CISSP- Domain 5

IAM next

DAC — Discretionary Access Control

A type of access control where users have the ability to manage access rights to their own resources, allowing them to grant or revoke access to other users.

The owner of the resource decides who gets access.

Example: you own a folder and grant another user read or edit permission.

Think:

DAC = Data/resource owner has discretion.

It is flexible, but that flexibility can make permissions harder to control consistently.

MAC — Mandatory Access Control

A type of access control where access rights are regulated by a central authority based on multiple levels of security. Users cannot change access permissions as they are set by security policies.

Access is determined by centrally enforced security labels and classifications, not by the individual data owner.

Example:

• File = Secret

• User clearance = Secret

• System checks whether access is permitted under the security policy.

Users generally cannot simply share the information with whomever they want.

Think:

MAC = Mandatory labels + central authority

This is strongly associated with military/government environments.

RBAC — Role-Based Access Control

A type of access control where permissions are assigned to users based on their role within an organization, rather than to individual users. This model simplifies management by grouping users with similar duties and responsibilities, allowing for effective permission management.

Permissions are assigned to roles, and users are assigned to those roles.

Example:

“Accounts Payable Analyst” role gets permission to enter invoices.

When someone joins Accounts Payable, you give them the role instead of individually assigning 20 permissions.

Think:

RBAC = What is your JOB?

This is extremely common in organizations.

ABAC — Attribute-Based Access Control

A type of access control that grants permissions based on attributes of users, resources, and the environment. This model allows for fine-grained access decisions by evaluating various attributes against policies, making it highly flexible and context-aware.

Access is determined dynamically using attributes.

Attributes might include:

• User: department, clearance, job title

• Resource: classification, owner

• Environment: location, time, device

• Action: read, edit, approve

Example:

Allow access only if the user is in Finance, is on a managed device, is inside the U.S., and is accessing during approved hours.

Think:

ABAC = What attributes are true RIGHT NOW?

Compared with RBAC:

RBAC = your role
ABAC = multiple characteristics/conditions

Least privilege vs need-to-know

These overlap, but CISSP may distinguish them.

Least privilege:

Give someone only the permissions necessary to perform their job.

Example: a help-desk employee can reset passwords but cannot create domain administrators.

Need-to-know:

Even if someone has the appropriate clearance or general authorization, they should access only the specific information necessary for their job.

Example:

Someone has Secret clearance, but that does not mean they can read every Secret document.

They also need a business need-to-know.

Differentiate between DAC vs. MAC etc

Scenario clue	Think
Owner chooses permissions	DAC
Labels + clearances + central enforcement	MAC
Job role determines access	RBAC
User/resource/device/time/location conditions	ABAC
Minimum permissions necessary	Least privilege
Must actually need the information	Need-to-know

Identity lifecycle

Think of IAM as managing access from before someone gets an account until after they leave.

Identity proofing happens before or during account creation. It answers:

Is this person really who they claim to be in the real world?

Examples include verifying government ID, employment records, or other trusted evidence.

Provisioning = creating the account and assigning appropriate access.

Modification = changing access when the person changes jobs, departments, projects, or responsibilities.

This is where privilege creep can happen: someone keeps old access while receiving new access.

Access review / recertification = periodically checking whether users still need the access they have.

Usually the best person to confirm business need is the manager/data owner/application owner, not simply IT.

Deprovisioning = removing or disabling access when it is no longer needed.

For a terminated employee, CISSP wants you thinking:

Revoke access promptly.

That includes logical accounts, badges, VPN access, tokens, privileged credentials, and other access paths.

A few account types matter too:

• Dormant account = legitimate account that has not been used for a while.

• Orphaned account = account that no longer has a valid responsible user/owner, often because someone left or a process changed.

• Shared account = multiple people use the same credentials; this weakens accountability.

And remember:

Joiner → Mover → Leaver

That is a common way to think about the identity lifecycle.

Single Sign-On (SSO)

Single Sign-On means:

Authenticate once, then access multiple systems without logging in again each time.

Main benefit:

• better usability

• fewer passwords

• easier centralized access management

Main risk:

• if the SSO account is compromised, the attacker may gain access to many connected systems

Think:

SSO = one login, many systems

Federation

Federation lets one organization trust another organization’s identity provider.

Example:

Your employer authenticates you, and a third-party SaaS application trusts your employer’s identity assertion.

Think:

Federation = Organization A trusts Organization B to authenticate the user

This is common with cloud services.

SAML

Security Assertion Markup Language; an XML-based framework for exchanging authentication and authorization data between parties, often used in web browser single sign-on (SSO) implementations.

SAML = Security Assertion Markup Language

Used mainly for federated authentication / enterprise SSO, especially browser-based applications.

It passes an assertion from an Identity Provider to a Service Provider saying, essentially:

“I authenticated this user. Here is information about them.”

Key roles:

• IdP — Identity Provider = authenticates the user

• SP — Service Provider = provides the application/service

Think:

SAML = enterprise browser SSO

OAuth 2.0

A widely used authorization framework that allows third-party applications to obtain limited access to user accounts on an HTTP service, such as Facebook or Google, on behalf of the user without exposing their credentials.

OAuth is primarily about authorization, not authentication.

It lets one application get limited access to another service without receiving the user’s password.

Classic example:

A photo-printing app gets permission to access selected photos in your cloud account.

The user is granting delegated access.

Think:

OAuth = let this app access something on my behalf

OpenID Connect (OIDC)

An authentication layer on top of OAuth 2.0 that provides identity verification and basic profile information about the user. OIDC adds a standard way to obtain the user's identity while still maintaining the authorization benefits of OAuth.

OpenID Connect adds an authentication layer on top of OAuth 2.0.

Think:

OAuth = what can the app access?
OIDC = who is the user?

OIDC is widely used for modern web/mobile authentication.

Kerberos

A network authentication protocol designed to provide secure authentication for users and services in a distributed environment. It uses a ticket-based system to authenticate entities without sending passwords over the network.

Kerberos is a network authentication protocol that uses tickets and a trusted third party.

Main components:

• KDC — Key Distribution Center

• AS — Authentication Service

• TGS — Ticket Granting Service

• TGT — Ticket Granting Ticket

The flow, simplified:

User authenticates → gets a TGT → uses the TGT to request service tickets → presents service ticket to resource.

Very important:

Kerberos does not repeatedly send the user's password across the network.

And Kerberos relies heavily on time synchronization. If system clocks differ too much, authentication can fail because timestamps help prevent replay attacks.

Fast distinction

Scenario	Think
One login to many apps	SSO
Organizations trust each other's identity systems	Federation
Enterprise browser SSO assertions	SAML
App gets delegated access to another service	OAuth
Authentication layered on OAuth	OIDC
Ticket-based network authentication	Kerberos

Biometrics: the CISSP way to think about them

Biometrics authenticate using a physical or behavioral characteristic.

Physiological biometrics include fingerprints, iris patterns, facial characteristics, and hand geometry. Behavioral biometrics include typing rhythm, voice patterns, signature dynamics, and gait.

Two terms matter:

Verification = 1:1 comparison

“I claim to be Stephanie. Does this biometric match Stephanie’s stored template?”

Identification = 1:many comparison

“I don’t know who this is. Search the biometric database and identify them.”

Now the big three metrics:

Metric	Meaning
FAR — False Acceptance Rate	Unauthorized/impostor person is incorrectly accepted
FRR — False Rejection Rate	Authorized person is incorrectly rejected
CER/EER — Crossover/Equal Error Rate	Point where FAR and FRR are equal

Think:

FAR = stranger gets IN → security problem
FRR = rightful user kept OUT → usability problem

If you tighten a biometric system's threshold, you generally reduce false acceptances but may increase false rejections. Loosen it, and the opposite tradeoff can occur.

CER/EER is commonly used to compare biometric systems. Lower is better, because it indicates a lower error rate at the crossover point.

One more CISSP issue: biometric characteristics are difficult to replace. If a password is compromised, you reset it. If a biometric template is compromised, you cannot simply issue someone a new fingerprint. That makes secure storage of biometric templates especially important.

AAA: Authentication, Authorization, Accounting

AAA gives you a clean way to remember three IAM functions:

• Authentication = Who are you?

• Authorization = What are you allowed to do?

• Accounting = What did you do?

That last piece is especially important for administrators and remote-access users because accounting creates the audit trail.

RADIUS

RADIUS = Remote Authentication Dial-In User Service

Commonly used for centralized authentication/AAA for things like:

• VPN access

• wireless network access

• remote network access

• network access servers

Classic CISSP distinction:

RADIUS combines authentication and authorization more closely.

It typically uses UDP.

Also, traditional RADIUS protects the user's password, but does not encrypt the entire packet contents.

Think:

RADIUS = network access

TACACS+

Terminal Access Controller Access-Control System Plus, a centralized authentication protocol that provides more granular control over authentication and authorization compared to RADIUS. It typically uses TCP for transport and encrypts the entire communication packet.

TACACS+ = Terminal Access Controller Access-Control System Plus

Very commonly associated with administrative access to network devices such as routers and switches.

Important distinctions:

• Separates authentication, authorization, and accounting

• Uses TCP

• Encrypts the authentication/authorization/accounting payload rather than only the password field

Think:

TACACS+ = administrators managing network equipment

For CISSP, if the scenario says:

“We want granular control over which commands a network administrator may execute”

TACACS+ should immediately come to mind.

LDAP and LDAPS

Lightweight Directory Access Protocol (LDAP) is a protocol used to access and maintain distributed directory information services over an internet protocol network. LDAPS is the secure version that uses SSL/TLS to encrypt the communication between the client and the server.

LDAP = Lightweight Directory Access Protocol

LDAP is used to query and interact with directory services.

A directory might contain:

• users

• groups

• computers

• organizational units

• attributes

• group memberships

Think of LDAP as:

The language/app protocol used to talk to a directory.

Common ports:

• LDAP = TCP/UDP 389

• LDAPS = TCP 636

LDAPS protects LDAP communications using TLS.

And an important distinction:

Active Directory is a directory service. LDAP is one protocol that can be used to access directory information.

Fast memory cues

Scenario	Think
VPN/Wi-Fi/network access AAA	RADIUS
Admin control of routers/switches	TACACS+
Granular admin command authorization	TACACS+
Query users/groups in directory	LDAP
Secure LDAP connection	LDAPS
Who / What access / What happened	AAA