A resource is a real-world service or data set (including physical things like buildings controlled through IT) that a resource owner wants to protect; it belongs to a relying party, the application that defines who may access it, when and under which conditions.

Three points are easy to miss:

• Resources are not only files. Anything whose use is governed by an IT system counts, including buildings and industrial plants with electronic access control. IAM therefore reaches into the physical world.
• The resource owner's goal is protection from unauthorised access. That is the mirror image of the subject's goal (getting in), and the tension between the two is what IAM mediates.
• The relying party (RP) speaks for the resource. The RP is the application, app or system that owns the resource and lays down the access rules. IAM services inform the RP about the subject, but the RP makes the final access decision.

Like subjects, resources are also stored in the IAM system as data objects, a digital image of the real thing, so that rules can refer to them.

A memorized secret is a knowledge-based authentication means where the subject authenticates by entering a secret only it knows, such as a password, PIN or security question; a password is a confidential character string agreed between subject and verifier at registration and used afterwards to authenticate.

Memorized secrets need enough complexity and randomness to resist guessing, phishing and brute force; password policies (length, character mix, expiry, reuse) determine their strength.

Go deeper:

• Password (Wikipedia) — cracking, policies and what actually makes a password system secure.
• NIST SP 800-63B-4 Authentication and Authenticator Management — every authenticator type defined and graded by assurance level.