Belajar Security Architect - Identity & Access Architecture

#Pendahuluan

Setelah di episode 4 kita mempelajari Zero Trust Architecture, pada episode ini kita dalami identity & access architecture — fondasi zero trust. Identity bukan sekadar authentication — ia mencakup governance, lifecycle, federation, dan privileged access management yang harus dirancang secara holistik.

Mengapa identity architecture penting? Karena 80% breach melibatkan compromised credentials. Identity architecture yang baik memastikan hanya orang yang tepat, dengan device yang tepat, dalam konteks yang tepat, bisa mengakses resource yang tepat.

#Identity Governance

#Identity Lifecycle

100%

Tahap	Aktivitas	Kontrol
Provisioning	Buat akun baru	Approval workflow
Authentication	Verifikasi identitas	MFA, SSO
Authorization	Grant akses	RBAC/ABAC
Monitoring	Pantau aktivitas	UEBA, logging
Deprovisioning	Hapus/revoke akses	Automated termination

#RBAC vs ABAC

Model	Cara Kerja	Best For
RBAC	Role-based: user → role → permission	Simple, hierarchical org
ABAC	Attribute-based: policy rules	Complex, dynamic
Hybrid	RBAC + ABAC	Majority organizations

Contoh RBAC policy

roles:
  - name: developer
    permissions:
      - read:code-repo
      - write:code-repo
      - read:staging
  - name: security-analyst
    permissions:
      - read:logs
      - read:alerts
      - write:rules

#SSO & Federation

#Protokol Federation

Protokol	Use Case
SAML 2.0	Enterprise SSO (legacy)
OpenID Connect	Modern SSO, mobile, API
OAuth 2.0	Authorization, API access
WS-Federation	Microsoft ecosystem

#Identity Provider Selection

IdP	Keunggulan
Azure AD / Entra ID	Microsoft ecosystem
Okta	Multi-cloud, feature-rich
Keycloak	Open-source, self-hosted
Auth0	Developer-friendly

Tip

Untuk majority organizasi: Azure AD jika sudah Microsoft-heavy, Okta untuk multi-cloud, Keycloak jika ingin self-hosted dan kontrol penuh. Pilih berdasarkan ekosistem yang sudah ada, bukan feature terbanyak.

#Privileged Access Management (PAM)

#Mengapa PAM Penting?

Privileged accounts adalah target utama attacker — satu admin account bisa mengakses seluruh infrastruktur.

#PAM Components

Komponen	Fungsi
Password vault	Store & rotate privileged credentials
Just-in-time access	Grant akses sementara
Session recording	Monitor privileged sessions
Check-out workflow	Controlled access grant

100%

#Directory Strategy

#Directory Consolidation

Strategy	Kapan
Single directory	Single IdP, semua user
Directory sync	Multiple dirs, ter-sync
Federation	Multiple org, berbeda IdP

#Directory Architecture

100%

Note

Jangan membangun identity architecture dari tools — mulai dari requirements: berapa user, berapa aplikasi, apa compliance needs, bagaimana lifecycle management. Tools mengikuti requirements, bukan sebaliknya.

#Identity Architecture Design Patterns

Pattern	Use Case
Hub-and-spoke	Single IdP, semua app terhubung
Mesh	Multiple IdP, cross-federation
B2B federation	Partner/vendor access
B2C identity	Customer-facing apps

#Penutup

Inti yang harus dibawa pulang:

Identity lifecycle: provisioning → authentication → authorization → monitoring → deprovisioning.
RBAC untuk simple; ABAC untuk complex; hybrid untuk majority.
SSO: SAML (legacy), OIDC (modern), OAuth (API).
PAM: vault, just-in-time, session recording.
Directory strategy harus dimulai dari requirements, bukan tools.

Di episode 6 selanjutnya kita akan membahas network security architecture — segmentation, SASE/SSE, perimetral evolution, dan microsegmentasi yang melindungi communication.