Identity, Authentication and Access Control
This domain covers proving who or what is present, then granting the minimum access for the minimum time. CPIT InfoSec questions usually hinge on the distinction between identification, authentication, authorisation and accountability, and on choosing an access model that expresses the real business rule.
The four steps
- Identification: a claimed identity such as a username or certificate subject.
- Authentication: proving the claim with factors, something you know, have or are. MFA requires different factor types, not two passwords.
- Authorisation: deciding what the authenticated subject may do.
- Accountability: attributing actions through unique identities and logs. Shared accounts destroy this.
Access models
- DAC: the owner decides; flexible but hard to audit at scale.
- MAC: system-enforced labels and clearances for high-assurance environments.
- RBAC: permissions bundled into roles, users assigned roles. Simple and coarse; role explosion is the risk.
- ABAC: policy evaluates attributes such as department, device posture, time and data tag. Fine-grained, but harder to test and explain.
Federation and lifecycle
SSO via SAML or OIDC reduces credential sprawl, and Kerberos remains common in Windows estates. FIDO2 and passkeys resist phishing and are preferred over SMS or OTP. The joiner, mover, leaver lifecycle is where most real breaches occur: access must be revoked on the termination date and re-evaluated on role change. Privileged access management adds vaulting, session recording and just-in-time elevation; access reviews and separation of duties keep entitlements honest.
Worked example
A hospital wants nurses to see only patients in their ward, and only during shifts. RBAC alone cannot express the ward-time relationship without hundreds of roles, so use ABAC: permit read on a patient record where nurse ward equals record ward, the request falls within the shift window, and the device is managed. The policy is centralised, testable and auditable, while RBAC keeps the baseline role for non-clinical functions and administrative staff.
Traps
- Counting two knowledge factors as MFA.
- Performing authorisation checks only in the client.
- Leaving orphaned accounts after transfers; recertification exists to catch this.
- Confusing SSO, which is an authentication convenience, with authorisation.