CCSK · Domain 6
Identity and Access Management
About 12% of the exam
Federation vocabulary
- Identity provider
- authenticates and issues the assertion
- Relying party
- consumes and trusts the assertion
- Assertion
- signed statement about the user
- Federation
- trust between separate identity domains
- Broker
- hub translating between many parties
- Attribute
- a fact about the subject
- Entitlement
- permission granted to an identity
- Provisioning
- creating accounts in the target
Federation moves authentication home but leaves authorization at the service, so the provider still decides what you may do
Protocols
- SAML
- signed assertions for browser federation
- OAuth 2.0
- delegated authorization, not authentication
- OpenID Connect
- identity layer on top of OAuth
- SCIM
- provisioning and deprovisioning accounts
- Proof key exchange
- binds the code to the client
- Token introspection
- server confirms a token is live
- Rich authorization requests
- fine grained detail in the request
- Relationship checks
- access follows a stored relationship
Assertion and token safety
- Validate signature, issuer and audience
- Honor the not-after condition
- One time identifiers stop assertion replay
- Short lifetimes limit stolen tokens
- Bind the token to the client
- Hash claims tie code and token
- Never accept an unsigned assertion
Authentication strength
- Phishing resistant factors beat one-time codes
- Step up when the risk rises
- Request a stronger context explicitly
- Passwordless reduces credential reuse
- Risk signals feed the decision
- Multi-party approval for the rarest actions
Authorization models
- Role based
- permissions grouped into roles
- Attribute based
- policy evaluates subject and resource
- Relationship based
- access follows a defined relationship
- Decision point
- makes the allow or deny
- Enforcement point
- applies the decision at runtime
- Information point
- supplies the attribute values
- Scopes
- coarse limit on the application
- Fine grained policy
- decides on the individual resource
Entitlement architecture
Design
- Externalize the decision from code
- Central policy, distributed enforcement
- Version policies like source code
Least privilege
- Grant the narrowest useful scope
- Separate duties across identities
- Time bound instead of standing
Review
- Recertify entitlements on a cadence
- No response means revoke
- An unused entitlement is a finding
Privileged access
The problem
- One admin credential reaches everything
- The management plane has no physical limit
- Standing access invites credential theft
Controls
- Just in time elevation with approval
- Session recording for privileged work
- Break glass accounts monitored closely
Signals
- Alert on every elevation
- Unusual location or device
- Elevation outside a change window
Workload and machine identity
- Workload federation replaces long-lived keys
- External token exchanged for cloud credentials
- Certificate identity for on-premises hosts
- Short lived credentials issued per session
- Key creation blocked by central policy
- Impersonation chains must be logged
Identity lifecycle
- Joiner, mover and leaver drive access
- An attribute change should retitle access
- Deprovisioning must happen immediately
- Guest accounts expire by default
- Access packages bundle related entitlements
- Reconciliation finds orphaned accounts
Continuous evaluation
- Sessions revalidated when conditions change
- A password change should end sessions
- Risk detection can force reauthentication
- Device posture checked at each request
- Network change triggers reevaluation
- Long tokens without revocation are dangerous
Identity failures
- Assertion accepted without an audience check
- Refresh token valid after account disable
- Service account keys shared between teams
- Guest access never reviewed
- Emergency account with no monitoring
- Roles that accumulate over years
Know the order
- Authenticate
- Evaluate risk
- Authorize
- Enforce
- Reevaluate
Authentication proves who, authorization decides what, and continuous evaluation checks that both of them still hold
Rapid recall: identity picks
- Browser single sign-on
- SAML federation
- Delegated interface access
- OAuth scopes
- Identity claims for apps
- OpenID Connect
- Automatic account creation
- SCIM provisioning
- Pipeline needs cloud credentials
- workload identity federation
- No standing admin rights
- just in time elevation
- Revoke on password change
- continuous access evaluation
- Access follows a relationship
- relationship based access control
Reference strip: protocols, authentication, authorization, privilege, lifecycle
Protocols
- SAML for browser federation
- OAuth for delegated authorization
- OpenID Connect for identity
- SCIM for provisioning
Authentication
- Phishing resistant factors
- Step up on risk
- Short token lifetimes
- Token bound to the client
Authorization
- Roles, attributes, relationships
- Decision separated from enforcement
- Scopes are coarse only
- Policy versioned as code
Privilege
- Just in time elevation
- Approval and justification recorded
- Session recording where needed
- Break glass under monitoring
Lifecycle
- Joiner, mover and leaver
- Recertification on a cadence
- Deprovision without delay
- Orphan reconciliation regularly
Quick exam traps
- Trap: OAuth 2.0 is an authentication protocol
- Trap: Deleting a user in the directory ends every issued token
- Trap: A signed assertion is safe to accept without checking the audience
- Trap: Federation moves authorization to the identity provider
- Trap: Service account keys are safer than user passwords
- Trap: Multi-factor authentication makes a standing admin role acceptable
- Trap: An entitlement nobody reviewed should be left in place
cybercertprep.com · original revision sheet written from the public body of knowledge