Start here
Three references that cover the whole field.
Identity Fundamentals & Directory Services
Who exists, and who says soA directory isn't a source of truth. It's a cache of one.
Authentication & Credentials
Proving it's themAnything that can be relayed will be.
- NIST SP 800-63BNIST · Authentication and authenticator managementAssurance levels, and the password rules that replaced forced rotation.
- Web Authentication (WebAuthn)W3CThe standard underneath passkeys and security keys.
- Implementing phishing-resistant MFACISA · Fact sheetWhich kinds of MFA survive a phishing kit, and which don’t.
In the Lab
Federation & Identity Standards
One identity, everywhereEvery local account is a standard you decided not to meet.
Authorization & Access Models
Who can reach whatA group name isn't an access model.
- Role-based access controlNIST · The RBAC model behind ANSI INCITS 359The formal model, which most role programs only half implement.
- NIST SP 800-162NIST · Attribute-based access controlThe usual next step when roles stop scaling.
- ZanzibarGoogle · USENIX ATC 2019Relationship-based authorization at scale, and the model behind several open-source engines.
In the Lab
Identity Governance & Administration
Coverage & MaturityYou can't certify access you can't enumerate, for a population you can't define, with nobody to sign it.
Privileged Access Management
Privilege that expiresPrivilege you can't see is privilege you can't remove.
- NIST SP 800-53, control AC-6NIST · Least privilegeThe control behind every standing-admin conversation.
- Enterprise access modelMicrosoft · Privileged access guidanceTiering privileged access. Written by a vendor, true anywhere.
- CIS Controls, controls 5 and 6Center for Internet SecurityAccount and access control management as a short, ordered list.
In the Lab
Cloud & Workload Identity
Identity without peopleMost of your identities aren't people, and none of them are in your reviews.
Zero Trust & Modern Identity Architecture
No inside to be onTrust is a decision, not a location.
Identity Threats & Security Operations
Detection and responseThe attacker signs in. Nothing about the session is malformed.
Compliance, Risk & Audit
Proving it to somebody elseAn auditor isn't asking whether you're secure. They're asking whether you can prove what you said.
- NIST SP 800-53, AC and IA familiesNISTThe access and authentication controls most frameworks map back to.
- PCI DSS v4, requirements 7 and 8PCI Security Standards CouncilNeed-to-know access, and identifying and authenticating it.
- ISO/IEC 27001:2022, controls 5.15 to 5.18ISO · Paid standardAccess control, identity management, authentication information and access rights.
In the Lab
Automation & Engineering
Identity as something you buildA process you can't run twice isn't a process. It's a memory.
- SCIM, RFC 7643 and 7644IETFThe schema and protocol for provisioning accounts into other systems.
- Your platform’s API and Terraform providerVendor documentationConfiguration you can review, version and run twice.
Communication & Professional Skills
Making it survive contactThe control you can't explain is the control that gets an exception.
There's no standard for this one. It's learned from the people you work with, which is why it's a domain at all.
Customer IAM (CIAM)
Identity for people who can leaveYour customers never agreed to your security model. They can simply go somewhere else.
Not affiliated with any publisher listed. Each link goes to the publisher's own page.