CISSP
Domain 5 · 13%
Identity and Access Management (IAM)
Who is this, is that really them, and what are they allowed to touch — and the machinery that keeps those answers correct as people join, change roles, and leave.
AAA
- Identification — claiming an identity (a username).
- Authentication — proving that claim (a password, token, biometric).
- Authorization — what the now-verified identity is permitted to do.
- Accounting/auditing — logging what was actually done, tying back to the identity (this is what makes non-repudiation enforceable in practice).
Authentication factors
- Something you know — password, PIN.
- Something you have — hardware token, smart card, phone (OTP app).
- Something you are — biometrics (fingerprint, iris, gait). Measured by FRR (False Rejection Rate, Type I), FAR (False Acceptance Rate, Type II), and the CER/EER (Crossover/Equal Error Rate) where they meet — the lower the CER, the better the sensor.
- Somewhere you are / something you do — location-based and behavioral factors, increasingly used as additional (not sole) signals.
MFA requires factors from at least two different categories — a password plus a PIN is still one factor (both "something you know").
Access control models
- DAC (Discretionary) — the resource owner sets permissions (classic filesystem ACLs). Flexible, weak central control.
- MAC (Mandatory) — a central authority sets access based on classification/clearance labels; users can't override it (maps directly to Bell-LaPadula/Biba).
- RBAC (Role-Based) — permissions attach to roles, users are assigned roles. The dominant enterprise model — simplifies onboarding/offboarding and audit.
- ABAC (Attribute-Based) — access decided dynamically from attributes of subject, object, and environment (e.g. "finance staff, from a managed device, during business hours"). The most granular, and the model zero-trust architectures lean on.
- Rule-based — static if/then rules, often layered on top of another model (e.g. firewall ACLs).
Identity lifecycle
Provisioning (account creation, tied to HR onboarding) → access reviews/recertification (periodic, catches privilege creep) → modification (role change should trigger both grants and revocations) → deprovisioning (must be prompt on termination — a classic audit finding is orphaned accounts from employees who left months ago). Privilege creep is the accumulation of unneeded access as someone changes roles without old access being revoked; periodic entitlement review is the control that catches it.
Federation and modern auth
- SSO — one authentication event grants access across multiple systems. Improves usability and reduces password fatigue, but raises the blast radius of a single compromised credential.
- SAML — XML-based, common for enterprise SSO to web apps; roles are Identity Provider (IdP) and Service Provider (SP).
- OAuth 2.0 — authorization framework (delegates access to a resource, e.g. "let App X read my calendar") — not itself an authentication protocol.
- OpenID Connect (OIDC) — an authentication layer built on top of OAuth 2.0; this is the piece that actually answers "who is this user."
- Kerberos — ticket-based authentication (KDC issues a TGT, then service tickets); vulnerable if the KDC is compromised (single point of failure) and to replay if clocks drift too far.
Privileged access management
Admin/root accounts get extra controls beyond normal IAM: just-in-time elevation instead of standing privilege, session recording, credential vaulting/rotation, and separate break-glass emergency accounts — because a compromised privileged account is the fastest path to full domain compromise.