SIEM, SOC and SOAR Explained: Security Monitoring, Threat Detection and Incident Response

## CONTENT

Quick Answer

Identity and Access Security protects an organisation's IT systems, applications, networks and data by ensuring that only authorised users and devices can access the resources they need. It combines identity verification, authentication, access policies and network security controls to reduce unauthorised access.

Three important technologies in this area are:

• MFA (Multi-Factor Authentication): Verifies a user's identity using two or more different authentication factors.
• ZTNA (Zero Trust Network Access): Provides secure, identity-based access to specific applications instead of automatically trusting users connected to a network.
• NAC (Network Access Control): Identifies users and devices connecting to a network and controls their access according to security policies.

Although these technologies have different functions, they can work together to protect users, devices, applications and corporate networks.

What Is Identity and Access Security?

Identity and Access Security refers to the policies, technologies and processes used to verify identities and control access to an organisation's IT resources. It determines who can access a resource, what they are permitted to do and under which conditions access should be granted.

Modern organisations operate across offices, remote locations, cloud platforms and hybrid IT environments. Employees use laptops, smartphones and business applications, while organisations also connect printers, IP phones, CCTV cameras, IoT equipment and third-party devices to their networks.

Traditional security methods that rely only on passwords or network boundaries are not sufficient to manage all these access requirements. Identity and Access Security introduces additional controls to verify users and devices before granting access.

Key Elements of Identity and Access Security

• User identity verification and authentication.
• Multi-factor and passwordless authentication.
• Role-based access permissions.
• Device identification and security compliance checks.
• Secure remote access to business applications.
• Network admission control and segmentation.
• Access monitoring, auditing and policy enforcement.
• Regular review and removal of unnecessary access permissions.

1. Multi-Factor Authentication (MFA)

What Is MFA?

Multi-Factor Authentication (MFA) is an authentication security method that requires a user to provide at least two different types of verification before access is granted.

Traditional login systems often depend only on a username and password. If a password is stolen, guessed or exposed in a data breach, an attacker may be able to access the account. MFA adds another layer of verification, making unauthorised access more difficult.

For example, when an employee signs in to a company email account, the system may request a password followed by approval through an authenticator application or a hardware security key.

How Does MFA Work?

1. The user enters their username and password.
2. The authentication service validates the login credentials.
3. The system requests an additional authentication factor.
4. The user completes the requested verification, such as entering a one-time code or approving a sign-in request.
5. The authentication service validates the additional factor and grants or denies access.

Types of MFA Authentication Factors

MFA uses different categories of authentication factors. The main categories are:

Authentication Factor	Description	Examples
Something You Know	Information that only the user should know.	Password, PIN or passphrase.
Something You Have	A physical or digital authenticator controlled by the user.	Security key, hardware token, registered smartphone or authenticator application.
Something You Are	A biometric characteristic of the user.	Fingerprint, facial recognition or iris recognition.

Two passwords do not count as two different authentication factors because both belong to the same category. MFA requires factors from at least two different categories.

Common MFA Methods

MFA Method	How It Works	Security Considerations
SMS Verification	A one-time code is sent to the user's registered mobile number.	Can be vulnerable to phishing and mobile-number takeover attacks.
Email Verification	A verification code is sent to the registered email account.	Security depends partly on the protection of the email account.
Authenticator Application	An application generates time-based codes or provides authentication approval notifications.	Manually entered codes can still be vulnerable to phishing.
Push Notification	A login approval request is sent to a registered device.	Number matching and user awareness help prevent accidental approvals.
Hardware Security Key	A physical security key is used to authenticate the user.	FIDO-based security keys can provide strong phishing-resistant authentication.
Passkeys	Cryptographic credentials authenticate the user, often using a device PIN or biometrics.	FIDO-based passkeys are designed to resist phishing by binding authentication to the legitimate service.

Benefits of MFA

• Reduces the risk of unauthorised access through stolen or compromised passwords.
• Provides additional protection for email, cloud applications and business systems.
• Helps secure administrator and privileged user accounts.
• Reduces the impact of password reuse and credential theft.
• Supports organisational security policies and access-control requirements.

MFA Implementation Best Practices

• Enable MFA for all accounts wherever supported, especially administrator and remote-access accounts.
• Prefer phishing-resistant methods such as FIDO2 security keys and suitable passkeys for sensitive access.
• Use number matching or other anti-fatigue protections for push-based authentication where available.
• Protect authenticator registration, account recovery and password-reset processes.
• Provide users with a secure procedure for reporting lost devices and suspicious authentication requests.
• Maintain emergency access procedures and monitor their use.
• Review registered authentication devices and remove obsolete entries.

Important: All MFA methods do not provide the same level of protection. SMS codes, email codes and manually entered one-time passwords may still be vulnerable to phishing. Organisations should consider phishing-resistant authentication for sensitive accounts.

2. Zero Trust Network Access (ZTNA)

What Is ZTNA?

Zero Trust Network Access (ZTNA) is a security technology that provides controlled access to specific applications and resources based on verified user identity, device information and organisational access policies.

ZTNA follows the principle of never trust automatically, always verify. A user or device is not automatically trusted simply because it is connected to the corporate network, located inside an office or using a VPN connection.

Traditional remote-access solutions may provide users with access to a broader internal network. ZTNA focuses on granting access only to the applications and resources that the user is authorised to use.

How Does ZTNA Work?

1. Access Request: A user attempts to access a business application from an office, home or remote location.
2. Identity Verification: The identity provider authenticates the user, often using MFA.
3. Device Assessment: The system evaluates available device information, such as device registration, operating system status and security compliance.
4. Policy Evaluation: The ZTNA service checks whether the user and device meet the access requirements for the requested application.
5. Access Enforcement: The system allows or denies access according to the defined policies.
6. Monitoring: Access activity and security events are logged. Some solutions can reassess access during an active session.

Key Components of ZTNA

Component	Purpose
Identity Provider (IdP)	Authenticates users and supplies identity information.
Policy Engine	Evaluates identity, device and contextual information against access policies.
Policy Enforcement Point	Enforces the decision to allow or deny access.
ZTNA Gateway or Connector	Facilitates controlled connectivity between authorised users and protected applications.
Device Posture Assessment	Checks available device security and compliance information.
Monitoring and Logging	Records access activity and supports security investigation.

ZTNA vs Traditional VPN

A traditional Virtual Private Network (VPN) establishes an encrypted connection between a remote user and a private network. Depending on its configuration, the user may receive access to multiple internal systems and network segments.

ZTNA provides access to specific authorised applications instead of automatically extending broad network-level access.

Feature	Traditional VPN	ZTNA
Access Model	Typically provides network-level access.	Provides application-specific access.
Trust Approach	May rely partly on network location and connection status.	Verifies identity and relevant context before granting access.
Remote Workforce	Connects remote users to a private network.	Provides controlled access to authorised applications.
Access Scope	Can expose multiple network resources depending on configuration.	Limits access according to application-level policies.
Device Assessment	Depends on VPN configuration and integrated security controls.	Can incorporate device posture into access decisions.
Visibility	Often focuses on VPN connections and network activity.	Can provide application-level access visibility.

ZTNA does not automatically replace every VPN use case. Some organisations still require VPN connectivity for legacy applications, network services and specific administrative workflows.

Benefits of ZTNA

• Reduces unnecessary exposure of internal applications and services.
• Supports secure access for remote and hybrid employees.
• Enforces identity-based and context-aware access policies.
• Limits access to authorised applications and resources.
• Can reduce reliance on broad network-level remote access.
• Supports Zero Trust security architecture and cloud-based environments.

ZTNA Implementation Best Practices

• Identify critical applications and classify them according to sensitivity.
• Integrate ZTNA with a central identity provider and MFA.
• Define access policies based on user roles, device status and business requirements.
• Start with a limited application group and test access policies before wider deployment.
• Review legacy application compatibility and connectivity dependencies.
• Log access decisions and integrate relevant events with security monitoring systems.
• Review permissions regularly and remove access when employees change roles or leave the organisation.

3. Network Access Control (NAC)

What Is NAC?

Network Access Control (NAC) is a security technology that identifies users and devices attempting to connect to an organisation's wired or wireless network and controls their access according to security policies.

NAC helps prevent unauthorised or non-compliant devices from gaining unrestricted access to corporate resources. Depending on the configuration, a device may be granted normal access, placed in a restricted network, redirected for remediation or blocked completely.

Why Is NAC Required?

Corporate networks may contain desktops, laptops, smartphones, printers, IP phones, CCTV cameras, wireless access points, IoT devices and guest equipment. Without suitable access controls, unknown or insecure devices may connect to the network and create security risks.

NAC provides visibility into connected devices and helps organisations enforce rules about which users and devices can access specific network resources.

How Does NAC Work?

1. Connection Attempt: A device connects to a wired switch port or wireless network.
2. Device Identification: NAC identifies the device using available information such as authentication credentials, certificates, MAC address and device profiling.
3. Authentication: The system verifies the user or device through an authentication service.
4. Posture Assessment: Where supported, the system checks compliance requirements such as operating system status, endpoint protection and required security configurations.
5. Policy Decision: NAC compares authentication and device information with the organisation's access policies.
6. Access Enforcement: The network allows, restricts, quarantines or blocks the device.
7. Monitoring: Connection events and policy violations are recorded for investigation and reporting.

Common NAC Access Decisions

Decision	Meaning	Example
Allow	Device meets the required access policy.	Managed company laptop receives authorised corporate network access.
Restricted Access	Device receives limited connectivity.	Guest smartphone receives internet-only access.
Quarantine	Device is isolated from normal network resources.	Non-compliant laptop is placed in a remediation network.
Deny	Connection is blocked.	Unknown or unauthorised device is prevented from joining the network.

Common NAC Technologies and Protocols

Technology or Protocol	Purpose
IEEE 802.1X	Port-based network access control for wired and wireless networks. It provides an authentication framework before normal network access is permitted.
RADIUS	Provides centralised authentication, authorisation and accounting services commonly used with network access infrastructure.
EAP	Authentication framework used by 802.1X to support different authentication methods.
EAP-TLS	Certificate-based EAP method that supports strong mutual authentication.
MAC Authentication Bypass (MAB)	Allows certain devices that cannot perform 802.1X authentication to be identified using their MAC address, subject to policy.
VLAN Assignment	Places devices into different network segments according to access policies.

Security consideration: MAC address-based identification should not be treated as strong identity verification on its own because MAC addresses can be spoofed. Certificate-based authentication and stronger device identity controls should be preferred where practical.

Common NAC Use Cases

• Employee Devices: Allow authorised and compliant company laptops and desktops to connect to corporate networks.
• Guest Access: Provide visitors with controlled internet access without exposing internal business systems.
• Bring Your Own Device (BYOD): Apply suitable access restrictions to personally owned devices used for business purposes.
• IoT Devices: Identify and isolate printers, cameras, sensors and other connected equipment.
• Contractors: Provide limited access based on approved business requirements and time periods.
• Endpoint Compliance: Restrict devices that do not meet defined security requirements.
• Incident Response: Isolate devices suspected of being compromised, where supported by the NAC platform and integrated security tools.

Benefits of NAC

• Improves visibility of devices connected to wired and wireless networks.
• Helps prevent unauthorised devices from accessing corporate resources.
• Supports network segmentation and controlled guest access.
• Enforces device authentication and security compliance policies.
• Helps isolate suspicious or non-compliant endpoints.
• Supports integration with identity management, endpoint security and SIEM platforms.

NAC Implementation Best Practices

• Maintain an accurate inventory of authorised users, devices and network assets.
• Identify devices that support 802.1X and those requiring alternative access methods.
• Use certificate-based authentication where practical and appropriate.
• Define separate policies for employees, guests, contractors, IoT devices and infrastructure equipment.
• Test policies in monitoring or low-impact mode before enforcing restrictions across the entire network.
• Prepare exception policies for printers, IP phones, legacy equipment and devices that cannot use standard authentication.
• Configure quarantine and remediation networks carefully to avoid disrupting critical services.
• Monitor rejected connections, unknown devices and repeated authentication failures.

Difference Between MFA, ZTNA and NAC

MFA, ZTNA and NAC are related security technologies, but they solve different access-control problems. MFA verifies the user, ZTNA controls access to applications, and NAC controls admission to the network.

Feature	MFA	ZTNA	NAC
Primary Purpose	Verify user identity using multiple factors.	Provide controlled access to specific applications.	Control which users and devices can connect to a network.
Main Focus	Authentication.	Application access.	Network access.
Typical Use	Login to email, cloud services, VPN or business applications.	Remote access to internal and cloud applications.	Wired and wireless network admission.
Identity Checks	User authentication factors.	User identity and relevant access context.	User and/or device identity, depending on deployment.
Device Checks	May use a registered authenticator device.	Can evaluate device posture and compliance.	Can identify devices and assess their compliance.
Access Enforcement	Allows or denies authentication.	Allows or denies access to protected applications.	Allows, restricts, quarantines or blocks network access.
Common Technologies	Authenticator apps, FIDO security keys and passkeys.	Identity providers, policy engines, gateways and application connectors.	802.1X, RADIUS, EAP and network policy enforcement.

How MFA, ZTNA and NAC Work Together

These technologies can be combined to create multiple layers of access protection. Each technology contributes a different security control.

Consider an employee working remotely who needs to access an internal business application:

1. NAC: When the employee's laptop connects to a managed office network, NAC can authenticate the device and apply the appropriate network access policy.
2. MFA: When the employee signs in to the organisation's identity service, MFA verifies the user's identity using an additional authentication factor.
3. ZTNA: When the employee requests access to an internal application, ZTNA evaluates the user's identity, device information and applicable policies before granting application access.
4. Monitoring: Relevant authentication, network and application access events can be logged and analysed by the organisation's security monitoring systems.

In this example, NAC controls network admission, MFA strengthens user authentication, and ZTNA limits access to the required application. These technologies are complementary rather than interchangeable.

Common Challenges and Security Considerations

1. User Convenience and Authentication Fatigue

Frequent authentication prompts can frustrate users and encourage unsafe approval behaviour. Organisations should configure appropriate session policies, use number matching where supported and prefer phishing-resistant methods for sensitive access.

2. Legacy Systems and Device Compatibility

Older applications, printers, industrial equipment and IoT devices may not support modern authentication or endpoint posture checks. Organisations should identify these systems and create controlled exceptions instead of granting unrestricted access.

3. Incorrect Access Policies

Overly permissive policies can expose sensitive resources, while overly restrictive policies can interrupt business operations. Policies should be tested, documented and reviewed before broad enforcement.

4. Account and Device Lifecycle Management

Employees change roles, devices are replaced and contractors leave projects. Organisations should regularly review accounts, permissions, registered authenticators and device certificates to prevent obsolete access from remaining active.

5. Monitoring and Incident Response

Authentication failures, unusual access patterns, unknown devices and repeated policy violations should be monitored. Integration with endpoint detection, identity monitoring and SIEM platforms can help security teams investigate suspicious activity.

Implementation Approach for Organisations

Organisations should introduce identity and access security controls in a planned sequence, taking existing infrastructure and business requirements into account.

1. Assess the Environment: Identify users, applications, devices, network connections and existing authentication methods.
2. Prioritise High-Risk Access: Start with administrator accounts, remote access, email, financial systems and other sensitive resources.
3. Strengthen Authentication: Implement MFA and prioritise phishing-resistant authentication for high-risk accounts.
4. Improve Network Visibility: Deploy NAC capabilities to identify connected devices and define suitable network access policies.
5. Plan Application-Level Access: Identify suitable applications for ZTNA and define identity- and device-based access requirements.
6. Pilot the Deployment: Test the controls with a limited group of users, devices and applications.
7. Monitor and Refine: Review authentication events, access denials, policy exceptions and user feedback.
8. Expand Gradually: Extend the deployment across additional users, locations, devices and applications.

Popular Identity and Access Security Solutions

Organisations can implement MFA, ZTNA and NAC through dedicated products or broader security platforms. Product capabilities and licensing vary by edition and deployment model.

Technology	Example Solutions
MFA and Identity Management	Microsoft Entra ID, Okta, Cisco Duo, Google Cloud Identity.
ZTNA	Zscaler Private Access, Cloudflare Access, Palo Alto Networks Prisma Access, Cisco Secure Access.
NAC	Cisco Identity Services Engine (ISE), Aruba ClearPass, Fortinet FortiNAC, Forescout platform.

Solution selection should consider compatibility with existing infrastructure, authentication requirements, device coverage, application support, reporting, scalability and ongoing administration.

Frequently Asked Questions (FAQs)

1. What is the main difference between MFA and ZTNA?

MFA verifies a user's identity using two or more authentication factors. ZTNA controls access to specific applications based on identity, device information and access policies. MFA may be used as one of the authentication controls within a ZTNA deployment.

2. Is MFA enough to protect an organisation?

No. MFA strengthens authentication, but it does not replace endpoint security, access permissions, network controls, application security, monitoring or incident response. Organisations should use multiple security controls together.

3. Is ZTNA a replacement for VPN?

ZTNA can replace or reduce the need for traditional VPN access in many application-access scenarios. However, some environments still require VPN connectivity for legacy applications, network services or specific operational requirements.

4. What is the difference between NAC and a firewall?

NAC identifies users and devices attempting to connect to a network and applies network admission policies. A firewall controls network traffic according to security rules. They serve different purposes and are often deployed together.

5. Does NAC work with Wi-Fi networks?

Yes. NAC can manage access to both wired and wireless networks. Enterprise wireless deployments commonly use 802.1X authentication to verify users or devices before granting network access.

6. Can NAC block unauthorised devices?

Yes. Depending on its configuration and integration with network equipment, NAC can deny access, assign a restricted network segment or quarantine devices that do not meet the organisation's policies.

7. What is phishing-resistant MFA?

Phishing-resistant MFA uses authentication methods designed to prevent credentials or authentication responses from being reused by an attacker on a fraudulent website. FIDO-based security keys and passkeys are common examples.

8. Can MFA, ZTNA and NAC be deployed together?

Yes. They provide complementary security controls. MFA verifies user identity, ZTNA controls access to applications, and NAC controls network admission for users and devices.

Conclusion

Identity and Access Security is an essential part of protecting modern IT environments. MFA strengthens user authentication, ZTNA provides controlled access to applications, and NAC helps ensure that only authorised and compliant devices connect to organisational networks.

When implemented together with suitable endpoint protection, network segmentation, access policies and security monitoring, these technologies help reduce unauthorised access and support a stronger Zero Trust security strategy. Organisations should select and configure them according to their business requirements, risk exposure and existing IT infrastructure.

References and Further Reading

• NIST SP 800-207 – Zero Trust Architecture
• NIST SP 800-63B – Digital Identity Guidelines: Authentication and Authenticator Management
• IEEE 802.1X – Port-Based Network Access Control
• Cisco – What Is Network Access Control (NAC)?
• NIST – Zero Trust Architecture Resources