SECURE · Identity & Access Management
The Right Access for the Right People, and Nothing More.
We implement identity governance, privileged access management and strong authentication across your users and systems.
- Fewer credential-driven incidents
- Least-privilege access
- Audit-ready access reviews
- 1Discover Identities
- 2Design Access Model
- 3Deploy and Integrate
- 4Enforce and Monitor
- 5Certify and Improve
Executive Summary
- 01Most breaches that involve credentials succeed because access was broader, older or weaker than anyone realized.
- 02Strong identity programs combine accurate identity data, phishing-resistant authentication, controlled privilege and recurring review.
- 03Automation and evidence matter as much as technology, because manual access processes drift and cannot be audited.
The Challenge
Credential compromise through stolen identities and weak multi‑factor authentication is a leading threat.
Joiners, movers and leavers are managed manually, and privileged accounts accumulate unchecked.
The DAAKYI Approach
DAAKYI designs the identity architecture, automates lifecycle processes and puts privileged access behind vaulting, approval and session control.
Authentication is strengthened in step with user experience.
- 01
Identity governance and lifecycle
- 02
Privileged access management
- 03
Authentication and access control
- 04
Access reviews
In Depth
How the Discipline Works
Identity Data Is the Foundation
Every access decision starts with an identity record. That record says who a person or workload is, what role they hold, and who vouches for them. If the record is wrong, every downstream control inherits the error. Identity governance defines the authoritative sources, usually HR for employees and a sponsor process for contractors, and maps each source to roles. Roles bundle entitlements so that access follows job function, not personal request history. Governance also sets the policies that decide which combinations of access are never allowed together, such as the ability to create and approve a payment. Clean identity data makes automation, review and audit possible.
Authentication Proves, Authorization Limits
Authentication confirms that the caller is who the record says. Authorization decides what that caller may do once confirmed. Treating them as one step is a common design flaw. Strong authentication uses factors that resist phishing, such as hardware-bound cryptographic credentials, and applies stronger checks when risk rises. Authorization then evaluates role, resource sensitivity, device state and context before granting a session. Privileged sessions add vaulted credentials, approval and recording. Service accounts and application identities need the same discipline, with managed secrets and defined owners, because attackers target them precisely when human accounts are well protected.
Review Keeps Access Honest
Access drifts. People change teams, projects end, and exceptions outlive their reasons. Periodic certification asks the business owner of each application or role to confirm who should still hold access. Good reviews show reviewers meaningful context, such as last use and risk level, so they can revoke with confidence rather than approving everything by default. Revocations must flow back into connected systems automatically and be verified. Evidence of the review, the decision and the removal becomes the record auditors ask for. Over time, review results also expose badly designed roles, which feeds back into governance and shrinks future review effort.
Identity is the perimeter that follows every user, device and workload; govern it like infrastructure, not like an account list.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Identity Governance | Policies, roles and access certification. | – | SECURE stage | – | Project Implementation |
| Privileged Access Management | Vaulting, approval and session control. | – | SECURE stage | – | Project Implementation |
| Authentication and Access Control | Strong, phishing-resistant authentication. | – | SECURE stage | – | Project Implementation |
| Identity Lifecycle Management | Automated joiner-mover-leaver processes. | – | SECURE stage | – | Project Implementation |
Identity Governance
Policies, roles and access certification.
- Stage
- SECURE
- Delivered Through
- Project Implementation
Privileged Access Management
Vaulting, approval and session control.
- Stage
- SECURE
- Delivered Through
- Project Implementation
Authentication and Access Control
Strong, phishing-resistant authentication.
- Stage
- SECURE
- Delivered Through
- Project Implementation
Identity Lifecycle Management
Automated joiner-mover-leaver processes.
- Stage
- SECURE
- Delivered Through
- Project Implementation
How It Works
How Identity & Access Management Works
- 01Govern
- 02Authenticate
- 03Authorize
- 04Review
Methodology
The Method, Step by Step
- 1
Discover Identities
Inventory human, contractor, service and administrative identities across directories, applications and cloud platforms. Identify authoritative sources, orphaned accounts, shared credentials and standing privilege. The output is a factual baseline of who has access to what, which every later design decision depends on.
- 2
Design Access Model
Define roles, policy rules and separation-of-duty constraints with business owners. Choose the authentication strength for each population and the privileged access tiers for administrators. Document the target architecture, including directories, federation, vaulting and how each connects to authoritative sources. Agree exceptions explicitly rather than allowing them to accumulate.
- 3
Deploy and Integrate
Build the platforms in stages, starting with the highest-risk systems and administrators. Connect lifecycle automation to the HR source, onboard applications to single sign-on, and move privileged credentials into the vault. Test each integration with real joiner, mover and leaver cases before it carries production traffic.
- 4
Enforce and Monitor
Switch on enforcement gradually: phishing-resistant authentication for administrators first, then wider populations. Feed authentication, vault and session logs into monitoring so unusual privilege use, impossible travel and repeated failures raise alerts. Measure user friction alongside security outcomes so controls stay usable and are not bypassed.
- 5
Certify and Improve
Run scheduled access certifications, test that revocations actually take effect, and track metrics such as orphaned accounts and standing privileged accounts. Use findings to refine roles and policies. Retain evidence of each decision so audits draw on records the process already produces.
Operating Model
Delivered from the SECURE Pillar
Pillar position
SECURE
Engineering, Architecture & Implementation
Engagement model
Project Implementation
Design and deployment of security technologies.
Best for · Modernization and transformation
Threat Scenarios
What It Looks Like in Practice
Phished or Fatigued Multi‑Factor Prompts
How It Shows Up
A user approves an unexpected push prompt, or a sign-in succeeds from a new location minutes after a phishing campaign.
Response
Replace push and one-time codes with phishing-resistant credentials for high-risk users, and add conditional access that challenges or blocks anomalous sign-ins.
Leaver Who Keeps Access
How It Shows Up
An account tied to a departed employee or contractor is still active and appears in sign-in logs weeks later.
Response
Drive deprovisioning from the HR source of record, disable accounts across connected systems together, and report on any account without a valid owner.
Standing Administrator Rights
How It Shows Up
Many accounts hold permanent domain or cloud administrator roles, and some are shared between staff.
Response
Move administrators to named accounts with just-in-time elevation, vaulted credentials, approval and session recording, and remove permanent rights.
Secrets Embedded in Code
How It Shows Up
Service account passwords or API keys appear in scripts, repositories or configuration files, and none have been rotated.
Response
Inventory non-human identities, assign owners, move secrets into a managed vault and replace long-lived keys with short-lived tokens.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Phished or Fatigued Multi‑Factor Prompts | A user approves an unexpected push prompt, or a sign-in succeeds from a new location minutes after a phishing campaign. | Replace push and one-time codes with phishing-resistant credentials for high-risk users, and add conditional access that challenges or blocks anomalous sign-ins. |
| Leaver Who Keeps Access | An account tied to a departed employee or contractor is still active and appears in sign-in logs weeks later. | Drive deprovisioning from the HR source of record, disable accounts across connected systems together, and report on any account without a valid owner. |
| Standing Administrator Rights | Many accounts hold permanent domain or cloud administrator roles, and some are shared between staff. | Move administrators to named accounts with just-in-time elevation, vaulted credentials, approval and session recording, and remove permanent rights. |
| Secrets Embedded in Code | Service account passwords or API keys appear in scripts, repositories or configuration files, and none have been rotated. | Inventory non-human identities, assign owners, move secrets into a managed vault and replace long-lived keys with short-lived tokens. |
Outcomes
What Your Institution Gains
- Fewer credential-driven incidents
- Least-privilege access
- Audit-ready access reviews
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Identity and Access Baseline Report | Documents current accounts, privileges, authentication methods and gaps so priorities rest on evidence. |
| Role and Policy Model | Defines roles, entitlements and separation-of-duty rules that business owners have approved. |
| Target Identity Architecture | Shows how directories, federation, authentication, vaulting and lifecycle automation fit together. |
| Privileged Access Standard | Sets tiers, approval rules, credential rotation and session recording requirements for administrators. |
| Access Certification Evidence Pack | Records reviewer decisions and verified revocations in a form auditors can test. |
| Role | Responsibility |
|---|---|
| Identity Program Owner (Client) | Sets policy, accepts risk decisions and resolves conflicts between security and business needs. |
| HR Data Owner (Client) | Keeps the employee and contractor source records accurate, because lifecycle automation relies on them. |
| Application Owner (Client) | Defines who should hold access to the application and completes certification reviews on time. |
| Identity Engineer (Provider) | Builds and integrates the identity, authentication and vaulting platforms and tests each connection. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Access is granted by request and removed when someone remembers. Administrator accounts are shared and reviews are rare.
Stage 2
Managed
A central directory and single sign-on cover major applications, and multi-factor authentication is common. Joiner and leaver steps are partly automated.
Stage 3
Governed
Roles, certifications and a privileged access vault are in place. Evidence is produced routinely and exceptions are tracked.
Stage 4
Adaptive
Phishing-resistant authentication, just-in-time privilege and risk-based decisions are standard. Identity signals feed detection and response.
Frameworks and Regulation
The Standards That Shape This Work
ISO/IEC 27001:2022
Annex A contains 93 controls in four themes, and access control, identity management and authentication fall within them. ISO/IEC 27002:2022 gives the implementation guidance.
PCI DSS v4.0 and v4.0.1
Its requirements on restricting access by business need and on identifying and authenticating users apply directly. Future-dated requirements became mandatory on 31 March 2025.
NIST CSF 2.0
The framework has six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Identity management, authentication, and access control fall mainly under Protect.
MITRE ATT&CK Enterprise
It organizes adversary behavior into 14 tactics, including Credential Access and Privilege Escalation, which helps teams test whether identity controls interrupt real techniques.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for a provider that starts with an identity inventory instead of a product choice.
- Look for designs that treat service accounts and application identities as first-class subjects.
- Look for authentication plans that name phishing-resistant methods and explain how exceptions and recovery are handled.
- Look for deliverables that include evidence for auditors, not only configured tools.
Questions to ask a provider
- How will you find accounts and privileges we do not know about?
- How do you handle contractors and other identities that sit outside HR?
- What happens when the identity platform is unavailable and administrators must still work?
- Which reports will show that revoked access was actually removed?
Regulatory & Industry Context
The Obligations This Service Supports
Identity controls support ISO/IEC 27001, PCI DSS and SOC 2 access requirements.
Frameworks DAAKYI helps clients implement
- ISO/IEC 27001
- PCI DSS
- SOC 2
- NIST CSF
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- ISO/IEC 27001
- PCI DSS
- SOC 2
- NIST CSF
Identity controls support ISO/IEC 27001, PCI DSS and SOC 2 access requirements.
Architecture reference
How Identity & Access Management Works: Govern → Authenticate → Authorize → Review.
DAAKYI designs the identity architecture, automates lifecycle processes and puts privileged access behind vaulting, approval and session control.
Federation and Token Hygiene
Modern access relies on federation protocols. SAML and OpenID Connect let applications trust an identity provider instead of storing passwords. Security depends on configuration detail. Validate token signatures, audience and expiry. Keep session lifetimes short for sensitive applications and require reauthentication for high-risk actions. Protect signing keys, since theft of a signing key lets an attacker forge assertions for any user. Disable legacy protocols that bypass multi-factor authentication, such as basic authentication for mail. Use conditional access to evaluate device compliance and location at each sign-in. For workloads, prefer short-lived tokens issued through workload identity over long-lived keys embedded in code or configuration files. Log token issuance centrally so forged or replayed tokens can be spotted.
Privileged Access Tiering
Privileged access works best when separated into tiers. Domain and cloud control-plane administration sits in the highest tier, with dedicated administrator accounts that never browse the web or read mail. Administrators connect through hardened jump hosts or privileged access workstations. The vault rotates credentials after each use and checks them out against an approved request with a time limit. Session brokering records activity and can terminate a session on suspicious commands. Where possible, replace standing administrator rights with just-in-time elevation that expires automatically. Break-glass accounts remain, sealed and monitored, for outages when normal authentication fails. Any use of a break-glass account should trigger an immediate alert and later review.
Glossary
Key Terms
- Entitlement
- A specific permission in a system, such as membership of a group or a role in an application.
- Separation of Duties
- A rule that prevents one person from holding access that allows them to complete a sensitive process alone.
- Just‑in‑Time Access
- Privilege granted for a limited period after approval and removed automatically when it expires.
- Orphaned Account
- An active account with no valid owner, often left behind by a leaver or a retired project.
Related
Explore Connected Capabilities
Solutions
Platforms
Industries
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Identity & Access Management
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Identity & Access Management with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Identity & Access Management will respond.
Talk to a Cybersecurity Expert