Access Control, Identity Management and MFA

As the digital economy in South Africa and across the African continent expands, traditional network perimeters are dissolving. In a landscape where remote work and cloud services are standard, identity has become the primary defensive line. To protect assets effectively, professionals must master the security management foundations of cybersecurity, moving beyond simple firewalls to secure the digital identities of users and devices.

The Central University of Technology (CUT) addresses these industry needs through its Postgraduate Diploma in Information Technology. This NQF Level 8 qualification equips IT specialists with advanced expertise in modules such as Advanced Information Security and Ethical Hacking, focusing on protecting sensitive data in increasingly hostile environments.

Identity: The New Security Perimeter

The shift towards identity-centric security is largely a response to the rise of Advanced Persistent Threats (APTs), which are stealthy, prolonged hacking operations often conducted by well-funded syndicates. Modern enterprises now rely on Identity and Access Management (IAM) systems to act as the gatekeepers for every interaction.

In South Africa, the urgency for robust IAM is clear. Research from the Council for Scientific and Industrial Research (CSIR) estimates the annual cost of data breaches in the country at R2.2 billion. With South Africa's increasing number of cyberattacks, demand for specialists who can implement complex authentication models is at an all-time high.

The Identity Management Lifecycle

Effective security requires managing digital identities from creation to deactivation, a process often called the Joiner-Mover-Leaver (JML) process.

• Joiner (Provisioning): When an employee joins, the IAM system should automate "birthright access" to grant baseline permissions based on their role.
• Mover (Management): As roles change, access rights must adapt. This prevents "privilege creep," where users accumulate unnecessary permissions that expand the attack surface.
• Leaver (Deprovisioning): Immediate revocation of access is vital when an employee exits. "Orphaned accounts" are frequent targets for lateral movement within a network.

Multi-Factor Authentication (MFA) and Device Health

Passwords are vulnerable to credential stuffing and phishing, which account for a vast majority of hacking incidents. MFA adds critical layers by requiring:

• Something you know: A password or PIN.
• Something you have: A mobile device or security key.
• Something you are: Biometric data like fingerprints or facial recognition.

Research in the Nigerian financial sector suggests biometric-based MFA is the most effective fraud deterrent. Locally, context-aware tools like Cisco Duo further enhance security by assessing "device health" to verify that a laptop or phone has the latest patches before allowing access. Students of CUT’s Postgraduate Diploma in Information Technology learn to implement these phishing-resistant MFA solutions in cloud-first environments.

Compliance and ISO 27001 Certification

Organisations must also navigate strict legal frameworks, such as the Protection of Personal Information Act (POPIA). Achieving ISO 27001 certification provides a globally recognised framework for information security. The 2022 update to this standard focuses heavily on technological controls, including identity management and secure authentication.

Zero Trust and Resilience

Modern defensible security systems are built on Zero-Trust Architecture and the principle of "never trust, always verify". Every access request is evaluated based on the subject's identity, task context and device environment. Technical methods like micro-segmentation function like the hull of a ship; even if one section is breached, the rest remains protected.

High-profile breaches, such as the 2025 attack on Cell C, which saw 2 terabytes of customer data exfiltrated, underscore the need for this granular control. By producing experts who can build such resilient systems, CUT’s PDIT directly supports the African continent's digital future.

FAQs: Access Control

1. What is the difference between RBAC and ABAC?

Role-Based Access Control (RBAC) grants permissions based on a job title, while Attribute-Based Access Control (ABAC) is more dynamic, using factors such as time, location, and device health to make access decisions.

2. Why is the "Leaver" phase of the identity lifecycle so critical?

If access is not revoked immediately upon departure, "orphaned accounts" remain active. These are prime targets for attackers who can use them to move undetected through a network.

3. Is SMS-based MFA still considered secure?

While better than a password alone, SMS-based OTPs are vulnerable to SIM swap attacks. Security experts now prefer biometrics or physical security keys for high-risk access.

4. How does ISO 27001 support IAM?

The ISO 27001 framework requires documented policies for access management and regular audits of user rights, ensuring that security is an ongoing organisational process rather than a one-time setup.

5. What is the core principle of Zero Trust Architecture?

The core principle is to eliminate "implicit trust". It assumes that the network is already compromised and therefore requires continuous verification of every user and device, regardless of their location.