I85PREP
⌘ K
ECF Cybersecurity (Core) study materials
ECF Cybersecurity (Core) study resources

ECF Cybersecurity (Core): Identity and Access Management

ECF Cybersecurity (Core) · Work through your exam, one topic at a time.

All guide sections

Identity and Access Management

IAM questions reward precision about the order of identity operations and the protocols behind federation. You must separate authentication from authorisation, choose an access model, and design joiner-mover-leaver flows that leave no orphaned accounts.

Core rules and concepts

  • Sequence: identification (claiming an identity), authentication (proving it), authorisation (what is permitted), accounting (the audit trail).
  • Factors: something you know, have or are; context such as location and behaviour acts as a signal. MFA requires different factor types; two passwords are not MFA.
  • Phishing-resistant MFA: FIDO2/WebAuthn passkeys and smart cards bound to origin. Push notifications and SMS are weaker (MFA fatigue, SIM swap).
  • Federation: SAML 2.0 carries browser SSO assertions; OIDC is the identity layer built on OAuth 2.0; OAuth 2.0 itself is delegated authorisation, not authentication.
  • Access models: DAC (owner discretion), MAC (labels and clearances), RBAC (roles), ABAC (attributes and policy), plus risk-adaptive access.
  • Principles: least privilege, separation of duties, need to know, just-in-time and time-bound elevation.
  • Lifecycle: authoritative source to provisioning (SCIM) to periodic recertification to prompt deprovisioning. Orphaned and non-human accounts are top audit findings.
  • PAM: vaulting, session recording, credential rotation for privileged and service accounts.

Worked example

A contractor needs read access to one analytics dashboard for 60 days. Federate SSO through SAML from the contractor's own IdP, so no new password exists to steal. Provision automatically via SCIM when the contract record is created. Assign a narrow RBAC role granting read-only dashboard access, time-bound to expire at day 60, with recertification at midpoint. Require phishing-resistant MFA. Stream access logs to the SIEM. If the contract ends early, deprovisioning is triggered by the contract system, not by a reminder email to a manager.

Traps that cost marks

  • Saying OAuth 2.0 authenticates users; it delegates authorisation.
  • Counting two knowledge factors as MFA.
  • Assuming SSO removes the need for authorisation decisions per application.
  • Excluding service accounts, API keys and OAuth grants from lifecycle and recertification controls.