IM-CCM cheat sheet

IAM coordinates four core functions: identification, authentication, authorization, and accountability (audit logging).

Identification is a claimed identity (username, email); authentication is the proof of that claim; authorization is the granted permission set.

AAA model: Authentication verifies, Authorization permits, Accounting records activity for later audit.

Subjects are entities requesting access (users, services, devices); objects/resources are the targets being accessed.

Least privilege: every subject receives only the permissions required for its current task, no more.

Separation of duties splits a sensitive task across two or more subjects so no single actor completes it alone.

Access control models: DAC (owner discretion), MAC (system labels/clearance), RBAC (role membership), ABAC (attributes/policy).

RBAC assigns permissions to roles and roles to users; ABAC evaluates attributes of subject, resource, action, and context at request time.

Identity proofing establishes that a claimed identity corresponds to a real entity before credentials are issued.

Identity lifecycle stages: joiner (provision), mover (modify), leaver (deprovision); the leaver step is the highest-risk control gap.

Provisioning creates accounts and entitlements; deprovisioning revokes them; orphaned accounts are those whose owner left without revocation.

Role mining derives roles from existing entitlement assignments; role engineering designs roles top-down from business functions.

Access certification (recertification) is periodic manager or resource-owner review confirming entitlements remain justified.

Segregation of duties analysis detects toxic combinations where one identity holds conflicting entitlements, e.g., create-vendor plus pay-vendor.

Entitlement creep is the accumulation of excess access over time via role changes; periodic review and least privilege counter it.

Authoritative source (HR system) drives identity data of record; downstream systems should consume, not originate, identity attributes.

Access requests should follow approval workflows that record requester, approver, justification, and time-bound expiry.

Authentication factors: something you know (password/PIN), something you have (token/device), something you are (biometric).

MFA requires two or more factors from different categories; two passwords are single-factor, not MFA.

Password storage uses salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2); plain or fast unsalted hashes are unacceptable.

SSO lets one authentication event grant access to multiple applications via a trusted session or token.

Session management controls include idle timeout, absolute timeout, session ID rotation at login, and secure/httpOnly cookie flags.

FIDO2/WebAuthn uses public-key cryptography bound to an origin, resisting phishing and credential replay.

OAuth 2.0 is an authorization delegation framework, not an authentication protocol; OpenID Connect adds the authentication layer.

Step-up authentication raises assurance for sensitive actions by requiring an additional factor at the moment of the action.

Privileged accounts include administrative, root, service, and emergency (break-glass) accounts with elevated entitlements.

PAM vaulting stores privileged credentials in an encrypted repository; checkout is time-bound and logged.

Session recording and keystroke logging provide accountability for privileged sessions on critical systems.

Just-in-time (JIT) privilege grants elevated rights only for a defined window, then auto-revokes.

Credential rotation changes privileged passwords or keys on a schedule or after each checkout to limit exposure.

Service accounts often have non-expiring passwords and broad rights; they should be inventoried, owned, and rotated.

Break-glass accounts are emergency access paths; use should trigger alerts and post-use review.

Privileged access should be separated from daily-use accounts so routine activity never runs with admin rights.

Federation trusts an identity provider (IdP) to authenticate users for a relying party (service provider) across organizational boundaries.

SAML 2.0 exchanges XML assertions for browser SSO; OIDC exchanges JSON Web Tokens on top of OAuth 2.0.

In SAML, the IdP signs assertions; the SP validates the signature, audience, recipient, and time conditions before trusting it.

Cloud IAM roles are assumed via temporary credentials (STS); long-lived access keys should be avoided in favor of role assumption.

Cloud least privilege is expressed in policies attached to identities or resources; wildcard actions and resources widen blast radius.

Workload identity federation lets CI/CD or services obtain cloud credentials using short-lived tokens instead of stored secrets.

Cross-tenant or cross-account trust should be scoped to specific principals and conditions, not granted to entire directories.

Risk = likelihood × impact; inherent risk is pre-control, residual risk is what remains after controls operate.

Control types: preventive (blocks), detective (identifies), corrective (remediates); a control gap is an unmitigated exposure.

Evidence for audit must be complete, timely, and attributable; access review sign-offs and logs are common artifacts.

Common frameworks: ISO/IEC 27001 (ISMS), NIST SP 800-53 (control catalog), SOC 2 (trust services criteria), PCI DSS (cardholder data).

Logging and monitoring require retention periods, integrity protection, and centralized collection for investigation.

Segregation-of-duties and least-privilege findings are measured by counting excess or conflicting entitlements per identity.

Key IAM metrics include orphaned accounts, dormant accounts, MFA coverage, and percentage of access certified on schedule.

Audit trails must record who, what, when, and outcome for authentication and privileged actions to support non-repudiation.