Identity and Access Management (IAM)

Discover WS-Fed, a web services federation protocol similar to SAML with enhanced security, and OAuth, enabling apps to access data without passwords.

Build a lab environment with a Windows server and Windows 10 workstation on the same network, configure a static IP and DNS, and set up Active Directory domain services for cyber.local.

Demonstrate joining a Windows 10 workstation to a Windows domain cyber.local, configure DNS to the domain controller, and log in with domain credentials to apply group policies.

Create a standard user in the IAM lab, add them to the local remote desktop users group on Windows 10, then log in to compare admin versus standard permissions.

In this lab, administer user attributes in Active Directory using the Users and Computers tool, updating general, address, and account settings, including logon hours and expiry for contractors.

Enforce password policies through group policy management by configuring history, minimum length six, and enabled complexity on Windows 10 domain computers, then apply and test the changes.

Enforce a stronger password policy by enabling complexity, increasing length to eight, and setting password history to five, then implement a 30-minute account lockout after three failed attempts.

Explore Okta as a SaaS-based identity provider offering simple web-based integration and APIs for single sign-on with applications, while Active Directory remains the primary directory through directory integration.

Customize your goals in Okta to guide the integration path for developers and admins, then add applications, enable single sign-on and provisioning, and monitor security in the dashboard.

Create and manage users and groups in the directory, assign them to applications, and review configuration. Integrate Active Directory with Okta to synchronize identities and control access to apps.

Configure a custom domain, branding, and sign-in experiences in Okta, including logos, images, fonts, and tailored email and text templates for organization-wide identity and access management.

Integrate external applications with Okta as the identity provider by browsing the app catalog, selecting apps such as Zendesk, configuring SSO, provisioning, and lifecycle management where available.

Learn to integrate Zendesk with Okta as the identity provider, using templates and sign on settings, and enable provisioning for lifecycle management and group access.

Create a web application in Okta, select authentication such as OpenID Connect or SAML, obtain the SDK, and configure tokens and client IDs for your custom app.

Enable self-service in Okta by letting users request apps like Zendesk, optionally with approvals, and publish these apps to the service catalog for portal access.

Review and strengthen your Okta identity platform by configuring captcha, notifications, health insights, and anomaly detection; enable multi-factor authentication and tailor authentication policies for applications.

Explore Okta system logs and reporting to track activity, changes, and logins, integrate with central logging and email reports to admins for auditing.

Explore domain 2 privileged access management, covering privileged accounts, credential management, session control, monitoring, and application whitelisting and software restriction, with hands-on Windows lab and password manager demonstrations.

Identify privileged accounts with special permissions across local and domain administrators, service and root accounts on systems, apps, or databases. Enforce least privilege to prevent data loss from cyber criminals.

Master privileged account and session management by using password managers, enforcing unique accounts, encrypting credentials, and monitoring sessions to defend against man-in-the-middle attacks.

Secure privileged sessions with certificate-based verification and encryption to prevent hijacking and man-in-the-middle attacks, while logging, monitoring, auditing, and alerting on privileged activity for compliant incident response.

Explores privileged access management solutions, outlining credential storage with strong encryption, multi-factor authentication, secure session management, auditing, anomaly monitoring, and reporting to minimize malicious use of privileged accounts.

Apply application whitelisting as a top essential control identified by the Australian Signals Directorate to prevent malicious code execution. On Windows, SRP and Applocker enforce which programs may run.

learn how to rename the windows default administrator account to iamadmin and enable auditing for privileged activities, then review event viewer logs to monitor privileged changes.

Discover identity governance and administration in IAM, covering onboarding, termination, access requests, role changes, role-based controls, certifications, segregation of duties, audits, lifecycle management, with Windows Active Directory audit demos.

Onboard a new employee or customer quickly by provisioning the relevant account, access, and information so they can start work without delay, with training on policies and security requirements.

Learn how to terminate user accounts promptly, revoke access to all systems, and collect assets when a contract ends, while managing role changes to prevent permission inheritance.

Develop and sustain identity governance through ongoing monthly access validation and certification, reviewing and adjusting user permissions to ensure the right access and remove excessive privileges.

Explore segregation of duties as a governance and security control to prevent fraud, with auditing and reporting requirements, tamperproof access logs, and compliance under SOX and ASX.

Develop and manage identity lifecycles with ILM, from onboarding and provisioning to access maintenance and termination. Leverage self-service, password and biometrics maintenance, and audit-ready security, compliance, and governance.

Leverage the SCIM standard to automate identity data exchange between identity providers and service providers. Provision user identities across applications such as finance, HR, and email.

Practice configuring an IIS web server on Windows 10 to manage identities by enabling basic authentication, disabling anonymous access, denying a specific user, and testing connectivity to localhost.

Create finance, HR, and IT groups with users in Active Directory, assign them to groups, grant full website access to the finance group only, and test with private mode.

Enable auditing on Windows machines using local or domain group policy to collect logs across audit policy settings, providing full visibility for security monitoring and incident response.

Identity governance and administration, a Gartner term, provides tools and processes to manage user identities and access across the enterprise, supporting provisioning, certifications, and lifecycle controls.

Explore One Identity Manager's virtual lab for identity and access governance and administration, showing automated provisioning, HRM integration, and Active Directory workflow in a ready-made test environment.

Explore a preconfigured one identity manager virtual lab with Windows Server 2019 domain controller, Active Directory integration, and a web portal for configuring users and roles.

Demonstrates logging into the One Identity Manager web portal in a test environment, changing administrator and employee passwords, and exploring entitlements, attributes, and manager vs. standard user views.

Learn how a manager reviews employee access in the identity and access management system, including entitlements, master data, risk scores, passcode self-service, and attestations.

Use the self-service portal to request access to apps or hardware from a configurable service catalog, and route approvals through compliance rules and a manager.

Configure the service catalog in the one identity manager, create a marketing read-only Active Directory group, and add it to the IT shop to enable access requests.

Assign administrator and business roles in the One Identity Manager app to reveal attestation, governance administration, and compliance features, including dashboards, policies, and risk information.

Explore how business rules and system rules in one identity management grant automated access by linking roles to Active Directory groups and governing attestations.

Sandra, the owner of business and system rules, uses role owners web access to view and update rules, manage entitlements and membership, and request Active Directory groups and system roles.

Create attestation campaigns to verify user access for business and system rules, empower rule owners to approve or deny access, and run scheduled attestations for compliance.

Explore data governance and protection by classifying data, complying with industry and local laws, managing structured and unstructured data, and preparing for data breach and incident response with access controls.

Explore data types and the value of sensitive information for different organizations, including PII and PHI, financial data, intellectual property, and government sensitive data.

Protecting intellectual property drives success for innovator companies, and this lecture maps trademarks, trade secrets, licensing, patents, and copyrights, with WIPO protecting patents and trademarks.

Classify data by relevant categories to improve usability and protection, making it easier to understand, locate, and retrieve, and apply PSPF layers from unofficial to top secret.

Understand how local and global data protection laws shape industry compliance, referencing the ACSC, PSPF, OAIC, PCI SSC, HIPAA, and GDPR.

Learn the differences between structured and unstructured data and how to manage and monitor them with user access controls, encryption, metadata, DLP, and file integrity monitoring.

Organizations identify and communicate security requirements through policy, standards, procedures, and baselines, clarifying senior management expectations and mandatory versus discretionary documents, with baselines as minimum requirements.

Identify and implement a structured incident response by preparing resources, detecting incidents, containing malware, remediating root causes, recovering operations, documenting lessons learned, and notifying authorities when data is lost.

identify notifiable data breaches in australia by recognizing incidents involving personal data where unauthorized access or disclosure could cause serious harm, triggering reporting under the ndb scheme.

Learn to manage data access and permissions in a Windows environment by creating C drive folders, assigning group-based security settings, and testing access for finance, HR, IT, and public data.

Grant the IT group read and execute access across folders and deny write access; verify with an IT login that read is allowed in public, HR, and finance.

Enable auditing on the finance folder to track access, time, and method for compliance, and configure group policy to audit object access with gpupdate and view logs in event viewer.

Simulate an incident response to a vulnerability exposing customer data and a possible data breach, guiding identification and verification, containment, remediation, stakeholder communication, regulation requirements, recovery, and lessons learned.

Create a lab with a Windows 11 client and a Server 2019 controller to install and test ManageEngine AD Audit Plus for auditing Active Directory and file access in lab.local.

Explore a hands-on lab with a Windows 11 Azure workstation and a Windows Server 2019 domain controller running Active Directory (Lab.Local), configured for dynamic IPs and future file server testing.

Set up Windows Server 2019 as a file server by creating a Datasec organization, three users in Active Directory, and three shared folders with read/write access.

Map and test a Windows file server with active directory by assigning three folders to three users, mapping network drives from a Windows workstation, and validating access.

Install and configure ManageEngine AD Audit Plus on a Windows Server domain controller to monitor file access and permissions across DataSec folders in Lab.Local.

Configure ADAudit Plus after installation by connecting to the domain and configuring domain controllers, alerts, and mail settings. Enable single sign-on, two-factor authentication, and SIEM integration.

Connect to ADAudit Plus remotely, monitor active directory and authentication events, and review user log on activity and failures through comprehensive reports, supporting identity governance and brute force detection.

Track AD users and groups changes with ADAudit Plus, including creation, modification, and disablement, in detailed reports. Monitor administrator activity and alerts to detect suspicious access events.

Monitor Active Directory activity with ADAudit Plus, including OU creation, GPO monitoring, and policy changes, with visibility into recently created OUs, computers, and GPO setting changes.

Learn how to troubleshoot ADAudit Plus by using the troubleshooting page, verifying domain credentials and privileges, and reviewing policy settings to ensure complete, accurate audits.

Configure ADAudit Plus to monitor a Windows file server and integrate with NetApp, EMC, and Hitachi. Track file activities and generate file and share reports in real time.

Explore monitoring active directory and file activity with ManageEngine ADAudit Plus, configure file integrity monitoring on domain controllers, and use analytics and alerts to detect login and access events.

Explore Open IAM, an open source identity governance and administration platform with identity store, authentication manager, policy engine, and access manager, enabling lifecycle, RBAC, self-service, and compliant access.

Discover the OpenIAM community edition, a free open source entry point with features like identity lifecycle management and access controls; the commercial edition adds enterprise grade integrations and dedicated support.

Install OpenIAM on a CentOS server using Docker and Docker Compose, with swarm, Bitbucket community edition, environment file and port configurations.

Learn how to initialize Open IAM after Docker installation, configure SELinux to permissive, open required ports (8080, 443, 5432, 9200, 9092, 6379), and start the Open IAM startup process.

Install and initiate open IAM with Docker on Linux, verify containers, then access the web console, create the default content provider, and enable http or https.

Integrate open IAM with an smtp relay to enable emails for onboarding, offboarding, and certification campaigns. Configure mailbox templates like SendGrid, test the connection, and verify delivery.

Open IAM centers identity governance, provisioning and deprovisioning users and groups across directories and applications, enabling source-of-truth governance and access review campaigns.

Create your first OpenIAM user via the user admin, select a user type (default, internal, contractor, or service account), enter name and email, and complete activation.

Discover how to define and manage access with resources, organizations, roles, and groups in Open IAM, enabling granular provisioning and policy-based access for services, databases, and data objects.

Link resources, groups, roles, and organizations to individual users to assign entitlements and establish supervisor hierarchies, then test with multiple users to enforce access controls.

Explore how to configure password and authentication policies in IAM, customize default rules, create multiple policies for different resources, and define authentication rules and steps such as two-factor prompts.

Learn how IAM connectors and managed systems enable provisioning to external systems like LDAP and Active Directory, configure connectors, and set up provisioning and deprovisioning workflows.

Explore the AD managed system template in identity and access management, using Open IAM's standard templates, default connectors, and policy mappings to provision accounts to Active Directory.

Learn how authentication providers link external services with IAM, configure app ID and secret for Google or other providers, and manage these links via access control and content providers.

Shows how to configure a managed system in open IAM, set up a role and approver, and route a user access request from submission to supervisor approval.

Explore identity and access management by defining and provisioning access rights for the ADP application, including admin and user roles, through requests, approvals, and automated provisioning.

Discover how open IAM's synchronization automates bidirectional attribute updates with Active Directory, SAP, Workday, Salesforce, and other apps, enabling seamless onboarding and offboarding.

Create and manage access certification campaigns in Open IAM, choosing between user-based and application-based reviews. Set intervals, start dates, and owners, and implement a two-tier approval workflow with supervisor validation.

Explore the reporting functionality in identity and access management with open IAM, generating and emailing out-of-the-box and custom reports on users, entitlements, access requests, and last login.

Explore Ping identity and the PingOne cloud platform to manage digital identities and access across apps, featuring user provisioning, identity federation, customizable workflows, and single sign-on with multi-factor authentication.

Discover how to obtain a 30-day trial of the PingOne identity platform by registering with a business email, selecting a data center, and creating your initial environment.

Explore the differences between workforce identity and customer identity in PingOne, and learn how to tailor solutions for employees and customers using HR systems and security and privacy priorities.

Set up a workforce identity environment in Ping Identity by creating a workforce solution, naming it, and enabling a sandbox. Configure region and license; explore administrators, SSO, and identity module.

Manage administrators and access in identity and access management via the administrator section, and use the environment to set dev, test, prod configurations with policies and app integrations.

Learn to integrate PingOne with Active Directory using an LDAP gateway, including environment setup, directory selection, hostname and credentials, and preparing the gateway for installation.

Deploy a gateway, connect LDAP to PingOne, and verify the integration is running. Create a connection and a provisioning rule, map AD attributes to PingOne, and enable synchronization.

Enable seamless Active Directory integration with PingOne by creating a gateway and provisioning connections, synchronizing AD users, and mapping AD attributes to enrich user metadata on the PingOne identity platform.

Learn to integrate applications with the PingOne platform using SAML SSO. Create a custom app, import metadata, enable it, and map attributes like user id, email, and last name.

Learn how to integrate Zendesk with PingOne using the application catalog, configure saml settings, certificate fingerprint, and external authentication to enable single sign-on for Zendesk users.

Configure the Ping Identity environment to manage the directory, create users, groups, and populations, and define attributes and roles for secure access.

Configure PingOne authentication with username and password, PingID MFA option, risk-based MFA, and passwordless paths, and use the application portal to assign test users and grant app access.

Define and customize authentication and password policies in the ping Wan platform, including single-factor and multifactor workflows, MFA and Fido options, application-specific policy assignment, and password complexity and expiration settings.

Implement threat protection with risk based authentication on the ping one platform, using predictors and risk scores to enforce multi-factor authentication when risk thresholds exceed.

Learn how Ping One Platform provisions and de-provisions users and groups to external applications, using Active Directory integration, attribute mapping, and rules to automate lifecycle across systems like Salesforce.

Customize the user experience in the identity management platform with extensive branding, language options, and notification templates. Define policies and end-user agreements to align the portal with your organization.

Join identity and access management training, celebrate your progress, and stay secure; share a review or feedback to help others and improve the course.