Identity and access management

Identity is the new perimeter. This objective covers provisioning and deprovisioning, identity proofing, federation and single sign-on, access control models, multifactor authentication, password practices, and privileged access management.

Account life cycle and federation

Provisioning creates accounts with the right access; deprovisioning removes it promptly when people leave or change roles. Permission assignments should be reviewed so access doesn't creep. Identity proofing verifies a person is who they claim before an account is issued. Single sign-on (SSO) lets one login reach many apps; federation extends that trust across organizations using standards such as SAML (XML assertions), OAuth (authorization delegation), and OpenID Connect (authentication on top of OAuth). LDAP is the directory protocol behind many identity stores.

Access control models

Time-of-day restrictions and least privilege apply on top of any model.

Authentication

Multifactor authentication combines factors from different categories: something you know (password, PIN), something you have (phone, hardware token), something you are (biometrics), and somewhere you are (location). Two passwords are still one factor. Implementations include biometrics, hard and soft authentication tokens, and security keys (FIDO2/passkeys), which resist phishing.

Password best practices emphasize length and complexity, no reuse, and password managers; modern guidance discourages forced frequent expiration. Passwordless options use keys or biometrics instead.

• Just-in-time permissions: access granted only when needed, for a limited time.
• Password vaulting: privileged credentials stored and checked out from a vault.
• Ephemeral credentials: short-lived credentials that expire automatically.

Key terms

Provisioning

Creating user accounts and granting the access each person needs.

Deprovisioning

Removing or disabling accounts and access when users leave or no longer need them.

Identity proofing

Verifying that a person is who they claim to be before issuing credentials.

Single sign-on (SSO)

Signing in once to access many applications without logging in again to each.

Federation

A trust relationship that lets identities from one organization access another's resources.

Security Assertion Markup Language (SAML)

An XML-based standard for exchanging authentication assertions between an identity provider and a service.

OAuth

An authorization framework that lets an app access resources on a user's behalf without their password.

Role-based access control (RBAC)

Granting permissions to roles that match job functions and assigning users to roles.

Attribute-based access control (ABAC)

Granting access through policies that evaluate many attributes of the user, resource, and context.

Mandatory access control (MAC)

An access model where the system enforces access using labels and clearances that users can't change.

Discretionary access control (DAC)

An access model where the owner of a resource decides who can access it.

Multifactor authentication (MFA)

Authentication that requires factors from two or more different categories.

Privileged access management (PAM)

Tools and practices that control, monitor, and limit the use of administrator accounts.

Just-in-time permissions

Granting elevated access only when needed and only for a limited time.

Security key (FIDO2)

A hardware authenticator that uses public-key cryptography and checks the site's origin, resisting phishing.