Identity, Access, and Data Protection
Domain 7 covers identity and access management (IAM) and data protection. Expect authentication versus authorization, least privilege, privileged access management, federation, encryption, and data classification.
Core rules and concepts
- Authentication proves identity; authorization decides access. MFA strengthens authentication but does not grant permissions.
- Least privilege and separation of duties reduce insider and credential-theft impact. RBAC grants by role; ABAC adds attributes such as time, device, and location.
- SSO and federation centralize trust; SAML and OIDC are common. De-provisioning must be immediate on termination.
- PAM vaults privileged credentials, brokers sessions, and records administrative activity.
- Classify data (public, internal, confidential, restricted) and apply encryption in transit and at rest, DLP, retention, and secure disposal.
- Key management matters: encryption without protected keys is weak.
Worked example
A contractor needs temporary access to a finance folder. Give a time-bound role with least privilege, require MFA, obtain manager approval, log access, and expire the entitlement after the project. Reasoning: the business need is satisfied without a permanent broad grant; approval and expiry create accountability. Review the access log after the first week to confirm actual use.
Traps that cost marks
Confusing authentication with authorization. Assuming MFA blocks insider abuse. Sharing administrative accounts destroys accountability. Encrypting data but storing keys beside it. Treating data classification as paperwork rather than a control driver.