Identity and Access Management
Identity and Access Management
This domain tests the identity lifecycle, authentication strength, and authorization models that enforce least privilege in practice.
Core rules
- Authentication proves identity; authorization decides access; accounting records what happened. Never conflate them.
- Factors: something you know, have, are, plus location and behavior as context. MFA must combine different types.
- Phishing-resistant MFA means FIDO2 security keys or passkeys bound to origin, not push notifications or SMS.
- Federation uses SAML or OIDC so an identity provider asserts identity to service providers; SSO reduces credential sprawl but concentrates risk.
- Authorization models: RBAC for job roles, ABAC for attributes, ReBAC for relationships. Least privilege and separation of duties constrain all of them.
- Privileged access management vaults credentials, brokers sessions, and grants just-in-time elevation with approval and recording.
- Lifecycle: joiner, mover, leaver. Movers are the usual source of excess access; leavers are the usual source of orphaned accounts.
Worked example
A contractor needs read access to a production database for two weeks. Rather than granting a standing role, assign a time-bound role through just-in-time approval, require manager and data owner sign-off, log the session, and set automatic expiry. At day 14 the access disappears without a ticket, and the access review shows no residual entitlement.
Traps that cost marks
- MFA push bombing: repeated pushes until a tired user approves. Number matching or FIDO2 addresses it.
- Shared or generic accounts that destroy accountability.
- Forgetting to remove old entitlements when a user changes roles.
- Granting admin rights to solve a temporary need.