What is identity management?
Definition
Identity management is the administration of individual identities within a system, such as a company, a network or a country, including who a person is and which roles and access privileges they hold.
- Category
- Identity
- Also called
- IdM, identity and access management, IAM
- Last updated
NIST's glossary describes identity management as broadly referring to the administration of individual identities within a system, such as a company, a network or even a country. In business IT, it means establishing and managing the roles and access privileges of individual network users. Its related term, identity and access management (IAM), covers the same ground.
How it works
Every identity system answers a few questions in order. Who are you (identity proofing, when an account is first set up), how can you prove it is you again later (authentication, with a password, a code or a security key), and what are you allowed to do (authorization). NIST's digital identity guidelines (SP 800-63) break these steps out in detail, including how strongly an organization should check a person's identity and how strong the login should be.
At work, identity management is the reason your new colleague gets access to the shared drive on day one and loses it when they leave. At home, you meet it every time you sign in with a Google or Apple account, set up a code on your phone or use a government login.
Why it matters to you
Your accounts are the doors to your money, email and records. When an organization manages identities badly, people keep access they shouldn't have, weak logins get through, and attackers use stolen credentials to get in as someone else. That is how a leaked password turns into account takeover and then identity theft.
It also shapes how much of your data sits in each system. Each service you sign up for holds an identity record about you, with your name, email and often your phone number.
Identity management vs. related terms
- Authentication proves who you are. Identity management is the wider system that also covers creating, changing and removing accounts and permissions.
- Digital ID is a person's credentials or record in such a system. Identity management is how those records are run.
- Identity theft is someone else using your identity. Good identity management is one of the defenses.
How to protect yourself
- 1
Use a unique password for each account
A password manager makes this easy. A single reused password lets one breach open many doors.
- 2
Turn on two-step verification
Use an authenticator app or a security key rather than text messages where the service allows it.
- 3
Review which apps can sign in with your account
Check the third-party apps connected to your Google, Apple or Facebook login and remove the ones you no longer use.
- 4
Close accounts you don't use
Every old account is an identity record that can leak in a breach. Delete the ones you don't need.
- 5
Watch for your details being listed publicly
Serus finds where your address and phone number are listed and removes them, so fewer details are available to anyone trying to pass as you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between identity management and IAM?
NIST lists identity and access management (IAM) as the same idea. In practice IAM stresses the access part: who gets into which systems and what they can do there.
Who uses identity management?
Any organization with user accounts: companies, schools, governments and online services. Employees and customers both go through it when they sign in.
What does identity management have to do with privacy?
It decides who can see and change records about you. Weak control over identities leads to exposed accounts and leaked personal data.
Sources
Something wrong or out of date? Tell us and we'll re-check it.