CIIM cheat sheet

Identity lifecycle states: joiner (provision), mover (re-evaluate entitlements), leaver (deprovision within a defined SLA); orphaned accounts are those without an active authoritative owner record.

RBAC maps users to roles and roles to permissions; role mining derives candidate roles from existing entitlement assignments, then role engineering validates them against least-privilege policy.

ABAC evaluates policy at request time using subject, resource, action, and environment attributes; it scales better than static roles but requires trustworthy attribute sources.

Segregation of duties (SoD) conflict = a pair or set of entitlements that lets one identity both initiate and approve (or conceal) a transaction; preventive SoD blocks at provisioning, detective SoD flags post-hoc.

Access certification (attestation) campaigns route entitlement reviews to managers or application owners; outcomes are certify, revoke, or remediate; evidence must be retained for audit.

Access request workflows require justification, owner approval, and time-bound expiry (temporary elevation) rather than permanent standing privilege.

Authoritative source hierarchy: HR system of record for employees, contractor registry for non-employees, student information system for education; downstream stores reconcile to the authoritative source.

Entitlement creep occurs when movers retain prior access; periodic reconciliation plus mover-triggered re-certification counters it.

Governance metrics: orphan account count, SoD conflict count and aging, certification completion rate, mean time to deprovision, and percentage of privileged access under review.

Authentication factors fall into knowledge (something you know), possession (something you have), and inherence (something you are); MFA requires two or more factors from different categories.

NIST SP 800-63B authenticator assurance levels: AAL1 single-factor, AAL2 multi-factor with replay resistance, AAL3 hardware-based cryptographic authenticator with verifier impersonation resistance.

FIDO2/WebAuthn uses public-key credentials bound to the origin; the private key never leaves the authenticator, which defeats phishing and server-side secret theft.

OAuth 2.0 delegates authorization via access tokens; OpenID Connect adds an identity layer with an ID token (JWT) carrying subject and authentication claims.

SAML 2.0 web browser SSO flow: SP redirects to IdP with AuthnRequest, IdP authenticates and posts a signed Assertion to the ACS URL, SP validates signature and conditions.

OIDC flows: authorization code with PKCE is preferred for public clients; implicit flow is deprecated because tokens leak via URL fragments.

Session management controls: short idle and absolute timeouts, secure and HttpOnly cookie flags, rotation of session identifiers at privilege change, and server-side revocation.

Privileged access management: vault credentials, session brokering, just-in-time elevation, and recording of privileged sessions; standing admin rights are the primary target of credential theft.

Zero trust replaces perimeter trust with per-request verification using device posture, identity assurance, and least-privilege policy enforcement (e.g., continuous access evaluation).

Data classification tiers (public, internal, confidential, restricted) drive handling, encryption, retention, and access rules; unclassified data defaults to the most restrictive tier until labeled.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) solves key distribution and enables digital signatures.

Envelope encryption: a data encryption key (DEK) encrypts data, a key encryption key (KEK) wraps the DEK; rotating the KEK avoids re-encrypting the full dataset.

Hashing (SHA-256) is one-way and used for integrity; password storage requires a salted, memory-hard KDF such as Argon2id, bcrypt, or scrypt, never plain hashing.

Tokenization replaces sensitive values with non-sensitive tokens mapped in a vault; unlike encryption, the token has no mathematical relationship to the original value.

Data masking and pseudonymization reduce exposure in non-production and analytics environments; pseudonymized data remains personal data under GDPR because it can be re-linked with additional information.

Data states: at rest (storage encryption, key management), in transit (TLS 1.2+/1.3, HSTS), and in use (confidential computing, memory encryption).

DLP enforces policy on data in motion, at rest, and in use using content inspection (regex, fingerprints, ML classifiers) plus context (destination, user, device).

Data retention and secure disposal: retention schedules align to legal/regulatory obligations; disposal must be verifiable (crypto-shredding via key destruction or certified media sanitization).

Risk score = likelihood × impact; identity risk scoring typically combines signal severity, identity privilege level, and asset sensitivity into a normalized score with defined thresholds for action.

Risk signals include impossible travel, anomalous login time, new device, credential stuffing patterns, leaked credentials, dormant accounts, and excessive privilege.

Impossible travel detection flags two authentications from locations whose distance divided by elapsed time exceeds plausible travel speed (e.g., >900 km/h for commercial flight).

Behavioral baselines (UEBA) model normal access patterns per identity; deviations are scored and can trigger step-up authentication or session restriction.

Step-up authentication raises assurance at the moment of risk (e.g., AAL1 session challenged to AAL2) rather than blocking outright, balancing friction and security.

Credential exposure monitoring compares identity identifiers against breach corpora; a match requires forced reset and re-enrollment of credentials.

Risk-based access decisions combine identity assurance, device trust, network context, and resource sensitivity; continuous evaluation re-scores active sessions on new signals.

Dormant and stale accounts inflate attack surface; policy typically disables after a defined inactivity period (e.g., 90 days) and deletes after a longer period.

Risk treatment options: mitigate (add control), transfer (insurance), avoid (remove access), accept (documented residual risk with owner sign-off).

Account takeover (ATO) attack chain: credential acquisition (phishing, stuffing, breach) → validation → access → persistence (MFA enrollment, mailbox rules) → monetization.

Credential stuffing reuses breached username/password pairs at scale; defenses are breached-password screening, rate limiting, bot detection, and MFA.

Phishing-resistant authentication (FIDO2/WebAuthn, certificate-based) blocks credential phishing because the origin-bound key will not sign for a lookalike domain.

New-account fraud uses synthetic identities (mixed real and fabricated data); detection relies on identity proofing, device reputation, velocity checks, and cross-institution consortium data.

Identity proofing levels per NIST SP 800-63A: IAL1 self-asserted, IAL2 remote or in-person evidence plus biometric or address verification, IAL3 supervised in-person with physical evidence.

Document and biometric liveness checks counter presentation attacks (photos, masks, deepfakes); liveness detection must resist injection attacks on the camera feed.

Transaction fraud monitoring scores anomalies in amount, payee, channel, and timing; rules and ML models feed case management with false-positive tuning.

MFA fatigue (push bombing) attacks spam approval prompts; mitigations are number matching, rate limiting, and phishing-resistant authenticators.

Fraud response playbook: contain (disable account, revoke sessions and tokens), eradicate (reset credentials, remove persistence), recover (restore access), and report (regulatory/breach notification).