tech