I85PREP
⌘ K
NISP Level 1 - Security Operations study materials
NISP Level 1 - Security Operations study resources

NISP Level 1 - Security Operations: Identity and Access Management

NISP Level 1 - Security Operations · Work through your exam, one topic at a time.

All guide sections

Identity and Access Management

This domain tests the identity lifecycle and the mechanisms that turn an identity into an authorised action. Expect questions that separate authentication from authorisation and that ask which access control model fits a scenario.

Lifecycle and fundamentals

Identity management covers joiner-mover-leaver events: provisioning, role change with revocation of old entitlements, and timely deprovisioning. Identification claims an identity, authentication verifies it, authorisation decides what it may do, and accounting records what it did.

Factors are something you know (password, PIN), something you have (token, smart card, phone) and something you are (biometrics); location and behaviour act as contextual signals. MFA requires two different categories - two passwords are not MFA.

Access control models

  • DAC - the owner decides; flexible but weak for regulated data.
  • MAC - labels and clearances enforced by the system.
  • RBAC - permissions bundled into roles; suits stable job functions.
  • ABAC - attributes of subject, object, action and environment; suits fine-grained, context-aware rules.
  • Rule-based and risk-based variants are common in cloud platforms.

Protocols

Kerberos uses a KDC and tickets (TGT, then service ticket) for single sign-on in Windows domains. SAML 2.0 carries federated authentication assertions. OAuth 2.0 delegates authorisation and issues access tokens; OIDC adds an identity layer on top. LDAP is a directory protocol, not an authentication protocol in itself.

Worked example

A finance clerk moves to sales. The correct sequence is: HR triggers the mover event, the RBAC role changes from finance-clerk to sales-rep, and all finance entitlements - shared drives, ERP roles, approval limits - are removed the same day. Keeping both roles "for convenience" creates a toxic combination that fails least-privilege and segregation-of-duties review.

Traps

  • Claiming OAuth authenticates users; it authorises access, while OIDC authenticates.
  • Confusing FAR and FRR: a stricter biometric threshold lowers FAR but raises FRR.
  • Forgetting that privileged accounts need vaulting, session recording and just-in-time elevation.
  • Leaving orphaned accounts after a leaver event because the ticket was closed early.