Table of Contents
Chapter 5: Access Management and Physical Security
Identity and Access Management (IAM) constitutes the foundational digital gatekeeper for financial market institutions in the GIFT IFSC. In an era where physical network boundaries have dissolved into hybrid cloud infrastructures, Identity has become the primary security perimeter. The mission of IAM is to ensure that the right identities (users, applications, and automated processes) access the right digital assets, for the right business reasons, at the right time.
THE IAAA SECURITY LIFECYCLE
│
┌───────────────────┬─────────────┴─────────────┬───────────────────┐
▼ ▼ ▼ ▼
[ IDENTIFICATION ] [ AUTHENTICATION ] [ AUTHORISATION ] [ ACCOUNTABILITY ]
"Who are you?" "Prove who you are!" "What can you do?" "What did you do?"
- Username - Passwords, Biometrics, - RBAC / ABAC - Immutable audit logs
- Employee ID FIDO2 Security Keys - Permissions - SIEM ingestion
- Digital Certificate- Multi-Factor Auth (MFA) - Least privilege - Forensic trails
The IAAA Security Model
All access control mechanisms are architected upon four sequential, distinct phases:
- Identification: The process by which an entity claims an identity to a system (e.g., supplying a unique username, employee serial number, or smart card identifier). An identity must be unique; shared or generic identities (such as
adminoroperator) are statutorily prohibited. - Authentication: The mathematical or procedural verification of the claimed identity. The system challenges the subject to supply authenticating factors proving ownership of the identity.
- Authorisation: The enforcement of policy rules determining what operations, files, transactions, or systems the authenticated entity is permitted to access.
- Accountability: The continuous recording, timestamping, and auditing of all user and system activities, ensuring that every transaction, record query, and administrative modification can be conclusively traced back to a specific individual identity.
The Identity and Access Lifecycle (Joiners, Movers, Leavers)
Access management is a dynamic lifecycle that must strictly track an employee's employment status:
THE EMPLOYEE ACCESS LIFECYCLE
│
┌──────────────────────────────┼──────────────────────────────┐
▼ ▼ ▼
[ JOINER (Onboarding) ] [ MOVER (Transfer) ] [ LEAVER (Offboarding) ]
- Background verification - Role changes / promotion - Immediate revocation
- Formal asset owner sign-off - Revoke old role rights - Disable Active Directory
- Baseline RBAC provisioning - Provision new role rights - Reclaim tokens / badges
- Issue MFA hardware token - Prevent "Privilege Creep" - Archive user mailbox
- Joiner (Onboarding):
- Prior to account creation, human resources completes background checks and Know Your Employee (KYE) screening.
- Access rights are provisioned strictly on the basis of pre-approved Role-Based Access Control (RBAC) templates corresponding to the employee's specific job description.
- Access requests require formal written sign-off from the relevant Business Asset Owner.
- Mover (Internal Transfer / Promotion):
- When an employee transfers between departments (e.g., moving from the back-office settlement team to the proprietary trading desk), access rights must be thoroughly re-evaluated.
- Preventing "Privilege Creep": A common vulnerability where employees accumulate access rights from previous roles over years of tenure. Policy mandates that all previous access permissions must be revoked before new department privileges are granted.
- Leaver (Offboarding / Termination):
- Upon voluntary resignation or termination of employment, all access rights must be immediately revoked.
- Immediate automated deactivation of Active Directory / Identity Provider accounts, revocation of active session tokens, termination of VPN and email access, and retrieval of physical smart cards, biometric credentials, and company-owned mobile devices.
Access Control Models: RBAC vs ABAC
- Role-Based Access Control (RBAC): Assigns permissions to standardized organizational roles (e.g.,
Risk_Analyst,Trader,Compliance_Officer) rather than individual users. Users are assigned to roles, significantly reducing administrative overhead and enforcing consistent baseline access. - Attribute-Based Access Control (ABAC): An advanced, context-aware authorization model that evaluates dynamic attributes in real-time before granting access:
- Subject attributes: User identity, role, department, security clearance level.
- Action attributes: Read, write, delete, execute, export.
- Resource attributes: File classification (e.g., Confidential), data owner, application type.
- Environmental attributes: Time of day, user geographic location (GPS/IP), device health status (e.g., whether antivirus is active).
The concentration of excessive administrative permissions represents one of the most hazardous internal vulnerabilities in financial market architectures. To prevent catastrophic fraud, data exfiltration, or accidental operational outages, regulated entities must enforce strict separation of responsibilities and specialized management of privileged accounts.
CORE ACCESS GOVERNANCE PRINCIPLES
│
┌──────────────────────────────┼──────────────────────────────┐
▼ ▼ ▼
[ LEAST PRIVILEGE ] [ NEED-TO-KNOW ] [ SEGREGATION OF DUTIES ]
- Minimum necessary rights - Access restricted to data - Separation of critical steps
- Zero standing privileges essential for current task - Four-Eyes Principle / Maker-Checker
- Time-bound access grants - Prevents curiosity browsing - Eliminates single-person fraud
1. Fundamental Access Governance Principles
- Principle of Least Privilege (PoLP):
- Users, software processes, and service accounts must be granted only the absolute minimum permissions, access rights, and system privileges required to perform their specific job functions, and nothing more.
- Standard business users must never operate with local administrator rights on their desktop workstations, preventing drive-by malware infections from achieving full system compromise.
- Need-to-Know:
- Access to confidential data is restricted exclusively to individuals who have a verified, legitimate business requirement to view that specific information to perform their assigned operational duties.
- Even if an executive holds a senior rank, they are not entitled to view sensitive client transaction data unless required by an active, authorized investigation or commercial function.
- Segregation of Duties (SoD) and Maker-Checker Controls:
- Critical, high-impact business processes must be partitioned across multiple individuals to ensure that no single person possesses the unilateral ability to initiate, approve, execute, and conceal a fraudulent or erroneous transaction.
- The Maker-Checker (Four-Eyes) Principle: Mandates that one individual (the "Maker") inputs or initiates a transaction (e.g., a multi-million-dollar cross-border wire transfer or database configuration change), while an independent authorized supervisor (the "Checker") must independently verify and cryptographically approve the transaction before execution.
2. Privileged Access Management (PAM)
Administrative accounts (e.g., Domain Admins, Enterprise Admins, root accounts, database administrators) wield unrestricted power over IT environments. Compromise of a single privileged credential can grant an attacker total control over core trading engines, clearing databases, and backup arrays.
Privileged Access Management (PAM) provides specialized technological and operational controls to secure, govern, and monitor privileged identities:
PRIVILEGED ACCESS MANAGEMENT (PAM) ARCHITECTURE
│
[ PRIVILEGED USER / ADMIN ]
│
▼
[ PAM SECURE VAULT ]
- Multi-Factor Authentication (MFA)
- Dynamic Just-In-Time (JIT) Checkout
- Ephemeral / Rotated Credentials
│
▼
[ SESSION PROXY ]
- Bastion / Jump Host Isolation
- Real-Time Keystroke Logging
- Full Video Session Recording
- Automated Threat Termination
│
▼
[ TARGET CRITICAL ASSETS ]
- Core Banking / Trading Engines
- Active Directory Domain Controllers
- Production Database Clusters
Core PAM Capabilities Mandated by Financial Regulators:
- Credential Vaulting: Administrative passwords and SSH private keys are stored in a hardened, encrypted digital vault. System administrators do not know the underlying passwords; credentials are automatically checked out via the PAM portal.
- Just-In-Time (JIT) Privileges: Eliminates standing administrative privileges. Administrators are granted elevated permissions only when required for a specific, pre-approved change ticket, and rights automatically expire after a fixed duration (e.g., 2 hours).
- Automated Password Rotation: Upon completion of an administrative session or immediately following check-in, the PAM engine automatically rotates the target system's password to an unpredictable 32-character string.
- Session Recording and Keystroke Logging: The PAM proxy records high-fidelity video of the administrator's desktop session and captures all typed CLI keystrokes.
- Real-Time Threat Termination: If an administrator executes an unauthorized command (e.g., attempting to drop a core table or download customer ledgers), the PAM engine instantly terminates the session and raises an immediate emergency alert to the SOC.
The convergence of logical authentication controls and physical infrastructure protection forms the twin pillars of organizational defense. Relying on simple passwords alone is indefensible against modern credential-stuffing, phishing, and brute-force attacks. Simultaneously, technological safeguards are useless if an unauthorized individual can physically walk into a server room and tamper with physical hardware.
THE 5 AUTHENTICATION FACTORS
│
┌──────────────┬───────────────┼───────────────┬──────────────┐
▼ ▼ ▼ ▼ ▼
[ SOMETHING [ SOMETHING [ SOMETHING [ SOMEWHERE [ SOMETHING
YOU KNOW ] YOU HAVE ] YOU ARE ] YOU ARE ] YOU DO ]
- Password - Hardware Key - Fingerprint - Geographic - Keystroke
- PIN (FIDO2) - Facial scan location dynamics
- Passphrase - TOTP App - Iris scan - Trusted IP - Signature
- Smart Card network cadence
1. Multi-Factor Authentication (MFA) Architecture
Multi-Factor Authentication (MFA) requires a user to present two or more independent authentication factors from different categories before access is granted:
- Knowledge Factor (Something You Know): Passwords, complex passphrases, PINs.
- Possession Factor (Something You Have): FIDO2/WebAuthn hardware security keys (e.g., YubiKey), hardware OTP tokens, smart cards, smartphone authenticator apps (TOTP).
- Inherence Factor (Something You Are): Biometric traits—fingerprint scans, facial recognition, iris patterns, voice recognition.
- Location Factor (Somewhere You Are): Verified corporate IP subnets, geo-fencing coordinates.
- Behavioral Factor (Something You Do): Keystroke dynamics, mouse movement cadence.
Regulatory Mandate: Regulated entities in the GIFT IFSC are required to enforce phishing-resistant MFA (such as FIDO2/WebAuthn or certificate-based smart cards) across all remote access connections (VPNs, virtual desktops), cloud administrator portals, and systems handling sensitive financial transactions. SMS-based OTP is discouraged due to vulnerability to SIM-swapping and SS7 interception.
2. Single Sign-On (SSO) and Federated Identity
- Single Sign-On (SSO): Allows users to authenticate once with a central Identity Provider (IdP) and gain seamless access to multiple authorized internal and cloud applications without repeatedly re-entering credentials.
- Federated Identity Standards:
- SAML 2.0 (Security Assertion Markup Language): XML-based standard exchanging authentication and authorization assertions between an Identity Provider (IdP) and a Service Provider (SP).
- OIDC (OpenID Connect): Modern, lightweight identity layer built on OAuth 2.0 utilizing JSON Web Tokens (JWT), widely used for API-driven microservices and mobile apps.
- Security Benefits: Centralizes access revocation (disabling the IdP account immediately terminates access across all federated SaaS applications), enforces consistent MFA policies, and eliminates password fatigue.
3. Physical and Environmental Security Controls for Data Centres
Physical security encompasses the physical safeguards, architectural designs, and environmental countermeasures deployed to prevent unauthorized physical access to facilities, server rooms, and telecommunications equipment.
MULTI-TIERED PHYSICAL DEFENCE PERIMETERS
│
[ Perimeter 1: Facility Boundary ] ──> Security fences, vehicle barriers, guard posts
│
[ Perimeter 2: Building Entrance ] ──> Anti-tailgating turnstiles, visitor badging, CCTV
│
[ Perimeter 3: Server Room Doors ] ──> Two-factor biometric mantrap, access logs
│
[ Perimeter 4: Server Racks ] ──> Individual biometric rack locks, PDU sensors
Physical Security Safeguards:
- Defense in Depth: Establishing layered physical concentric zones, where each successive zone requires higher authorization.
- Mantrap (Air-Lock Doors): A secure interlocking door vestibule where Door B cannot open until Door A closes and locks, preventing tailgating or piggybacking (unauthorized persons following an authorized employee into secure areas).
- 24/7 CCTV Surveillance: High-definition cameras covering all facility perimeters, corridors, and server rack rows, with footage preserved for a minimum of 90 to 180 days under regulatory retention rules.
Environmental and Disaster Countermeasures:
- Fire Suppression: Clean-agent gaseous fire suppression systems (e.g., FM-200, Novec 1230, Inergen) that extinguish fires by oxygen displacement or chemical cooling without spraying water or leaving chemical residue on delicate electronic server circuitry.
- HVAC and Temperature Regulation: Industrial Heating, Ventilation, and Air Conditioning (HVAC) maintaining data centre ambient temperatures between 18°C and 27°C and relative humidity between 40% and 60% to prevent static electricity discharge and hardware overheating.
- Redundant Power Infrastructure: Uninterruptible Power Supply (UPS) battery arrays providing continuous clean power during grid transitions, backed by on-site diesel generators with redundant fuel supplies capable of sustaining operations for at least 72 continuous hours.