Skip to main content
Style:
Size:

Chapter 2: The 5 Pillars of Identity (A Framework to Keep You Sane)

One of the biggest mistakes a company can make is treating Identity and Access Management (IAM) purely as an IT procurement project.

It usually happens like this: A Chief Information Security Officer (CISO) gets spooked by a data breach on the news. They secure a massive budget, buy a shiny, expensive piece of software like Okta, CyberArk, or SailPoint, plug it into the network, and proudly declare to the board, "There. We're secure."

Spoiler alert: You are not secure.

Without an underlying framework, a fancy IAM tool just automates your existing bad habits at a much faster speed. If your process for giving a developer access to the core network is broken, automating it just means you are handing out dangerous access faster and more efficiently.

To prevent this, every single identity problem—whether you are dealing with a human employee, a background database bot, or an autonomous AI agent—must be solved using a structured framework. We call this the 5 Pillars: People, Process, Technology, Control, and Impact.

1. People (The "Who" and the "Who is Responsible")​

In the old days of network security, the "People" pillar simply meant the employee sitting at the keyboard. Today, it means the Owner. Identity cannot exist without accountability.

  • Human Workloads: This remains straightforward. Alice from Accounting owns her account. If Alice does something malicious, HR and Legal know exactly who to talk to.
  • Non-Human Identities (NHI): A database backup script doesn't have a pulse. If it goes rogue and starts deleting network logs, you can't fire the script. Rule #1 of NHI: Every single service account must have an active human sponsor. If that sponsor leaves the company, ownership must immediately transfer to their manager, or the bot gets automatically turned off.
  • AI Workloads: When an AI agent is dynamically generating API calls to your cloud infrastructure, who is responsible when it accidentally exposes sensitive data? The "People" pillar dictates that the developer or team who deployed the agent's identity boundary is the ultimate owner.

2. Process (The Lifecycle)​

Process dictates the rules of the game. It is the heartbeat of both IAM and Network Security, universally known as the Joiner, Mover, Leaver (JML) lifecycle.

  • Joiner: How is the identity created? (e.g., HR enters a new hire into Workday, triggering a cascading sequence of automated network approvals).
  • Mover: What happens when an entity changes roles? If Bob moves from Sales to Engineering, his network VPN profile needs to change just as much as his software licenses.
  • Leaver: How do we kill the access the exact second a contract is terminated?

The Modern Process: Continuous Certification Historically, companies reviewed access once a year using massive, unreadable spreadsheets that managers just rubber-stamped. Modern enterprises replace this with an Anytime Review Cycle (ARC). Using custom, responsive dashboards, managers are periodically presented with highly contextual, bite-sized access reviews. Instead of a yearly audit, the review cycle is continuous, visual, and seamlessly integrated into their daily workflow.

Interactive Simulator: The IAM Lifecycle Explorer​

Visualize how automated Identity rules cascade into network and application provisioning across the Joiner, Mover, and Leaver lifecycle:

IAM Lifecycle (JML) Explorer

Visualize how automated Identity rules secure the network across an employee's tenure.

The Joiner Phase (Day 1 Onboarding)

The goal is zero-friction productivity without manual IT tickets.

📝
HR Trigger
HR enters new hire 'Alice' into Workday.
👤
Identity Creation
IAM system automatically creates an Active Directory account.
🔐
RBAC Assignment
Alice is assigned the 'Marketing' role, granting Email and Intranet access.
✅
Secure Productivity
Alice logs in on Day 1 with exact Least Privilege access.

3. Technology (The Engine)​

This is the software and hardware enforcing your rules. The most critical shift in modern security is that IAM and Network Technology have inextricably merged.

In the past, the network team managed firewalls, and the IAM team managed passwords. Today, we use Zero Trust Network Access (ZTNA). In a Zero Trust world, the network firewall doesn't care what your IP address is; it only cares who you are and if your device is safe.

  • For Humans: Identity Providers (IdP) like Entra ID or Okta authenticate the user, while Zscaler or Palo Alto networks enforce the micro-segmented routing.
  • For AI & NHI: We use Secrets Managers (like HashiCorp Vault) and API Gateways. The technology ensures the AI doesn't use a static, permanent password, but rather a temporary, rotating token.

4. Control (The Guardrails)​

If Process is the road and Technology is the car, Controls are the brakes and guardrails that keep you from flying off a cliff.

  • Phishing-Resistant MFA: The foundational control for humans. (SMS text messages no longer count as secure).
  • Just-In-Time (JIT) Access: Instead of giving a network admin 24/7 standing access to a core router, they have zero access by default. They request access, get approved, and the network opens for exactly 2 hours before slamming shut again. Every keystroke is logged.
  • Contextual Bounding (For AI): AI agents shouldn't have standing permissions. If an AI is asked to "summarize customer feedback," the control is a rigid API policy that explicitly blocks the AI's identity from executing DELETE or WRITE commands on the database, regardless of what the user's prompt tells it to do.

5. Impact (The Blast Radius)​

When you design an IAM control, you must ask a brutally honest question: "If this identity is compromised, what is the worst thing the attacker can do?"

  • Low Impact: A marketing intern's account is hacked. They can post an embarrassing tweet.
  • Critical Impact: The service account running your automated network backups is compromised. The attacker can encrypt the backups, deploy ransomware across your servers, and bankrupt the company.

Consultant's Corner: The "So What?" Test​

When a client asks you to implement a complex, highly secure IAM control—like requiring a physical smart-card and a fingerprint scan for every single employee—you must apply the Impact pillar to test their logic.

If the employee is a contractor who only accesses the cafeteria menu and the shuttle schedule, a biometric smart-card is too heavy for the impact. It creates friction, costs money, and users will hate it. Save the expensive, high-friction controls for your Network Admins, Cloud Engineers, and autonomous AI deployment pipelines. Apply security proportionally to the risk.

Putting It All Together: A Real-World Example​

Let's say you want to deploy a new AI chatbot to help employees reset their passwords (an AI Workload). How do we secure it using the 5 Pillars?

  1. People: You assign Sarah, the IT Helpdesk Lead, as the documented owner of the bot's identity.
  2. Process: You build an Anytime Review Cycle that requires Sarah to audit the bot's transaction logs every 30 days to ensure it hasn't gone rogue.
  3. Technology: You use an API Gateway to connect the chatbot's reasoning engine to your Active Directory.
  4. Control: You implement a strict guardrail stating the bot can only reset passwords for standard users. It is mathematically blocked from interacting with Network Admin or Executive accounts.
  5. Impact: By restricting the bot from resetting Admin passwords, you have successfully reduced the blast radius. If the bot is tricked by a hacker using Prompt Injection, the core network remains completely safe.

In our next chapter, we will dive deep into the messy, human reality of the Joiner, Mover, Leaver process—and what happens to your network when HR forgets to tell IT that an employee was fired.