CoreQ Academy4.6 Given a scenario, implement and maintain identity and access management.
Identity is the new perimeter. Getting accounts, permissions, federation and MFA right prevents most account-takeover attacks.
Account life cycle
- Provisioning/de-provisioning user accounts
- Create accounts with the right access when people join; remove access promptly when they move or leave.
- Permission assignments and implications
- Every permission granted widens what a compromised account can do; review regularly to avoid privilege creep.
- Identity proofing
- Verifying a person's real identity before issuing credentials (ID documents, in-person checks).
Federation and SSO
- Federation
- Trusting identities from another organisation or identity provider, so users log in with one identity across domains.
- Single sign-on (SSO)
- One authentication grants access to many applications.
- Lightweight Directory Access Protocol (LDAP)
- Protocol for querying and managing directory services (users, groups). Use LDAPS for encryption.
- Open authorization (OAuth)
- Authorisation framework letting apps access resources on a user's behalf using tokens, without sharing passwords. OpenID Connect adds authentication on top.
- Security Assertions Markup Language (SAML)
- XML-based standard for exchanging authentication assertions between an identity provider and a service provider; common for enterprise SSO.
- Interoperability
- Systems using common standards so identities work across platforms.
- Attestation
- Formal confirmation that access is appropriate (periodic access reviews), or that a device is in a trusted state.
Access controls
- Mandatory
- Access set by labels and clearances enforced by the system; users cannot change it. Used in government and SELinux.
- Discretionary
- The owner decides who can access their resources (typical file permissions).
- Role-based
- Permissions assigned to roles; users get roles based on job function.
- Rule-based
- Access governed by system rules, such as firewall rules or "no access after 6 p.m."
- Attribute-based
- Decisions based on attributes of user, resource and context (department, location, device).
- Time-of-day restrictions
- Access only allowed during defined hours.
- Least privilege
- Minimum access needed, for the minimum time.
Multifactor authentication
- Biometrics
- Fingerprint, face, iris. Convenient, but cannot be changed if compromised; watch false acceptance and false rejection rates.
- Hard/soft authentication tokens
- Hardware fobs or apps generating one-time codes (TOTP/HOTP).
- Security keys
- Hardware devices (FIDO2/WebAuthn) using public-key crypto; resistant to phishing.
- Something you know
- A knowledge factor such as a password, PIN or passphrase.
- Something you have
- Phone, token, smart card, security key.
- Something you are
- An inherence factor: fingerprint, face or other biometric trait.
- Somewhere you are
- Location, such as GPS or IP geolocation.
Password concepts
- Length
- The most important factor; longer passphrases are much harder to crack.
- Complexity
- Mixing character types; less valuable than length and can lead to predictable patterns.
- Reuse
- Prevent reuse of old passwords and across sites to limit credential stuffing.
- Expiration
- Forced change after a period. Current guidance (NIST) favours changing only on evidence of compromise.
- Age
- Minimum age prevents users cycling through changes to reuse an old password.
- Password managers
- Generate and store unique strong passwords.
- Passwordless
- Authentication without passwords, using passkeys, biometrics or security keys.
Privileged access management tools
- Just-in-time permissions
- Admin rights granted only when needed and removed automatically after.
- Password vaulting
- Privileged credentials stored in a secure vault, checked out with approval and logged, often rotated after use.
- Ephemeral credentials
- Short-lived credentials that expire automatically, limiting the value of theft.
Check your understanding
Knowledge quiz · pass mark 80%
- Access granted based on department, device type and location is:
- Admin rights that are granted for one hour and then removed are:
- A smart card plus a PIN combines which factors?
- Which MFA method best resists phishing?
- When an employee leaves, their access should be removed promptly as part of de-provisioning.
- Which XML-based standard is common for enterprise web SSO?
Original CoreQ Academy material, mapped to objective 4.6 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.