In information technology, physical access includes access to physical assets such as facilities, operational areas, and data centers. Logical access includes access to computing assets such as operating systems, application programs, and networks that include the Internet/intranet, information, and data.

Access to physical or logical assets is attempted by entities such as people, programs, or scripts. From the perspective of access, every entity that is trying to access physical or logical assets through any method is considered to be anonymous before some sort of method is used to determine the identity of the entity, and subsequently the access permission. The information security domain that deals with such activities is called identity and access management—€”in short, IAM.

The IAM domain can be further subdivided into two interrelated management activities: identity management and access management. Generally, they are called layers in this domain. There are distinctive principles and practices that govern processes in these layers. The layers are known as identity layers and access layers.

This chapter covers principles and practices in the identity layer, or in other words, it covers identity management principles and practices. In the next chapter, we will cover access management principles and practices that pertain to access layers.