Which term describes the process of identifying, authenticating, and authorizing users, computers, and other entities in systems?

Which term describes the process of identifying, authenticating, and authorizing users, computers, and other entities in systems?

• A. Non-repudiation
• B. Security controls
• C. Gap analysis
• D. Identity and access management (IAM)

Answer: (D)

Identity and Access Management (IAM) is the practice that brings together the processes and technologies used to identify, authenticate, and authorize entities within systems. Identification is how an entity presents who it is, authentication verifies that claim using methods such as passwords, tokens, or biometrics, and authorization determines what the entity is allowed to do based on policies, roles, and attributes. IAM also encompasses provisioning and deprovisioning accounts, enforcing multi-factor authentication, and auditing access to resources. Non-repudiation deals with proving that a transaction occurred and cannot be denied, which is not about controlling access. Security controls refer to protective measures in general, not specifically the end-to-end process of managing identities and access. Gap analysis is a method for identifying differences between current and desired security states, not the ongoing management of identities and access.

Identity and Access Management (IAM) is the practice that brings together the processes and technologies used to identify, authenticate, and authorize entities within systems. Identification is how an entity presents who it is, authentication verifies that claim using methods such as passwords, tokens, or biometrics, and authorization determines what the entity is allowed to do based on policies, roles, and attributes. IAM also encompasses provisioning and deprovisioning accounts, enforcing multi-factor authentication, and auditing access to resources.

Non-repudiation deals with proving that a transaction occurred and cannot be denied, which is not about controlling access. Security controls refer to protective measures in general, not specifically the end-to-end process of managing identities and access. Gap analysis is a method for identifying differences between current and desired security states, not the ongoing management of identities and access.