Identity and Access Management
The four steps
Identification is claiming an identity; authentication is proving it; authorization is what may be done; accounting records it. Questions routinely conflate authentication with authorization. Factors are something you know, have, are, do, and somewhere you are - MFA requires different categories, so two passwords are not MFA.
Models
DAC lets the owner decide (flexible, weaker). MAC uses labels and clearances (strong, rigid). RBAC assigns permissions to roles, not people, and scales well. ABAC evaluates attributes and context and is the most granular. Rule-based access control applies global rules. Need to know is distinct from clearance.
Federation and SSO
Kerberos issues tickets from a KDC using symmetric keys. SAML carries authentication assertions for browser SSO. OAuth 2.0 is an authorization delegation framework, not an authentication protocol; OIDC layers authentication on OAuth. Items claiming OAuth authenticates users are false.
Lifecycle
Provision, review, transfer, deprovision. On departure, disable the account first, preserve data, and delete later. Periodic recertification catches privilege creep, and log review supports accountability.
Rule of thumb
Biometrics: FAR admits the wrong person, FRR rejects the right one. The crossover error rate (EER) compares systems - lower is better, and it is the right metric when asked which device is most accurate. Tightening the threshold makes the system stricter: FRR rises, FAR falls, and usability drops. Do not pick "lowest FAR" alone when the question asks for overall accuracy.