Identity and access management

Identity and Access Management (IAM) is the operational core of the Confidentiality pillar. It ensures that the right individuals access the right resources, at the right times, for the right reasons. CompTIA tests these concepts through scenarios where you must choose how users authenticate, how permissions are calculated, and how highly privileged administrative accounts are tightly controlled.

1. User Lifecycle & Identity Governance

Managing the birth, movement, and retirement of identity objects inside an enterprise directory.

Provisioning vs. De-provisioning:
- Provisioning: Creating a user account, assigning a unique corporate identity, mapping email addresses, and matching initial permissions to a new hire’s job description.
- De-provisioning: The rapid, structured removal of access when an employee leaves the company. Delayed de-provisioning creates “Orphaned Accounts”, active, unmonitored profiles that attackers look to compromise.
Identity Proofing: The critical prerequisite verification phase before a credential or digital identity is issued. It involves validating a person’s real-world identity using trusted documentation (like a government passport, driver’s license, or background check).
Attestation: A formal, periodic compliance review process in which resource owners or managers explicitly audit and sign off on access lists, thereby legally certifying that the individuals who have access to a specific system still have a valid business need to be there.

2. Federation, SSO, & Directory Protocols

Federation allows identities to be shared securely across separate organizations, networks, or cloud realms, allowing users to authenticate once and access multiple disjointed services (Single Sign-On / SSO).

LDAP (Lightweight Directory Access Protocol): An industry-standard directory service protocol used to query and manage user accounts, groups, and organizational units within a local corporate infrastructure (such as Microsoft Active Directory or OpenLDAP). It typically operates over Port 389 (clear text) or Port 636 (LDAPS over TLS).
SAML (Security Assertion Markup Language): An XML-based open standard primarily used for Enterprise B2B Web SSO. It securely passes authentication and authorization data (assertions) between two distinct entities:
- Identity Provider (IdP): The central service that stores user credentials and handles login validation (e.g., Okta, Ping Identity).
- Service Provider (SP): The external application the user is trying to access (e.g., Salesforce, Zoom).
OAuth (Open Authorization): An open standard framework primarily used for API-driven token-based authorization. It allows a third-party application to act on behalf of a user without the user ever giving their password to that app (e.g., a mobile app requesting access to your Google Contacts via an active JSON Web Token).
Interoperability: The architectural capability of distinct identity systems (such as linking a legacy on-premises Windows directory with a modern cloud-native identity ecosystem) to cleanly exchange authentication tokens without breaking data formats.

3. Access Control Models

When a user attempts to open a resource, the system uses specific underlying models to determine whether to allow or deny access.

MAC (Mandatory Access Control): The most rigid model, utilized heavily in military and high-security settings. Access is based strictly on security clearances (e.g., Secret, Top Secret) and data classification labels. Users cannot modify permissions; only the central system administrator dictates access rules.
DAC (Discretionary Access Control): The most flexible model. Every file or folder has a designated Owner. The owner has absolute discretion over who has access, allowing them to modify the resource’s Access Control List (ACL) at will. (e.g., Standard Linux/Windows file systems).
Role-Based Access Control (RBAC): Permissions are tied directly to specific job functions or Roles, not individual users. Users are dropped into functional groups (e.g., Accounting_Group, HR_Group), inheriting all the permissions mapped to that role.
Rule-Based Access Control: Access is determined by system-enforced restrictions or global logic rules, regardless of the user.
- Time-of-Day Restrictions: A rule that blocks employees from logging into corporate networks outside normal working hours (e.g., denying access from 10:00 PM to 5:00 AM).
ABAC (Attribute-Based Access Control): The most dynamic model. It evaluates a context-aware matrix of Attributes in real-time to grant or deny access. It evaluates attributes across the subject, resource, and environment.
- Example: Allow access if the user is in the HR department (User Attribute), and the document is marked confidential (Resource Attribute), and they are connecting from a corporate laptop (Device Attribute) located inside the US (Environment Attribute).
Least Privilege: The core governing principle across all models: users must be restricted to the absolute bare minimum data access required to execute their immediate tasks.

4. Multi-Factor Authentication (MFA)

Authentication relies on verifying distinct categories of evidence. For security to be considered true MFA, an authentication mechanism must require factors from at least two distinct categories.

The Authentication Factors

Something You Know: Knowledge factors, such as a password, PIN, or answers to security questions. (The most vulnerable factor to social engineering).
Something You Have: Possession factors, such as a hardware token, an SMS code, an authentication app on a smartphone (soft token), or a dedicated hardware Security Key (like a YubiKey using FIDO2).
Something You Are: Inherent factors, utilizing biometrics such as fingerprints, retinal scans, facial recognition, or voice geometry.
Somewhere You Are: Geolocation factors, using GPS parameters, network IP routing, or cellular towers to verify you are physically present in an allowed zone.

5. Password Concepts & Lifecycle Management

Password Best Practices:
- Length & Complexity: Modern guidelines emphasize Length over complex character swapping. Long passphrases (e.g., correcthorsebatterystaple) are highly resilient to mathematical brute-forcing while remaining easier for humans to remember.
- Reuse / Age / Expiration: Restricting how often old passwords can be recycled and setting minimum/maximum password ages to prevent immediate rotation tricks designed to bypass history logs.
Password Managers: Centralized, highly encrypted software vaults that generate, store, and auto-fill unique, complex passwords for each distinct corporate resource, reducing users’ reliance on predictable patterns.
Passwordless Authentication: Transitioning entirely away from traditional shared secrets. It uses public-key cryptography (such as WebAuthn or Passkeys), in which the user authenticates locally on their physical device via biometrics or a security key, and the device signs a cryptographic challenge sent by the server. No password ever crosses the network wire.

6. Privileged Access Management (PAM) Tools

Administrative accounts (root, Domain Admin) are the ultimate prizes for attackers. PAM platforms isolate and strictly monitor these highly privileged credentials.

Password Vaulting: PAM systems securely lock administrative account passwords away in a centralized, highly monitored vault. When an engineer needs to perform maintenance on a critical server, they do not know the actual password; the PAM tool dynamically injects credentials or passes an active session token directly to the server on their behalf.
Just-In-Time (JIT) Permissions: Instead of an engineer holding continuous, permanent administrative rights 24/7, JIT assigns privileges dynamically. The account remains a standard low-level user until a maintenance ticket is approved. The PAM system then escalates the account’s permissions for a strict, limited window (e.g., 2 hours) and automatically strips those privileges away once the time expires.
Ephemeral Credentials: Automatically generate short-lived, single-use access keys or digital certificates that self-destruct shortly after a specific task or deployment pipeline completes, eliminating the risk of hard-coded, long-term backdoor access.