Identity Security
Identity Security tests how authentication, authorization, and identity governance controls are configured and attacked. The exam expects you to separate proving who a user is from deciding what that user may do, and to recognize identity as the primary lateral-movement path.
Core rules
- Authentication establishes identity: passwords, MFA, passkeys, and federation through an identity provider. Authorization decides access: roles, groups, and policy.
- SSO via SAML or OIDC centralizes authentication; conditional access adds device, location, and risk signals. MFA alone does not fix an over-privileged role.
- Least privilege applies to humans, service accounts, and machine identities. Orphaned accounts and unused keys are standing risk.
- Session tokens are credentials. Theft of a valid token can bypass MFA, so revocation and short session lifetimes matter.
- Identity threat detection looks for impossible travel, MFA fatigue, password spraying, token replay, and privilege escalation.
Worked example
A user signs in successfully with MFA, then a session is used from a distant country minutes later. The correct interpretation is token theft or session hijack, not a second legitimate login. Response: revoke sessions and refresh tokens, force re-authentication, review the identity provider sign-in logs, and check what the session accessed. Reasoning: MFA was satisfied once; the risk now lives in the session, so revoking the token is the control that actually stops the attacker.
Traps
Treating successful MFA as proof the session is safe. Confusing authentication with authorization. Ignoring service accounts and API keys. Forgetting that group nesting grants effective privilege. Assuming an IdP policy covers apps that bypass SSO.