Access Control and Identity Management
Access control answers four questions in sequence: identification (who claims to be there), authentication (prove it), authorization (what may they do) and accountability (what did they do, via logging). Keep that order straight - many questions hinge on it.
Authentication factors are something you know, have or are; MFA requires different types, so two passwords or a password plus a security question is not MFA. Modern additions include behavioural and location context. Understand SSO and federation (SAML assertions, OIDC/OAuth 2.0 tokens, Kerberos tickets from a KDC, RADIUS for network access, TACACS+ for device administration), and the provisioning lifecycle: join, move, leave - with prompt de-provisioning being the classic audit finding.
Access control models:
- DAC - owner decides (flexible, weaker).
- MAC - system-enforced labels and clearances (strongest, e.g. classified systems).
- RBAC - rights attached to roles, users assigned to roles; best for stable job functions and easiest to audit.
- ABAC - decisions from attributes (department, time, device posture); most granular and dynamic.
- Rule-based - global conditional rules (e.g. no access outside business hours).
Also know ACLs versus capability lists, privileged access management (vaulting, session recording, just-in-time elevation) and zero trust (verify explicitly, assume breach, least-privilege micro-segmentation).
Traps: RBAC questions often describe attribute-driven rules ("only from managed devices in the EU") - that is ABAC. Kerberos provides authentication and single sign-on, not authorization policy. Biometrics are authentication, not identification, once a template is matched.
Worked example: a contractor needs read access to one project folder for 30 days. Create a time-bound role with least privilege, assign the contractor, log the grant, and schedule automatic removal - not a standing ACL entry.