Identity, Authentication and Access Control
Domain 5 covers who a user is, how that is proven, and what they may then do. L1 questions present a login design, an access model or an account-lifecycle failure and ask for the flaw or the correct model.
Four distinct steps
- Identification - the claimed identity, such as a username.
- Authentication - proof of the claim.
- Authorization - what that identity may access.
- Accountability - the audit trail tying actions to the identity, which is why shared accounts are forbidden.
Factors and multi-factor authentication
Factors are something you know (password, PIN), something you have (token, smart card, authenticator app, phone), and something you are (fingerprint, face, iris). MFA requires two different categories - a password plus a second password is not MFA. Time-based one-time codes, push approval and hardware keys such as FIDO2 tokens are the common second factors; SMS codes are weaker because of SIM-swap and interception.
Access control models
- DAC - the owner decides, as with file permissions.
- MAC - system-enforced labels, as in classified systems and SELinux.
- RBAC - permissions attach to roles, users attach to roles; the usual enterprise choice.
- ABAC - decisions use attributes such as department, time, device posture and location.
Layer these with least privilege, need-to-know, and separation of duties so no single person can both request and approve a payment. Privileged accounts get vaulting, session recording and just-in-time elevation. Single sign-on with Kerberos or SAML improves usability but makes the primary credential a high-value target, so it needs strong MFA.
Worked example
An audit finds a former employee's account accessed project files twelve days after their last working day. Reasoning: this is a leaver-process failure, not a password-strength failure. Root cause is the gap between HR's departure date and account disabling. Controls: an HR-triggered disable SLA measured in hours, a single authoritative joiner-mover-leaver feed, quarterly access recertification by managers, and review of dormant accounts. Adding complexity to the password would not have helped, because nobody was watching the account.
Traps that cost marks
- Using authentication and authorization interchangeably.
- Calling two passwords or two knowledge questions MFA.
- Ignoring the mover case: a transferred employee keeps old entitlements.
- Allowing shared administrative accounts, which destroys accountability.