An identity is the set of attributes and authenticators that distinguish a person, device, or service in a digital system.
It answers who or what is presenting itself, and it does not by itself decide which files that subject may open.
How it works
Attributes can include a name, an employee number, a device certificate, or a service account name that other records can point to.
Authenticators such as a password, a key, or a hardware token help the system believe that the presenter matches the identity on file.
Identity is the subject, access management is the set of decisions about what that subject may do, and identity theft is the crime of abusing someone else's subject.
Mixing those three ideas leads teams to buy a login box when they actually needed an owner for joiner, mover, and leaver events.
Concrete examples
- A contractor receives an identity record with a company email and a start date before anyone grants access to the finance folder.
- A server presents a certificate that names the service, which is an identity for a machine rather than for a human.
- A customer profile stores a phone number and a shipping name that together distinguish that shopper from another shopper with a similar name.
Protective measures
- Keep one authoritative record for each person and service identity, and stop creating duplicates that nobody can reconcile.
- Bind strong authenticators to the identity instead of treating a shared mailbox password as proof of a person.
- Record when an identity was created, who sponsored it, and when it should be retired.
- Do not store extra personal attributes on an identity just because a form had a spare field.