Domain 5: Identity and Access Management (IAM)
The IAA chain
Identification (claim: username) → Authentication (prove it) → Authorisation (what you may do) → Accounting/Auditing (log what you did). Authorisation should follow least privilege and need to know.
Authentication factors
| Type | Something you… | Examples |
|---|---|---|
| 1 | know | password, PIN, security question |
| 2 | have | smart card, TOTP app, key, phone (SMS-OTP) |
| 3 | are | fingerprint, iris, face, retina, voice |
MFA = two DIFFERENT factor types (password + PIN is still single-factor). Tokens: HOTP (counter-based), TOTP (time-based, 30s window). Smart cards = private key on tamper-resistant chip + PIN (2 factors).
Biometric errors
| Error | Meaning | Also called |
|---|---|---|
| FRR | legitimate user rejected | Type I / false rejection |
| FAR | impostor accepted | Type II / false acceptance — usually considered worse |
CER/EER = the sensitivity setting where FRR = FAR; lower is better. Accuracy ranking (rough): retina > iris > fingerprint > hand geometry > face/voice. Also consider enrollment time, throughput, acceptance.
Kerberos (the exam's favourite protocol)
- KDC = AS + TGS; everything relies on symmetric keys shared with the KDC plus time-stamped tickets (typical lifetime 8–10 h).
- Flow: pre-auth → TGT (ticket-granting ticket) → use TGT to get a service ticket (ST) → access service. Port 88.
- Weaknesses: KDC is single point of failure; clocks must be synced; secret keys temporarily on clients; golden/silver ticket attacks forge tickets (KRBTGT account compromise).
Federation and SSO web standards
| Standard | Purpose | Shape |
|---|---|---|
| SAML 2.0 | enterprise SSO / authn+authz assertions | XML, IdP → SP |
| OAuth 2.0 | authorisation delegation (scoped access) | tokens (bearer), REST/JSON |
| OIDC | authentication layer on OAuth2 | ID token (JWT) |
Identity Provider (IdP) asserts; Service Provider (SP) consumes. IDaaS = cloud identity (e.g., Entra ID, Okta). Directory terms: forest > domain tree > domain > OU. LDAP/LDAPS (389/636) queries directories.
Access control models
| Model | Who decides | Signature idea |
|---|---|---|
| DAC | data owner | ACLs; owner passes rights on (flexible, weakest) |
| MAC | admin/security policy | labels (hierarchical, compartmented, lattice); military |
| RBAC | role assignment | rights via job roles; best for low turnover / clear structure |
| Rule / ABAC | policy engine | attributes of user, resource, environment; most granular |
| Risk-based | context | step-up MFA on odd logins |
Credential attacks and defences
- Dictionary / brute force / hybrid → lockouts, rate limits, length-first passwords, salting + slow hashes (bcrypt, PBKDF2, Argon2).
- Rainbow tables → defeated by unique salts.
- Pass-the-hash, Kerberoasting, golden ticket → PAM vaulting, tiered admin, EDR detections, rotating KRBTGT twice.
- Phishing / spear-phishing / whaling / vishing / smishing → FIDO2 phishing-resistant MFA beats OTP.
Identity lifecycle and privileged access
Provision (least privilege, approvals) → periodic access reviews → change with transfers (move = often privilege creep!) → disable on notice (grace period for return kit) → deprovision. PAM: credential vault, session recording, just-in-time elevation, no shared admin accounts, break-glass accounts audited.
Memory hooks
- FAR = Type II = impostor got in (the worse one). FRR = Type I = real user locked out.
- CER/EER = where the two curves cross; smaller = better biometric.
- Kerberos: KDC(AS+TGS) → TGT → ST; port 88; time-sensitive tickets.
- SAML = enterprise SSO; OAuth2 = authorisation delegation; OIDC = authn on OAuth2.
- MAC = labels by admin; DAC = owner's ACLs; RBAC = roles; ABAC = attributes.
Exam tips
- Password + smart-card PIN = two factors only if the PIN protects the card, not another ‘know’ item.
- ‘Phishing-resistant’ answer = FIDO2/WebAuthn or certificate-based.
- Provisioning questions: think lifecycle — leaver disablement is the most time-critical step.
- Kerberos questions: ‘single point of failure’ = KDC; ‘time skew’ = ticket validity.