Identity Risk Management
Identity Risk Management tests whether you can identify, score, treat, and monitor identity risk in business terms. The exam expects a repeatable method: find the risk source, estimate likelihood and impact, choose a treatment, assign an owner, and track residual risk. It is not enough to list weaknesses. Risk reviews should include third-party and machine identities, not only employees.
Core rules and concepts
- Risk is likelihood times impact, not a vulnerability label. A dormant admin account with no owner and no MFA has higher risk than a dormant read-only account.
- Common identity risk sources: orphan accounts, excessive or accumulated entitlements, stale accounts, weak authentication, shared credentials, third-party access, and unmonitored privileged activity.
- A risk register records description, affected identities and systems, inherent score, controls, residual score, owner, treatment, and due date.
- Treatment options are mitigate, transfer, avoid, or accept. Acceptance needs an accountable owner and an expiry or review date.
- Continuous monitoring uses metrics such as percentage of accounts with owners, MFA coverage, privileged accounts, certification completion, and time to revoke access.
- Risk scoring criteria must be defined in advance so different reviewers score consistently.
Worked example
A service account has domain administrator rights, no named owner, a password unchanged for two years, and no interactive login requirement. Likelihood is high because the credential is powerful and unmonitored; impact is high because compromise could affect the directory. Inherent risk is critical. Controls should include assigning an owner, vaulting the credential, rotating it, restricting logon, and reviewing use. Residual risk is reassessed after evidence. The reasoning is that the combination of privilege, staleness, and missing accountability drives the score, not any single flaw.
Traps that cost marks
Scoring risk without defined criteria; recording a vulnerability as a risk; treating 'accept' as closure without owner and expiry; ignoring business impact; and measuring only account counts rather than control effectiveness.