The Hardened Stack — Ep. 3: Identity and Access Management
From Holding the Line: Practical IT Security · 00:47:53
Show by SECURITIES
Welcome to Episode 3 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.In modern estates where employees work remotely and applications live across multiple clouds, the traditional network boundary is no longer the main defense—identity is the new security perimeter. In Chapter 3: Identity and Access Management, we unpack why the overwhelming majority of breaches are not clever malware exploits, but valid logins by unauthorized actors—or as Meridian Foods security lead Aiko Tanaka puts it, "We did not get hacked. We got logged into." This episode explores how to prove identity reliably, restrict access using least privilege, and govern the full lifecycle for both human and non-human accounts.What You’ll Learn in This EpisodeAuthentication vs. Authorization: Understanding the distinct roles of proving who someone is versus granting what they can touch—the doorkeeper checking the guest list versus handing out room keys.MFA Everywhere & Phishing-Resistant Factors: Why multi-factor authentication must cover every login path without exception, and how moving to FIDO2 passkeys and hardware keys prevents adversary-in-the-middle attacks through origin binding.Single Sign-On (SSO) & Conditional Access: Using central identity providers like Microsoft Entra ID to evaluate real-time sign-in context—such as user risk, device health, and location—before granting access.Least Privilege, RBAC & Privileged Access: Applying Role-Based Access Control to shrink blast radiuses, utilizing Privileged Identity Management (PIM) for just-in-time elevation, and safeguarding isolated break-glass emergency accounts.The Joiner-Mover-Leaver (JML) Lifecycle: Managing account transitions to eliminate "privilege creep" when employees change roles, and automating offboarding from HR systems so access is revoked within hours.Securing Non-Human Identities: Scoping service accounts, replacing long-lived API keys with platform-managed identities or workload identity federation, and auditing stale inactive accounts.At Meridian Foods: How senior sysadmin Hana Sato staged conditional access policies in report-only mode to prevent factory floor lockouts, and how Aiko Tanaka rolled out phishing-resistant FIDO2 keys to admins first.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.
More episodes of Holding the Line: Practical IT Security
More episodes
- The Hardened Stack — Ep. 9: Secure Development and DevSecOps
- The Hardened Stack — Ep. 10: Secrets and Key Management
- The Hardened Stack — Ep. 8: Email Security
- The Hardened Stack — Ep. 6: Securing the Cloud (Azure and AWS)
- The Hardened Stack — Ep. 7: Microsoft 365 and Entra ID Security
- The Hardened Stack — Ep. 5: Network Security and Zero Trust
- The Hardened Stack — Ep. 4: Endpoint Hardening
- The Boardroom Firewall (Ep. 12) — Ransomware: The Decisions You Will Face
- The Boardroom Firewall (Ep. 13) — Incident Response and Crisis Communications
- The Boardroom Firewall (Ep. 14) — Cyber Insurance — What It Does and Doesn't Cover
PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.