IAM

Delegated Admin & Just-In-Time Access: Reducing Standing Privileges TL;DR Standing (always-on) admin privileges are a top target for attackers—and a pain point for compliance. By shifting to delegated admin roles and “just-in-time” access, organizations reduce risk, limit attack surfaces, and enforce true least privilege in practice. This post unpacks how to design and run these controls, practical pitfalls, and the benefits for audit, security, and business agility. Why Standing Privileges Are a Problem Standing privilege means an account (often admin) always has elevated rights, even when not in use....

#IAM in the Cloud & SaaS Era: Tackling Shadow IT, API Sprawl, and Access Chaos TL;DR As enterprises shift further into cloud and SaaS ecosystems, identity and access management (IAM) becomes a tangled web of apps, permissions, and overlooked risks. This post outlines the top threats—like Shadow IT and API sprawl—and offers strategies to maintain control. The Identity Challenge in a Cloud-First World Modern enterprises are no longer running a single stack—they’re running hundreds....

Six Essential IAM Policies Every Business Needs (Beyond Passwords) TL;DR If your security program starts and ends with a password policy, your business is exposed. To defend against breaches, insider threats, and regulatory penalties, you need a well-rounded suite of Identity & Access Management (IAM) policies—clear, actionable rules that leave no gaps for attackers (or auditors) to exploit. This post breaks down six foundational IAM policies, when to use them, why they matter, and how to link them together for real-world protection....

IAM 101: The IAM Backbone – A Unified and Secure Foundation TL;DR Directories and identity federation are the backbone of any modern IAM program. They serve as the new security perimeter, enable Zero Trust, and automate lifecycle management. Misconfigurations here can undermine your entire security posture. Background: The Shift to Identity as the New Perimeter Not long ago, enterprise security meant big firewalls and locked-down networks. Today, those barriers are porous—thanks to remote work, SaaS, and hybrid environments....

Access Reviews & Certifications: Why and How Everything you need to know about periodic reviews, compliance value, and common traps to avoid TL;DR Access reviews and certifications are your IAM safety net. Done right, they ensure that users have only the access they need—no more, no less. In this post, we’ll explain the what, why, and how, along with real-world examples and common mistakes to avoid. What Are Access Reviews?...

🧠 TL;DR IAM projects don’t succeed because of tools—they succeed because of project discipline. This post breaks down core project management pillars—scope, stakeholders, communications, risk, and delivery—and ties them to identity work like Okta, Adaxes, and JAMF rollouts. 🏗️ IAM Projects Are Still Projects While identity work is technical and security-driven, the project fundamentals are universal: Stakeholder alignment drives decisions Scope controls chaos Communication prevents surprises Testing builds confidence Governance ensures long-term success Every successful identity project I’ve led—whether rolling out JAMF, Okta, or ServiceNow—followed proven project management best practices....

Breached Passwords and Modern Authentication: How Clerk Protects Your App from Known Risks TL;DR Using passwords found in previous breaches is like leaving your door unlocked for attackers. Developers can stop this risk cold—tools like Clerk Authentication and its competitors (Auth0, Okta, Microsoft Entra ID, and others) automatically block known breached passwords during signup and reset. Let’s break down why this matters, what the latest password dumps look like, and how you can protect your users (and your reputation) in a few lines of code....

IAM 101: Zero Trust and Identity – Continuous Verification in Practice EverydayIdentity TL;DR Zero Trust isn’t a product—it’s a security philosophy. At its core is continuous verification: a principle that access decisions should never rely on a one-time check. This post breaks down how identity, context, device posture, and dynamic access policies form the foundation of Zero Trust, and how IAM teams can implement this model in practice. What Is Zero Trust?...

What Does an IAM Manager Actually Do? First-Hand Insights from a 15-Year IAM Pro Introduction Fifteen years ago, I stumbled into Identity and Access Management (IAM) when “cloud SSO” was still a buzzword and the biggest access threat was a sticky note password. Fast-forward to today, and I manage an IAM team responsible for protecting thousands of users, devices, and applications. If you’re wondering what an IAM Manager actually does—and what it takes to thrive in the role—this post is for you....

Protecting Your Digital Identity: Essential Strategies for 2025 In today’s interconnected world, our digital footprints extend across countless platforms and services. As we’ve seen throughout 2024, the landscape of digital threats continues to evolve at an alarming pace. With major data breaches affecting millions and increasingly sophisticated phishing campaigns, protecting your personal identity online has never been more crucial. This guide explores comprehensive strategies to safeguard your digital identity, with a particular focus on recent developments and the emerging “Zero Trust Human” approach....