This comprehensive guide covers identity and access management (IAM) implementation and maintenance, including user provisioning, authentication methods, access controls, multifactor authentication, password management, and privileged access management essential for Security+ certification.
User Account Lifecycle Management
Provisioning User Accounts
User provisioning is the process of creating and setting up user accounts with appropriate access rights:
- Account Creation: Establish new user accounts with unique identifiers
- Role Assignment: Assign appropriate roles based on job function
- Resource Allocation: Provision access to necessary systems and applications
- Documentation: Maintain records of user access and permissions
- Approval Workflow: Implement approval processes for account creation
- Automated Provisioning: Use tools to streamline the provisioning process
De-provisioning User Accounts
De-provisioning ensures proper removal of access when users leave or change roles:
- Immediate Disable: Disable accounts immediately upon termination
- Access Revocation: Remove all system and application access
- Data Transfer: Transfer ownership of critical data and resources
- Account Deletion: Permanently delete accounts after retention period
- Audit Trail: Maintain records of de-provisioning activities
- Exit Interviews: Conduct security-focused exit interviews
Permission Assignments and Implications
Understanding the implications of permission assignments is crucial for security:
- Principle of Least Privilege: Grant minimum necessary permissions
- Separation of Duties: Prevent single users from having conflicting permissions
- Permission Inheritance: Understand how permissions are inherited in hierarchies
- Implicit Permissions: Consider permissions granted through group membership
- Permission Auditing: Regularly review and validate user permissions
- Risk Assessment: Evaluate security risks of permission assignments
Identity Proofing
Identity proofing verifies that users are who they claim to be:
- Document Verification: Verify government-issued identification documents
- Knowledge-based Authentication: Ask questions only the real person would know
- Biometric Verification: Use fingerprints, facial recognition, or other biometrics
- Credit Bureau Checks: Verify identity through credit reporting agencies
- Social Media Analysis: Analyze social media presence for consistency
- Video Verification: Conduct live video calls for identity verification
Federation
Federation enables secure sharing of identity information across different organizations:
- Trust Relationships: Establish trust between identity providers and service providers
- Identity Providers (IdP): Organizations that authenticate users
- Service Providers (SP): Organizations that provide services to users
- Federation Protocols: Use standardized protocols like SAML, OAuth, OpenID Connect
- Attribute Exchange: Share user attributes between organizations
- Trust Boundaries: Define and enforce trust boundaries
Single Sign-On (SSO)
Lightweight Directory Access Protocol (LDAP)
LDAP provides directory services for user authentication and authorization:
- Directory Structure: Hierarchical organization of user and group information
- Authentication: Bind operations for user authentication
- Authorization: Group membership and attribute-based access control
- LDAP over SSL/TLS: Secure LDAP communications
- Active Directory: Microsoft's implementation of LDAP
- OpenLDAP: Open-source LDAP implementation
Open Authorization (OAuth)
OAuth enables secure authorization for third-party applications:
- OAuth 2.0: Current standard for authorization delegation
- Authorization Server: Issues access tokens after user consent
- Resource Server: Hosts protected resources
- Client Application: Requests access to protected resources
- Access Tokens: Bearer tokens for API access
- Refresh Tokens: Long-lived tokens for obtaining new access tokens
Security Assertions Markup Language (SAML)
SAML provides XML-based authentication and authorization data exchange:
- SAML Assertions: XML documents containing authentication and authorization information
- Identity Provider (IdP): Authenticates users and issues SAML assertions
- Service Provider (SP): Consumes SAML assertions for access decisions
- SAML Bindings: HTTP POST, HTTP Redirect, SOAP bindings
- Digital Signatures: Cryptographic signing of SAML assertions
- SAML Metadata: XML documents describing SAML entities
Interoperability
Interoperability ensures IAM systems work together effectively:
- Standards Compliance: Adhere to industry standards (SAML, OAuth, OpenID Connect)
- Protocol Support: Support multiple authentication and authorization protocols
- API Integration: Provide APIs for system integration
- Data Format Compatibility: Support common data formats (JSON, XML)
- Cross-platform Support: Work across different operating systems and platforms
- Vendor Neutrality: Avoid vendor lock-in through open standards
Attestation
Attestation provides verification of system and user compliance:
- Compliance Attestation: Verify adherence to security policies and regulations
- Access Review: Regular review and certification of user access
- System Attestation: Verify system configuration and security posture
- Audit Trails: Maintain comprehensive logs of attestation activities
- Remediation: Address identified compliance issues
- Reporting: Generate attestation reports for stakeholders
Access Controls
Mandatory Access Control (MAC)
MAC enforces system-wide security policies that cannot be overridden by users:
- Security Labels: Assign security classifications to subjects and objects
- Bell-LaPadula Model: No read up, no write down
- Biba Model: No read down, no write up
- System Enforcement: Operating system enforces access decisions
- Government/Military Use: Common in high-security environments
- SELinux: Linux implementation of MAC
Discretionary Access Control (DAC)
DAC allows resource owners to control access to their resources:
- Owner Control: Resource owners determine access permissions
- Access Control Lists (ACLs): Lists of users and their permissions
- User Discretion: Users can grant or revoke access
- Flexibility: Easy to implement and manage
- Security Risk: Potential for privilege escalation
- Common Implementation: Standard file system permissions
Role-Based Access Control (RBAC)
RBAC assigns permissions based on user roles within the organization:
- Role Definition: Define roles based on job functions
- Permission Assignment: Assign permissions to roles, not individual users
- User-Role Assignment: Assign users to appropriate roles
- Hierarchical Roles: Support role inheritance and hierarchies
- Separation of Duties: Prevent conflicting permissions within roles
- Scalability: Easily manage large numbers of users
Rule-Based Access Control
Rule-based access control uses predefined rules to make access decisions:
- Conditional Rules: Access based on specific conditions
- Time-based Rules: Access allowed only during certain times
- Location-based Rules: Access based on user location
- Device-based Rules: Access based on device characteristics
- Context-aware Rules: Consider multiple factors for access decisions
- Dynamic Enforcement: Rules evaluated in real-time
Attribute-Based Access Control (ABAC)
ABAC makes access decisions based on attributes of subjects, objects, and environment:
- Subject Attributes: User characteristics (role, department, clearance level)
- Object Attributes: Resource characteristics (classification, owner, sensitivity)
- Environment Attributes: Context (time, location, network, device)
- Policy Engine: Centralized policy evaluation
- Fine-grained Control: Highly granular access decisions
- XACML: eXtensible Access Control Markup Language standard
Time-of-Day Restrictions
Time-based access controls limit access to specific time periods:
- Business Hours: Restrict access to normal business hours
- Maintenance Windows: Allow access during scheduled maintenance
- Emergency Access: Provide after-hours access for emergencies
- Time Zone Considerations: Account for different time zones
- Holiday Schedules: Adjust access for holidays and special events
- Session Timeouts: Automatically terminate inactive sessions
Least Privilege
Least privilege ensures users have only the minimum access necessary:
- Minimal Permissions: Grant only required permissions
- Regular Reviews: Periodically review and reduce permissions
- Just-in-Time Access: Provide temporary access when needed
- Privilege Escalation: Temporary elevation for specific tasks
- Default Deny: Deny access by default, grant explicitly
- Segregation of Duties: Prevent single users from having excessive privileges
Multifactor Authentication (MFA)
Authentication Factors
Something You Know
- Passwords: Traditional text-based passwords
- PINs: Numeric personal identification numbers
- Passphrases: Longer, more secure text-based authentication
- Security Questions: Personal questions for account recovery
- Patterns: Visual or gesture-based patterns
Something You Have
- Hardware Tokens: Physical devices that generate codes
- Smart Cards: Chip-based authentication cards
- Mobile Devices: Smartphones for SMS or app-based authentication
- USB Security Keys: FIDO2/WebAuthn compatible devices
- Software Tokens: Applications that generate time-based codes
Something You Are
- Fingerprint Recognition: Unique fingerprint patterns
- Facial Recognition: Biometric facial analysis
- Iris Scanning: Unique iris pattern recognition
- Voice Recognition: Voice pattern authentication
- Retina Scanning: Blood vessel pattern in the eye
- Palm Print: Unique palm print characteristics
Somewhere You Are
- Geolocation: GPS-based location verification
- IP Address: Network location verification
- WiFi Networks: Known network verification
- Cell Tower Triangulation: Mobile network location
- Geofencing: Virtual geographic boundaries
MFA Implementations
Biometrics
- Accuracy Requirements: Balance false acceptance and false rejection rates
- Template Storage: Secure storage of biometric templates
- Liveness Detection: Prevent spoofing with fake biometrics
- Privacy Considerations: Protect biometric data privacy
- Fallback Methods: Alternative authentication when biometrics fail
- Multi-modal Biometrics: Combine multiple biometric factors
Hard/Soft Authentication Tokens
- Hardware Tokens: Physical devices (RSA SecurID, YubiKey)
- Software Tokens: Mobile apps (Google Authenticator, Microsoft Authenticator)
- Time-based Codes: TOTP (Time-based One-Time Password)
- Counter-based Codes: HOTP (HMAC-based One-Time Password)
- Push Notifications: Server-initiated authentication requests
- QR Code Generation: Easy token setup via QR codes
Security Keys
- FIDO2/WebAuthn: Modern web authentication standard
- USB-A/USB-C: Physical connection to devices
- NFC Support: Near-field communication for mobile devices
- Bluetooth: Wireless connection to mobile devices
- Phishing Resistance: Built-in protection against phishing attacks
- Passwordless Authentication: Eliminate need for passwords
Password Management
Password Best Practices
Length
- Minimum Length: At least 12-16 characters
- Maximum Length: Reasonable limits to prevent DoS attacks
- Variable Length: Allow different lengths for different systems
- Entropy Considerations: Longer passwords provide more security
Complexity
- Character Variety: Mix uppercase, lowercase, numbers, symbols
- Avoid Patterns: Prevent common patterns and sequences
- Dictionary Words: Avoid common dictionary words
- Personal Information: Prohibit use of personal information
- Keyboard Patterns: Avoid common keyboard patterns
Reuse
- Password History: Prevent reuse of recent passwords
- Cross-System Reuse: Discourage reuse across different systems
- Account Compromise: Change passwords after security incidents
- Unique Passwords: Encourage unique passwords for each account
Expiration
- Regular Rotation: Change passwords at regular intervals
- Risk-based Expiration: Shorter expiration for high-risk accounts
- Event-based Expiration: Change passwords after security events
- Grace Periods: Allow time for password changes
Age
- Maximum Age: Set maximum password age limits
- Minimum Age: Prevent immediate password changes
- Account Age: Consider account creation date
- Last Change Tracking: Monitor when passwords were last changed
Password Managers
Password managers help users create and manage strong, unique passwords:
- Password Generation: Create strong, random passwords
- Secure Storage: Encrypted storage of passwords
- Auto-fill: Automatically fill login forms
- Cross-device Sync: Synchronize passwords across devices
- Breach Monitoring: Alert users to compromised passwords
- Sharing Features: Securely share passwords with team members
Passwordless Authentication
Passwordless authentication eliminates the need for traditional passwords:
- Biometric Authentication: Use fingerprints, facial recognition, etc.
- Security Keys: FIDO2/WebAuthn compatible devices
- Mobile Authentication: SMS or app-based authentication
- Magic Links: Email-based authentication links
- Certificate-based: Digital certificates for authentication
- Risk Assessment: Consider security implications of passwordless methods
Privileged Access Management (PAM)
Just-in-Time Permissions
Just-in-time (JIT) access provides temporary elevated permissions when needed:
- Temporary Elevation: Grant elevated permissions for specific time periods
- Approval Workflows: Require approval before granting access
- Automatic Revocation: Automatically remove permissions after time expires
- Session Recording: Record privileged sessions for audit
- Risk Assessment: Evaluate risk before granting access
- Emergency Access: Provide emergency access procedures
Password Vaulting
Password vaulting securely stores and manages privileged account passwords:
- Centralized Storage: Store all privileged passwords in one location
- Encryption: Strong encryption for stored passwords
- Access Control: Strict controls on who can access passwords
- Password Rotation: Automatically rotate passwords regularly
- Audit Logging: Log all password access and usage
- High Availability: Ensure vault is always available
Ephemeral Credentials
Ephemeral credentials are temporary credentials that expire quickly:
- Short Lifespan: Credentials expire within minutes or hours
- Dynamic Generation: Generate credentials on-demand
- Single Use: Credentials can only be used once
- Scope Limitation: Limited to specific resources or actions
- Automatic Cleanup: Automatically revoke expired credentials
- Zero Standing Privileges: No permanent elevated access
Implementation Best Practices
Identity Lifecycle Management
- Automated Provisioning: Automate user account creation and management
- Role-based Provisioning: Provision access based on user roles
- Regular Reviews: Periodically review and update user access
- Offboarding Process: Comprehensive process for user departure
- Audit Trails: Maintain detailed logs of all identity activities
Authentication Security
- Multi-factor Authentication: Implement MFA for all privileged accounts
- Strong Password Policies: Enforce strong password requirements
- Account Lockout: Implement account lockout after failed attempts
- Session Management: Proper session timeout and management
- Risk-based Authentication: Adjust authentication based on risk factors
Access Control Implementation
- Principle of Least Privilege: Grant minimum necessary access
- Separation of Duties: Prevent conflicts of interest
- Regular Access Reviews: Periodically review and validate access
- Privileged Access Management: Special controls for privileged accounts
- Monitoring and Alerting: Monitor for unusual access patterns
Common Scenarios and Solutions
Scenario 1: New Employee Onboarding
Challenge: Provision access for a new employee with appropriate permissions.
Solution:
- Create user account with unique identifier
- Assign role based on job function
- Provision access to required systems and applications
- Set up MFA for the new account
- Provide security training and password manager
- Schedule access review after probationary period
Scenario 2: Employee Departure
Challenge: Properly de-provision access when an employee leaves.
Solution:
- Immediately disable all user accounts
- Revoke access to all systems and applications
- Transfer ownership of critical data and resources
- Collect and secure company devices
- Conduct exit interview focusing on security
- Schedule account deletion after retention period
Scenario 3: Privileged Access Management
Challenge: Secure access to administrative accounts and systems.
Solution:
- Implement password vaulting for all privileged accounts
- Use just-in-time access for temporary elevated permissions
- Require MFA for all privileged access
- Record all privileged sessions for audit
- Implement ephemeral credentials where possible
- Regular review of privileged access assignments
Key Takeaways for Security+ Exam
- Understand the complete user account lifecycle from provisioning to de-provisioning
- Know the different types of access control models and their characteristics
- Comprehend the various authentication factors and MFA implementations
- Understand federation protocols like SAML, OAuth, and LDAP
- Know password best practices and passwordless authentication methods
- Understand privileged access management and its components
- Know how to implement and maintain identity and access management systems
- Understand the importance of regular access reviews and attestation