Most breaches involve someone logging in with credentials they should not have, or having more access than they need. Identity and access management (IAM) is how organisations decide who someone is and what they are allowed to do. You'll start with the fundamentals: identity management, authentication, authorisation and traceability.
Then you'll look at proving identity with authentication factors, 2FA and MFA, and how single sign-on (SSO) works through OpenID Connect, OAuth and SAML. The module finishes with controlling what people can do: the principle of least privilege and privileged access management (PAM), including just-in-time access and credential vaulting.
Once you can control access, you'll be ready for the next module, Vulnerability Management & Pentesting, where you test whether those controls actually hold up.
What identity and access management is: how identities are managed, how users are authenticated and authorised, and why every action should be traceable.
The authentication concepts and factors behind identity and access management, including two-factor authentication, multi-factor authentication and TOTP.
How “Sign in with Google” works: the OIDC flow, ID tokens versus access tokens, single sign-on, and SAML for enterprise authentication.
Why users should only have the access they need, how it limits the damage from a compromised account, and practical steps to put it in place.
Why attackers target privileged accounts, and how credential vaulting, just-in-time access, session monitoring and zero standing privileges protect them.