{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/access-management","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/access-management/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/access-management/"},"term":{"en":"Access management","da":"Adgangsstyring"},"aka":{"en":["identity and access management","IAM"],"da":["IAM","adgangsstyring og identitetsstyring"]},"domain":["security"],"cluster":"controls","layer":"identity","status":"current","summary":{"en":"The rules and routines that decide who may use which data and systems, and that keep those rights correct over time.","da":"De regler og rutiner, der afgør, hvem der må bruge hvilke data og systemer, og som holder rettighederne korrekte over tid."},"body":{"formal":{"en":"The ongoing process of granting, reviewing and removing each user account's rights to data and systems, based on the holder's role and approved need, so that access control always enforces a decision that still holds.","da":"Den løbende proces, hvor hver brugerkontos rettigheder til data og systemer tildeles, gennemgås og fjernes ud fra personens rolle og godkendte behov, så adgangskontrollen altid håndhæver en beslutning, der stadig gælder."},"plain":{"en":"Like the office manager who decides who gets a key to which rooms, and collects the keys back when someone changes job or leaves.","da":"Som kontorchefen, der bestemmer, hvem der får nøgle til hvilke rum, og som samler nøglerne ind igen, når nogen skifter job eller stopper."},"inPractice":{"en":"When a case officer in a municipality moves from social services to the payroll office, IT removes her access to citizens' case files the same week and grants payroll access, approved by her new manager.","da":"Når en sagsbehandler i en kommune skifter fra socialforvaltningen til lønkontoret, fjerner IT hendes adgang til borgernes sager samme uge og giver hende adgang til lønsystemet, godkendt af hendes nye chef."},"whyItMatters":{"en":"Rights pile up quietly as people change roles; if nobody reviews them, one stolen account can open far more than its owner ever needed.","da":"Rettigheder hober sig stille op, når folk skifter roller; uden opfølgning kan én stjålet konto åbne langt mere, end ejeren nogensinde havde brug for."}},"deepDive":{"en":"Access management is usually modelled as an identity lifecycle: joiner, mover, leaver (JML). An authoritative source, typically the HR system, emits events that an identity governance and administration (IGA) platform turns into provisioning actions in directories and applications, today often over SCIM 2.0 (RFC 7643 for the schema, RFC 7644 for the protocol) or through connectors to Active Directory and Entra ID. The mover case is where most programmes fail: new rights are added promptly because someone needs them to work, but old rights are rarely removed, so accumulated privilege (\"privilege creep\") grows with tenure. Leaver processing has its own traps - disabling the directory account does not revoke local application accounts, API keys, OAuth refresh tokens or already-issued session cookies.\n\nThe authorisation model sits underneath. Role-based access control (RBAC, standardised as ANSI/INCITS 359) bundles permissions into roles derived from job functions; attribute-based access control (ABAC, NIST SP 800-162) evaluates policies over attributes of subject, object, action and environment at request time. Real estates are hybrids: coarse RBAC for birthright access, ABAC or fine-grained entitlements for sensitive data, and just-in-time elevation through privileged access management (PAM) for administrator rights. Segregation of duties (SoD) rules - for instance that nobody may both create a supplier and approve payments to it - are expressed as toxic role combinations that the IGA tool blocks or flags.\n\nAssurance comes from periodic access reviews (recertification), in which data or system owners confirm or revoke each entitlement. Reviews degrade into rubber-stamping when owners are shown thousands of cryptic group names; effective programmes review by business role, highlight deviations from peer groups and track revocation rates. Orphaned accounts (no living owner), shared accounts and service accounts with non-expiring secrets are standard audit findings.\n\nIn control frameworks the topic is split across several controls: ISO/IEC 27002:2022 5.15 (access control), 5.16 (identity management), 5.17 (authentication information), 5.18 (access rights) and 8.2 (privileged access rights); CIS Controls v8 Control 5 (Account Management) and Control 6 (Access Control Management), where Safeguards 6.1 and 6.2 require documented processes for granting and revoking access. NIS2 Art. 21(2)(i) names access control policies explicitly. Access management should be distinguished from authentication (proving who someone is) and from access control as an enforcement mechanism: it is the governance process that decides what the enforcement point should enforce.","da":"Adgangsstyring beskrives typisk som en identitetslivscyklus: joiner, mover, leaver (JML). En autoritativ kilde, oftest HR-systemet, sender hændelser, som en IGA-platform (identity governance and administration) omsætter til provisionering i kataloger og applikationer, i dag ofte via SCIM 2.0 (RFC 7643 for skemaet, RFC 7644 for protokollen) eller via konnektorer til Active Directory og Entra ID. Det er i mover-tilfældet, de fleste programmer fejler: nye rettigheder tildeles hurtigt, fordi medarbejderen skal kunne arbejde, men gamle fjernes sjældent, så privilegieophobning (\"privilege creep\") vokser med ancienniteten. Fratrædelser har deres egne faldgruber - at deaktivere kontoen i kataloget tilbagekalder ikke lokale applikationskonti, API-nøgler, OAuth refresh tokens eller allerede udstedte sessionscookies.\n\nUnder processen ligger autorisationsmodellen. Rollebaseret adgangskontrol (RBAC, standardiseret som ANSI/INCITS 359) samler rettigheder i roller afledt af jobfunktioner; attributbaseret adgangskontrol (ABAC, NIST SP 800-162) evaluerer politikker over attributter for subjekt, objekt, handling og kontekst på forespørgselstidspunktet. I praksis er miljøer hybride: grov RBAC til basisadgang, ABAC eller finkornede rettigheder til følsomme data og just-in-time-eleverede administratorrettigheder via privileged access management (PAM). Funktionsadskillelse (segregation of duties) - fx at ingen både kan oprette en leverandør og godkende betalinger til den - udtrykkes som forbudte rollekombinationer, som IGA-værktøjet blokerer eller markerer.\n\nSikkerheden for, at rettighederne stadig er korrekte, kommer fra periodiske rettighedsgennemgange (recertificering), hvor data- eller systemejere bekræfter eller fjerner hver rettighed. Gennemgangene bliver til ren afkrydsning, når ejerne præsenteres for tusindvis af kryptiske gruppenavne; velfungerende programmer gennemgår pr. forretningsrolle, fremhæver afvigelser fra kolleger med samme rolle og følger andelen af fjernede rettigheder. Forældreløse konti uden ejer, delte konti og servicekonti med hemmeligheder, der aldrig udløber, er klassiske revisionsfund.\n\nI kontrolrammerne er emnet fordelt på flere kontroller: ISO/IEC 27002:2022 5.15 (adgangsstyring), 5.16 (identitetsstyring), 5.17 (autentificeringsinformation), 5.18 (adgangsrettigheder) og 8.2 (privilegerede adgangsrettigheder); CIS Controls v8 Control 5 (Account Management) og Control 6 (Access Control Management), hvor Safeguard 6.1 og 6.2 kræver dokumenterede processer for tildeling og fjernelse af adgang. NIS2 art. 21, stk. 2, litra i, nævner politikker for adgangskontrol direkte. Adgangsstyring skal holdes adskilt fra autentificering (at bevise, hvem man er) og fra adgangskontrol som håndhævelsesmekanisme: det er den styringsproces, der afgør, hvad håndhævelsespunktet skal håndhæve."},"edges":[{"type":"requires","to":"cs/authentication","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/authorization","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"implements","to":"cs/access-control","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/least-privilege","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/role-based-access-control","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/mfa","confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"CIS Critical Security Controls v8 - Controls 5 and 6","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}