In short: this page gathers Cyber Snowden’s guides on proving who users are and controlling what they can reach. It covers zero trust, privileged access, access models, identity protocols, password security and the attacks that target identities.
Stolen and misused credentials are among the most common causes of breaches, which makes identity the control that most other defenses depend on. The guides below move from strategy to specific protocols and tools.
Start here: read our introduction to zero trust for the strategy, then the privileged access management guide to protect the accounts that matter most.
Latest guides
Our newest in-depth articles in this area.
- Best Privileged Access Management Tools: Top 5 PAM Solutions Compared
- FIDO2 vs WebAuthn: What Is the Difference?
Zero trust
The strategy of verifying every request and granting the least access needed.
- Zero Trust — New Concept of Cybersecurity
- NIST Zero Trust vs Google BeyondCorp: Key Differences Explained
- Avoidable Mistakes in Implementing Zero Trust Security
- Zero Trust Architecture for IoT: Securing the Everything of Things
Privileged access and access models
Control administrator rights and decide how permissions are granted.
- Best Privileged Access Management Tools: Top 5 PAM Solutions Compared
- Privileged Access Management – Everything You Need to Know About
- Just-in-Time Access vs Always-On Privileges: Which Is More Secure?
- Role-Based Access Control vs Attribute-Based Access Control: What’s the Difference?
- HashiCorp Vault vs AWS Secrets Manager: The 2025 Comparison Guide
Identity protocols and directories
How sign-in and trust between systems work.
- FIDO2 vs WebAuthn: What Is the Difference?
- OAuth 2.0 vs SAML 2.0: Which Identity Protocol Should You Use?
- Identity Federation vs Identity Brokering: What’s the Difference?
- Cloud IAM vs Traditional Active Directory: Which Is Better for Modern Access Control?
- Top Identity Verification Tools for Customer Platforms
Password security
Store, manage and test passwords properly.
- Password Management Best Practices for Businesses: Everything You Should Know 2023
- PBKDF2 vs Argon2 Password Hashing: Which Should You Use?
- Hydra vs Medusa Password Cracking Comparison: Which Tool Is Better?
Identity threats and biometrics
Attacks that take over accounts and the risks of biometric data.
- SIM-Jacking Countermeasures for Activists: How to Secure Your Mobile Identity
- Biometric Data Breaches: Risks, Realities, and Mitigation Strategies
- Biometric data leakage in facial recognition APIs — risks, real cases, and what to do about it
Frequently asked questions
What is identity and access management?
Identity and access management (IAM) is the set of policies and tools that confirm who a user is and control what that user can do. It covers authentication, authorization, privileged accounts and the lifecycle of every identity.
What is the difference between authentication and authorization?
Authentication proves who you are, for example with a password or passkey. Authorization decides what you are allowed to do once you are signed in.
Where should a company start with IAM?
Enforce multifactor authentication for all users, remove standing administrator rights, and adopt single sign-on. Those three steps close the most common routes attackers use.
More guides: all cybersecurity guides, cybersecurity comparisons, cloud security guides and compliance and frameworks guides.