CISSP · Domain 5
Identity and Access Management
About 13% of the exam
The IAAA chain
- Identification
- Authentication
- Authorization
- Accountability
- Identification claims who you are
- Authentication proves the claim
- Authorization decides what you may do
- Accountability logs who did what
- Nonrepudiation: cannot deny the action
Claim, prove, permit, record: the exam tests where each step ends and the next begins
Authentication factors
- Something you know
- password, PIN, passphrase
- Something you have
- smart card, token, phone
- Something you are
- fingerprint, iris, face
- Somewhere you are
- location, often a risk signal
- Something you do
- typing rhythm, gait, signature
- Multifactor
- two different categories, not two knows
- TOTP, HOTP
- time-based, counter-based codes
- FIDO2, passkeys
- device private key, server public key
- Push fatigue
- spam prompts until one is approved
Biometrics
- Type I error
- false reject, FRR, annoys users
- Type II error
- false accept, FAR, security failure
- CER or EER
- where FAR meets FRR, lower is better
- Enrollment
- capture the reference template
- Throughput
- people processed per minute
- Iris
- accurate, contactless, stable for life
- Retina
- very accurate, intrusive, reveals health
- Multimodal
- two traits cut both error rates
Type I turns away the right person; Type II lets in the wrong one. Tighten sensitivity and FRR rises while FAR falls
Credential hygiene
- Length beats complexity rules
- Screen against breached password lists
- No forced periodic rotation without cause
- Store with salted slow hashes: bcrypt, Argon2, PBKDF2
- Never store reversibly encrypted passwords
- Throttle and lock out brute force
- Vault privileged and service account secrets
- Rotate service credentials, they rot silently
- Session timeout for idle users
Access control models
Discretionary (DAC)
- Resource owner decides, not the admin
- ACLs on files and folders
- Flexible, sprawls, hard to audit
- Default in Windows, Linux file systems
Mandatory (MAC)
- System enforces labels and clearances
- Lattice of sensitivity levels and compartments
- Users cannot share at will
- Military, SELinux, high assurance
Role, attribute, rule
- RBAC: permissions bound to job roles
- Role mining can codify old excess
- ABAC: subject, object, environment attributes
- XACML expresses ABAC policies
- Rule-based: firewall style if-then
- Risk-adaptive: tighten as context worsens
Ask who decides: the owner (DAC), the system by label (MAC), the role (RBAC), or the policy over attributes (ABAC)
Identity lifecycle
- Provision
- Review and recertify
- Modify on move
- Deprovision on leave
- Joiner, mover, leaver: JML events
- HR record drives automated provisioning
- Movers accumulate rights: privilege creep
- Periodic attestation by the manager
- Orphan accounts: no living owner
- Disable first, delete after retention
- IGA platforms flag SoD violations
Privileged access management
- Separate admin account from daily account
- Vault credentials, check out, auto rotate
- Record and monitor privileged sessions
- Just in time access, automatic expiry
- Zero standing privilege as the goal
- Break-glass account for emergencies, sealed and audited
- Service accounts: no human, broad rights, stale secrets
- SUID binaries run as the file owner
- Nested groups hide escalation paths
Kerberos
- Client asks AS for a TGT
- KDC returns TGT, encrypted
- Client shows TGT to TGS
- TGS issues service ticket
- Client presents ticket to service
- KDC
- AS plus TGS, holds all keys
- Symmetric only
- secret keys, no PKI needed
- Clock skew
- five minutes, else tickets fail
- Golden ticket
- forged TGT from krbtgt hash
- Silver ticket
- forged service ticket
- Kerberoasting
- request SPN tickets, crack offline
Federation: SAML vs OAuth vs OIDC
SAML 2.0
- XML assertions, signed by the IdP
- Identity provider and service provider
- Enterprise browser SSO
- Authentication and attributes
- Signed, often encrypted
OAuth 2.0
- Delegated authorization, not authentication
- Access token with scopes
- Resource owner, client, authorization server
- Grants: authorization code with PKCE
- Lets an app act on your behalf
OpenID Connect
- Identity layer on top of OAuth 2.0
- ID token is a signed JWT
- Consumer and mobile sign in
- Relying party trusts the provider
- Answers who the user is
SAML for the enterprise browser, OAuth to delegate access, OIDC to prove identity; SCIM provisions accounts across them all
Directories and network AAA
- LDAP
- directory query, 389 plain, 636 TLS
- Active Directory
- domain identity, Kerberos, group policy
- Group Policy
- settings pushed via containers
- RADIUS
- UDP, encrypts password field only
- TACACS+
- TCP 49, whole payload, AAA split
- Diameter
- RADIUS successor, telecom
- 802.1X
- supplicant, authenticator, auth server
- IDaaS
- cloud-hosted identity provider
- SSO risk
- one key opens every door
Attacks on identity
- Credential stuffing
- breached pairs replayed elsewhere
- Password spraying
- one password, many accounts
- Brute force
- many passwords, one account
- Rainbow table
- precomputed hashes, beaten by salt
- Pass the hash
- reuse NTLM hash, no cracking
- Pass the ticket
- reuse stolen Kerberos ticket
- MFA fatigue
- flood prompts until approval
- Session fixation
- attacker sets the session ID first
- Privilege escalation
- nested groups, SUID, misconfig
- Phishing
- still the top credential thief
Authorization mechanisms
- Complete mediation: revoke mid-session must bite
- Re-authenticate for sensitive actions
- Policy decision point evaluates, enforcement point applies
- Capability tokens carry the permission
- Macaroons attenuate: holder narrows, never widens
- Delegation with time-limited scope
- Constrained interfaces hide what you cannot use
- Content and context dependent controls
- SDP hides resources until authorized
Rapid recall: federation words
- IdP
- authenticates and asserts identity
- SP or RP
- consumes the assertion
- Assertion
- signed statement about a user
- Claim
- one attribute inside a token
- JWT
- signed JSON token, header.payload.signature
- Scope
- what an access token may do
- SCIM
- cross-domain account provisioning
- SPN
- service name Kerberos tickets target
- Trust
- one-way or two-way between domains
Key numbers and levels
- Kerberos
- port 88, 5 minute skew
- LDAP, LDAPS
- 389, 636
- RADIUS
- 1812 auth, 1813 accounting
- TACACS+
- TCP 49
- NIST 800-63
- IAL, AAL, FAL levels 1 to 3
- AAL3
- hardware authenticator, phishing resistant
- Password minimum
- 8 chosen, 6 if system generated
Something you know twice is still one factor; add a possession or inherence factor to call it MFA
Reference strip: standards, models, attacks
Standards
- NIST SP 800-63 digital identity
- SAML 2.0, OAuth 2.0, OpenID Connect
- FIDO2, WebAuthn passwordless
- SCIM provisioning, LDAP X.500 roots
- X.509 certificates for smart cards
Protocols
- Kerberos, NTLM (legacy), LDAP
- RADIUS, TACACS+, Diameter
- 802.1X with EAP-TLS or PEAP
- TOTP RFC 6238, HOTP RFC 4226
Models
- DAC, MAC, RBAC, ABAC, rule-based
- Risk-adaptive access control
- Lattice-based for MAC labels
- Access control matrix, ACL by column, capability by row
Attacks to name
- Golden ticket, silver ticket, Kerberoasting
- Pass the hash, pass the ticket
- Credential stuffing, spraying, MFA fatigue
- Session hijack, session fixation
- Privilege escalation via nesting or SUID
Cloud identity terms
- IDaaS, IGA, PAM, CIEM
- JIT access, zero standing privilege
- SDP, SASE, CASB
- Break-glass, service principal, managed identity
Quick exam traps
- Trap: A password plus a PIN is multifactor
- Trap: OAuth authenticates the user
- Trap: False rejection is the more dangerous biometric error
- Trap: In DAC the administrator owns the data
- Trap: Forced 30-day password rotation is best practice
- Trap: Kerberos relies on public key cryptography
- Trap: Role mining automatically removes excessive permissions
- Trap: SSO eliminates the single point of failure
cybercertprep.com · original revision sheet written from the public body of knowledge