CoreQ Academy2.4 Given a scenario, apply security concepts to the design of access, authentication, and authorization systems.
Identity architecture decides how people and systems get credentials, how trust is federated, how access decisions are made and how PKI underpins it all.
Provisioning and federation
- Provisioning/deprovisioning
- Automated account creation and removal tied to HR and app life cycles (e.g. SCIM).
- Credential issuance
- Securely issuing initial credentials, tokens or certificates.
- Self-provisioning
- Users request access themselves through governed workflows with approvals.
- Federation
- Trusting identities from another identity provider.
- Single sign-on (SSO)
- One authentication for many applications.
- Conditional access
- Policies that grant, block or step up authentication based on user, device, location and risk.
- Identity provider
- The system that authenticates users and issues assertions or tokens.
- Service provider
- The application that relies on the identity provider.
- Attestations
- Signed statements about a device or identity state, or periodic access reviews confirming access is correct.
- Policy decision and enforcement points
- The PDP evaluates policy and decides; the PEP enforces the decision at the resource.
Access control models
- Role-based access control
- Permissions by job role.
- Rule-based access control
- System-wide rules (e.g. time or IP based).
- Attribute-based access control (ABAC)
- Decisions from attributes of subject, object, action and environment; very granular.
- Mandatory access control (MAC)
- Labels and clearances enforced by the system.
- Discretionary access control (DAC)
- Owners grant access to their resources.
Logging and auditing
- Logging and auditing
- Recording authentication and authorisation decisions for detection and compliance.
Public key infrastructure (PKI) architecture
- Certificate extensions
- Fields such as Subject Alternative Name, Key Usage and Extended Key Usage that limit how a certificate may be used.
- Certificate types
- TLS server, client authentication, code signing, email (S/MIME), wildcard and multi-domain certificates.
- Online Certificate Status Protocol (OCSP) stapling
- The server attaches a recent signed OCSP response to the TLS handshake, improving privacy and performance.
- Certificate authority/registration authority (CA/RA)
- The CA signs certificates; the RA verifies identity before issuance.
- Templates
- Predefined certificate profiles (e.g. in AD CS); misconfigured templates can allow privilege escalation.
- Deployment/integration approach
- Offline root CA, online issuing CAs, HSM-protected keys, automated enrollment (ACME, SCEP, EST).
Access control systems
- Physical
- Badges, readers and locks integrated with identity.
- Logical
- Systems controlling access to data and applications.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 2.4 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.