Access Control and Identity Management
What this domain tests
Access control and identity management tests how identities are proven, authorized, used, reviewed, and removed. Expect access models, least privilege, authentication, privileged access, and access reviews.
Core rules
- Access control phases are identification, authentication, authorization, and accountability.
- DAC lets owners set access; MAC uses labels and clearances; RBAC uses roles; ABAC uses attributes.
- Least privilege and need-to-know limit access to what is required.
- MFA should protect remote access, administrators, and sensitive transactions.
- Privileged access management vaults credentials, records sessions, and requires approval.
- The joiner-mover-leaver process must update access when roles change.
- Periodic access reviews should be risk-based and acted on; rubber-stamping is a finding.
- Shared accounts destroy accountability and should be eliminated or tightly controlled.
Worked example
An employee moves from sales to finance. HR records the move; the manager requests the finance role; the old sales role is removed. The finance system owner approves, and the access review confirms the change within 30 days. Reasoning: the mover process is the risk point; adding new access without removing old access creates privilege accumulation.
Traps
- Defining roles so broadly that they exceed business need.
- Keeping shared administrator accounts.
- Applying MFA only to ordinary users.
- Running access reviews that produce no removals.
- Leaving orphan accounts after termination.