PROTECT: Identity Management, Authentication, and Access Control (PR.AA)

Learning Objectives

By the end of this lesson, you will be able to:

• Implement effective identity and access management systems appropriate for startup scale
• Deploy strong authentication mechanisms that balance security with usability
• Create access control frameworks based on least privilege and zero-trust principles
• Build identity governance processes that scale with organizational growth
• Manage the full lifecycle of user identities from onboarding to offboarding

Introduction: The Keys to Your Kingdom

Identity and access management (IAM) is arguably the most critical security control for any startup. Every data breach, every insider threat, every compliance violation ultimately comes down to someone accessing something they shouldn’t. Yet most startups treat IAM as an IT task—creating accounts, resetting passwords, and hoping for the best.

Modern identity management is about much more than usernames and passwords. It’s about knowing who has access to what, why they have it, whether they still need it, and being able to prove it all to auditors and customers. For startups, it’s also about doing all this without an army of identity administrators or million-dollar IAM platforms.

This lesson shows you how to build identity and access management that provides enterprise-grade security with startup-appropriate complexity and cost.

Understanding PR.AA: Identity Management, Authentication, and Access Control

NIST CSF 2.0 PR.AA Outcomes

PR.AA-01: Identities and credentials are issued, managed, verified, revoked, and audited for authorized individuals, processes, and devices

PR.AA-02: Physical access to assets is managed and protected

PR.AA-03: Remote access is managed

PR.AA-04: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties

PR.AA-05: Network integrity is protected, employing network segmentation where appropriate

Modern Identity Management Principles

Zero Trust Architecture:

• Never trust, always verify—regardless of network location
• Continuous verification of identity and authorization
• Least privilege access by default
• Assume breach and minimize blast radius

Identity as the New Perimeter:

• Traditional network perimeters are dissolving
• Identity becomes the primary security boundary
• Strong identity equals strong security foundation
• Identity-centric security strategies

Lifecycle Management:

• Identity creation with proper vetting and approval
• Regular access reviews and recertification
• Automated deprovisioning and access removal
• Continuous monitoring and anomaly detection

Identity Lifecycle Management

User Onboarding Process

Pre-Employment Phase:

## New Employee Identity Checklist

### Before Start Date
- [ ] Background check completed (if required)
- [ ] Equipment ordered and configured
- [ ] Manager approval for access requirements
- [ ] Identity proofing documentation collected

### Day 1 Setup
- [ ] Create primary user account (email, SSO)
- [ ] Configure multi-factor authentication
- [ ] Assign role-based access groups
- [ ] Provide password manager access
- [ ] Complete security awareness training

### Week 1 Provisioning
- [ ] Department-specific application access
- [ ] Development environment setup (if applicable)
- [ ] Customer system access (if required)
- [ ] Document access permissions granted

Identity Verification Levels:

• Basic (Low Risk Roles): Government ID and employment verification
• Enhanced (Medium Risk): Background check and reference verification
• Comprehensive (High Risk): Criminal check, credit check, and security clearance

Role-Based Access Assignment:

• Start with minimal access required for role
• Add additional access based on documented need
• Require manager approval for privileged access
• Document all access decisions and approvals

Access Management During Employment

Access Review Cycles:

• Monthly: Privileged and administrative access
• Quarterly: Department and system access
• Semi-Annually: All user access comprehensive review
• Annually: Complete access recertification

Access Change Triggers:

• Role changes and promotions
• Department transfers
• Project assignments and completions
• Security incidents or violations
• Performance or disciplinary actions

Temporary Access Management:

## Temporary Access Request Form

### Request Details
- **Requester:** [Name and role]
- **Access Needed:** [System/data/privilege]
- **Business Justification:** [Why needed]
- **Duration:** [Start date - End date]
- **Approver:** [Manager name]

### Security Review
- [ ] Access aligns with business need
- [ ] No separation of duties conflict
- [ ] Appropriate for risk level
- [ ] Expiration date set in system
- [ ] Monitoring enabled for access

Offboarding and Deprovisioning

Termination Types and Timelines:

• Voluntary Resignation: Begin deprovisioning on notice, complete on last day
• Involuntary Termination: Immediate deprovisioning upon notification
• Contractor/Temporary: Automated deprovisioning on contract end date
• Leave of Absence: Suspend access with reactivation process

Offboarding Checklist:

## Employee Offboarding Security Checklist

### Immediate Actions (Within 1 Hour)
- [ ] Disable primary user account
- [ ] Revoke VPN and remote access
- [ ] Disable badge/physical access
- [ ] Change shared account passwords
- [ ] Revoke mobile device access

### Day 1 Actions
- [ ] Transfer data ownership
- [ ] Backup user data (if required)
- [ ] Remove from communication channels
- [ ] Update on-call and emergency contacts
- [ ] Collect company equipment

### Week 1 Cleanup
- [ ] Complete access audit trail
- [ ] Remove from all applications
- [ ] Update documentation and runbooks
- [ ] Knowledge transfer sessions
- [ ] Final security reminder

Authentication Mechanisms

Multi-Factor Authentication (MFA) Strategy

Authentication Factors:

• Something You Know: Passwords, PINs, security questions
• Something You Have: Phone, hardware token, smart card
• Something You Are: Fingerprint, face recognition, voice
• Somewhere You Are: Location, network, device
• Something You Do: Behavioral biometrics, typing patterns

MFA Implementation Levels:

Level 1: Basic MFA (All Startups)

• SMS or voice call OTP for critical systems
• Email-based OTP for lower-risk applications
• Recovery codes for account recovery
• Cost: $0-5 per user/month

Level 2: Standard MFA (10+ Employees)

• Authenticator apps (Google, Microsoft, Authy)
• Push notifications for user convenience
• Backup methods for reliability
• Cost: $5-10 per user/month

Level 3: Advanced MFA (25+ Employees)

• Hardware security keys (FIDO2/WebAuthn)
• Biometric authentication where appropriate
• Risk-based authentication triggers
• Cost: $10-20 per user/month

Level 4: Adaptive MFA (50+ Employees)

• Contextual and risk-based authentication
• Passwordless authentication options
• Continuous authentication monitoring
• Cost: $20+ per user/month

Password Management

Password Policy Framework:

## Password Policy for Startups

### Password Requirements
- **Length:** Minimum 12 characters (14+ preferred)
- **Complexity:** No specific requirements if length met
- **Uniqueness:** Cannot reuse last 12 passwords
- **Expiration:** No forced rotation (unless compromised)

### Password Best Practices
- Use password manager for all accounts
- Unique passwords for every account
- Passphrase approach encouraged
- No password sharing ever

### Password Manager Requirements
- Company-approved password manager mandatory
- Shared vaults for team credentials
- Regular backups of vault data
- MFA required for vault access

Password Management Tools:

• Individual: 1Password, Bitwarden, LastPass
• Team: 1Password Business, Bitwarden Business
• Enterprise: CyberArk, HashiCorp Vault
• Open Source: KeePass, Bitwarden (self-hosted)

Single Sign-On (SSO) Implementation

SSO Benefits for Startups:

• Reduced password fatigue and better security
• Centralized access management and control
• Improved user experience and productivity
• Simplified onboarding and offboarding
• Better visibility into access patterns

SSO Provider Options:

• Google Workspace: Built-in SSO for Google-first startups
• Microsoft Azure AD: Comprehensive identity platform
• Okta: Dedicated identity provider with extensive integrations
• Auth0: Developer-friendly identity platform
• OneLogin: Cost-effective SSO solution

SSO Implementation Roadmap:

1. Phase 1: Core business applications (email, collaboration)
2. Phase 2: Critical SaaS applications (CRM, development tools)
3. Phase 3: Infrastructure and administrative tools
4. Phase 4: All applications supporting SSO

Access Control Frameworks

Role-Based Access Control (RBAC)

Standard Role Hierarchy:

## Startup RBAC Model

### Business Roles
- **Executive:** Strategic systems, financial data, board materials
- **Manager:** Department systems, team data, approval workflows
- **Employee:** Job-specific applications, general resources
- **Contractor:** Limited project-specific access

### Technical Roles
- **Admin:** Full system administration and configuration
- **Developer:** Code repositories, development environments
- **DevOps:** Infrastructure, deployment, monitoring
- **Support:** Customer systems, ticketing, knowledge base

### Compliance Roles
- **Auditor:** Read-only access to compliance data
- **Security:** Security tools and incident response
- **Privacy:** Personal data and privacy controls

Role Definition Template:

## Role Definition: [Role Name]

### Role Information
- **Role Name:** [Descriptive name]
- **Department:** [Owning department]
- **Risk Level:** [High/Medium/Low]
- **Approval Required:** [Manager/Executive/Board]

### Access Rights
- **Applications:** [List of applications and permission levels]
- **Data:** [Types of data and access levels]
- **Systems:** [Infrastructure and system access]
- **Privileges:** [Special permissions or capabilities]

### Constraints
- **Time Restrictions:** [Business hours, on-call periods]
- **Location Restrictions:** [Office, VPN, geographic]
- **Device Restrictions:** [Managed devices only]
- **Separation of Duties:** [Conflicting roles]

Attribute-Based Access Control (ABAC)

Attribute Categories:

• User Attributes: Department, role, clearance level, training
• Resource Attributes: Classification, owner, sensitivity, age
• Environment Attributes: Time, location, network, threat level
• Action Attributes: Read, write, delete, execute, approve

ABAC Policy Examples:

## ABAC Policy Examples

### Policy 1: Customer Data Access
IF user.department = "Support" 
AND resource.type = "CustomerData"
AND time.businessHours = TRUE
AND user.training = "PrivacyCompleted"
THEN ALLOW read

### Policy 2: Production Deployment
IF user.role = "DevOps"
AND resource.environment = "Production"
AND time.maintenanceWindow = TRUE
AND approval.status = "Approved"
THEN ALLOW deploy

### Policy 3: Financial Records
IF user.level >= "Manager"
AND resource.classification = "Financial"
AND user.department = resource.department
AND audit.logging = TRUE
THEN ALLOW read

Principle of Least Privilege

Implementation Strategy:

1. Default Deny: Start with no access and add as needed
2. Just-In-Time Access: Provide temporary elevated access when needed
3. Regular Reviews: Continuously remove unnecessary access
4. Segregation of Duties: Separate conflicting responsibilities

Privileged Access Management (PAM):

• Identify and inventory all privileged accounts
• Implement strong authentication for privileged access
• Monitor and record privileged sessions
• Rotate privileged credentials regularly
• Implement break-glass procedures for emergencies

Physical Access Control

Office Security for Startups

Access Control Levels:

Open Office (Coworking Spaces):

• Rely on building security controls
• Secure storage for sensitive materials
• Clear desk policy enforcement
• Visitor management through reception

Dedicated Office Space:

• Key card or biometric access systems
• Visitor badge and escort requirements
• Security cameras at entry points
• Alarm systems for after-hours

Server/Network Rooms:

• Restricted access list (documented)
• Dual authentication required
• Access logging and monitoring
• Environmental monitoring

Remote Work Security

Home Office Requirements:

## Remote Work Security Requirements

### Physical Security
- [ ] Dedicated workspace with privacy
- [ ] Locking storage for sensitive materials
- [ ] Secure disposal/shredding capability
- [ ] Protection from unauthorized viewing

### Device Security
- [ ] Company-managed or approved devices
- [ ] Full disk encryption enabled
- [ ] Screen lock with timeout
- [ ] Webcam cover when not in use

### Network Security
- [ ] VPN for all company access
- [ ] Separate network for work devices
- [ ] Router security hardening
- [ ] No public WiFi for sensitive work

Remote Access Management

VPN and Zero Trust Network Access

VPN Implementation:

• Traditional VPN: Good for office-to-office connectivity
• Split-Tunnel VPN: Balance security and performance
• Always-On VPN: Maximum security for remote workers
• Per-App VPN: Granular control for specific applications

Zero Trust Network Access (ZTNA):

• Identity-based network access regardless of location
• Micro-segmentation and application-level controls
• Continuous verification of device and user trust
• Reduced attack surface compared to traditional VPN

Remote Access Security Controls:

• Device compliance checking before access
• Location-based access restrictions
• Session recording for privileged access
• Automated threat response and access revocation

Cloud Application Access

Cloud Access Security Broker (CASB):

• Visibility into cloud application usage
• Data loss prevention for cloud services
• Threat protection for cloud applications
• Compliance monitoring and enforcement

Secure Web Gateway (SWG):

• Web filtering and malware protection
• SSL inspection for encrypted traffic
• Cloud application control and monitoring
• Bandwidth management and optimization

Network Segmentation and Protection

Network Segmentation Strategy

Startup Network Zones:

## Network Segmentation Model

### Production Zone
- Customer-facing applications
- Production databases
- Payment processing systems
- Highest security controls

### Development Zone
- Development environments
- Test systems
- CI/CD infrastructure
- Isolated from production

### Corporate Zone
- Employee workstations
- Business applications
- Printers and office devices
- Standard security controls

### Guest Zone
- Visitor WiFi access
- Isolated from all other zones
- Internet access only
- Limited bandwidth

### Management Zone
- Security tools
- Administrative access
- Monitoring systems
- Restricted access

Segmentation Implementation:

• VLANs for logical separation
• Firewalls between network zones
• Access control lists (ACLs) for traffic filtering
• Network monitoring for anomaly detection

Cloud Network Security

Cloud Provider Controls:

• Security groups for instance-level firewalls
• Network ACLs for subnet-level controls
• VPC peering for secure connectivity
• Private endpoints for service access

Software-Defined Perimeter:

• Application-level micro-segmentation
• Identity-based network access
• Encrypted application tunnels
• Dynamic trust verification

Hands-On Exercise: Design Your IAM Strategy

Step 1: Identity Inventory

User Categories:

• Employees: ___ users
• Contractors: ___ users
• Administrators: ___ users
• Service accounts: ___ accounts

Application Inventory:

• Business applications: ___
• Development tools: ___
• Infrastructure systems: ___
• Third-party services: ___

Step 2: Authentication Strategy

MFA Implementation:

• Critical systems requiring MFA: ____________
• MFA method selected: ____________
• Backup authentication method: ____________
• Timeline for implementation: ____________

Password Policy:

• Minimum password length: ___ characters
• Password manager requirement: [Yes/No]
• Password rotation policy: ____________
• Shared account management: ____________

Step 3: Access Control Design

Role Definition: List your top 5 organizational roles and their access needs:

1. Role: _______ Access: _______
2. Role: _______ Access: _______
3. Role: _______ Access: _______
4. Role: _______ Access: _______
5. Role: _______ Access: _______

Access Review Schedule:

• Privileged access review: ____________
• Regular access review: ____________
• Certification process: ____________

Step 4: Implementation Plan

Phase 1 (Month 1):

• Implement MFA for admin accounts
• Deploy password manager
• Document access procedures
• Create onboarding checklist

Phase 2 (Month 2-3):

• Extend MFA to all users
• Implement SSO for core apps
• Establish access review process
• Deploy privileged access management

Phase 3 (Month 4-6):

• Complete SSO rollout
• Implement network segmentation
• Deploy access analytics
• Achieve zero trust architecture

Real-World Example: FinTech Startup IAM Journey

Company: 35-employee digital lending platform Challenge: Regulatory requirements, rapid growth, remote workforce

Initial State:

• Shared passwords in spreadsheets
• No MFA implementation
• Manual account provisioning
• No access reviews or audit trail

Phase 1: Foundation (Months 1-3)

Actions:

• Deployed 1Password for Business
• Implemented Google Workspace SSO
• Required MFA for all financial systems
• Created basic onboarding/offboarding checklists

Results:

• Eliminated 95% of shared passwords
• 100% MFA adoption for critical systems
• Reduced account setup time by 50%
• Passed initial security audit

Phase 2: Maturation (Months 4-9)

Actions:

• Implemented Okta for enterprise SSO
• Deployed CyberArk for privileged access
• Automated provisioning with HR system
• Established quarterly access reviews

Improvements:

• 40 applications integrated with SSO
• Zero standing privileged access
• Automated 80% of provisioning
• Achieved SOC 2 compliance

Phase 3: Optimization (Months 10-18)

Advanced Capabilities:

• Risk-based authentication
• Just-in-time access provisioning
• Behavioral analytics for anomaly detection
• Zero trust network architecture

Business Impact:

• Zero account compromise incidents
• 90% reduction in password reset tickets
• 75% faster employee onboarding
• Enabled $5M enterprise deal requiring advanced IAM

Key Success Factors:

• Started with password manager for quick wins
• Prioritized user experience to drive adoption
• Automated before adding complexity
• Aligned IAM improvements with business goals

Common IAM Implementation Challenges

Challenge: “MFA Creates Too Much Friction”

Solution:

• Start with high-risk systems only
• Use push notifications for convenience
• Provide multiple authentication options
• Remember trusted devices for period
• Communicate security benefits clearly

Challenge: “Too Many Systems to Integrate with SSO”

Solution:

• Prioritize based on risk and usage
• Use password manager for non-SSO apps
• Negotiate SSO in new vendor contracts
• Consider replacing non-SSO applications
• Build SSO requirements into procurement

Challenge: “Access Reviews Take Too Much Time”

Solution:

• Automate data collection and reporting
• Risk-based review frequency
• Manager self-service review tools
• Focus on changes since last review
• Integrate with existing meetings

Challenge: “Developers Need Broad Access”

Solution:

• Implement just-in-time access
• Separate production from development
• Use vault for secret management
• Monitor and alert on unusual access
• Provide break-glass procedures

Key Takeaways

1. Identity is Your Security Foundation: Strong IAM enables all other security controls
2. Start Simple, Build Systematically: Begin with MFA and password managers, evolve to SSO and zero trust
3. Automate Lifecycle Management: Manual processes don’t scale and create security gaps
4. Balance Security and Usability: Overly restrictive controls get circumvented
5. Continuous Improvement Essential: Regular reviews and updates keep IAM effective

Knowledge Check

1. What’s the most important first step in IAM for startups?

   • A) Implement biometric authentication
   • B) Deploy MFA and password managers
   • C) Build custom IAM system
   • D) Create detailed access policies

2. How often should privileged access be reviewed?

   • A) Annually
   • B) Quarterly
   • C) Monthly
   • D) Daily

3. What principle should guide access control decisions?

   • A) Give everyone admin access for efficiency
   • B) Trust but verify
   • C) Least privilege and need-to-know
   • D) Department-based access

Additional Resources

• IAM implementation checklists and templates (coming soon)
• SSO configuration guides for popular platforms (coming soon)
• Zero trust architecture planning resources (coming soon)

In the next lesson, we’ll explore how to build effective security awareness and training programs that transform your employees from potential vulnerabilities into your strongest security assets.