Identity and Access Management (IAM): Systems and processes used to manage access to information in an organization to ensure that the right individuals have access to the right resources at the right times for the right reasons.
Four Main Processes
Identification: Process where a user claims a unique identity to a system (e.g., a username or email).
Authentication: Process of verifying the identity of a user/device/system.
Authorization: Process that determines user’s access permissions/level.
Accounting/Auditing: Involving monitoring and recording user actions for compliance and security records.
Other Concepts
Provisioning: Process of creating new user accounts, assigning them appropriate permissions and providing users with access to systems.
Deprovisioning: Process of removing an individual’s access rights when the rights are no longer required.
Identity Proofing: Process of verifying identity of a user before the account is created.
Interoperability: Ability of different systems/devices/applications to work together and share information.
Attestation: Process of validating that user accounts and access rights are correct and up-to-date.
Multifactor Authentication
Security system that requires more than one method of authentication from independent categories of credentials to verify user’s identity.
Types of Factors:
Knowledge-based Factor: Information user must provide to authenticate their identity.
Behavior-based Factor: Recognizing patterns associated with a user (e.g., keystroke patterns, mouse movement, gait).
Passkeys
Users can create and access online accounts without needing to input a password. Passkeys are asymmetric (public key and private key) and allow for passwordless Multi-Factor Authentication that is convenient for users.
Password Security
Measures the password’s ability to resist guessing and brute-force attacks.
Password Length: Use 12—16 characters for better security.
Password Complexity: Mix uppercase, lowercase, numbers, and symbols.
Password Reuse: Using same password increases risk.
Password Age: Length of time a password has been in use.
Password Managers: Store, generate, and autofill passwords to enhance security.
Passwordless Authentication: Provides improved security and user experience.
Password Attacks
Brute Force: Trying every possible combination of characters until the correct password is found.
Dictionary Attack: Uses a dictionary of common passwords.
Password Spraying: Brute force that tries a small number of common passwords against a large number of accounts.
Hybrid: Blends brute force and dictionary.
Single Sign-On
Authentication process that allows user to access multiple applications by logging in only once with a single set of credentials.
Identity Provider (IdP): System that creates, maintains, and manages identity information for principals11. Principals: The users/devices logging in. while providing authentication services to relying applications22. Relying Applications: The external services trusting the IdP. within a federation33. Federation: A trust agreement between multiple distinct organizations. or distributed network.
Lightweight Directory Access Protocol (LDAP): Used to access and maintain distributed directory information services over an Internet protocol network.
LDAPS: LDAP over SSL.
Open Authorization (OAuth): Open standard for token-based authentication and authorization that allows an individuals account information to be used by third party services without exposing the users password.
Security Assertion Markup Language (SAML): Standard for logging users into applications based on their sessions in another context.
Federation
Process that allows for linking of electronic identities and attributes to store information across multiple distinct identity management systems. Works by using trust relationships that exist between different systems.
Privilege Access management (PAM)
Policies, procedures, and technical controls that are used to prevent malicious abuse of privileged access.
Three Key Components:
Just-In-Time Permissions: Security model where administrative access is granted only when needed for a specific period.
Password Vaulting: Store and manage passwords in a security environment.
Temporal Accounts: Used to provide time-limited access to resources.
Access Control Models
Mandatory Access Control (MAC): Employs security labels to authorize user access to specific resources.
Discretionary Access Control (DAC): Resource’s owner determines which users can access a resource.
Role-Based Access Control (RBAC): Administrator assigns users to roles and uses these roles to grant permissions to resources.
Rule-Based Access Control (RuBAC): Enables administrators to apply security policies to all users based on specified conditions or rules.
Attribute-Based Access Control (ABAC): Uses object characteristics for access control decisions.
Assigning Permissions
Principle of Least Privilege
User should only have minimum access rights to perform their job functions and tasks, and nothing additional or extra.
User Account Control (UAC)
Mechanism designed to ensure actions requiring administrative rights are explicitly authorized by the user to minimize risk of unauthorized changes.