Lesson 19: Given a Scenario, Implement and Maintain Identity and Access Management

Identity Proofing

verifying and validating that a persion is who they say they are

IAM (Identity and Access Management)

business process of giving the right individuals access to the right resources at the right time for this right reasons

Provisioning

IAM function that involves creating and managing digital identities

Deprovisioning

IAM function that involves removing and deleting digital identities

IAM Phase 1

Onboarding, account request, user agreement signing, credential management

IAM Phase 2

Assignment of rights and permissions, user training

IAM Phase 3

User account auditing, user access auditing, change request submission, change request auditing, user trianing (SETA)

IAM Phase 4

Termination, offboarding

Authorization is granted by resource custodians. (T or F)

False. Authorization is granted by resource owners. They make the decision but the rights and permissions are actually assigned by the resource custodian

SETA

Security Education Training and Awareness

Change Request

formal process to request, revoke, or modify access when a user's status changes (e.g. transfer, resignation, termination)

Authorization Creep

the accumulation of unnecessary rights and permissions over time

Recertification/Access atestation

when management validates that rights and permission assignments are correct

SSO (Single Sign-On)

- also called legacy single sign on

- users can access multiple applications within the same organization using a single set of credentials

Federated Identity

- users can access applications across mulitple organizations (that are part of a federated configuration) using a single set of credentials

What is the difference between legacy SSO and Federated Identity

Legacy SSO allows is WITHIN the same organization while Federated Identity is ACROSS multiple organizations.

Portable Identity

the single set of credentials used in Federated Identity

Federated Configuration

configuration in which resources belong to different organizational entities

FIM (Federated Identity Management)

- processes and technologies for managing user identities, access rights, and permissions across federated systems

- uses SAML and OAuth 2.0

SAML (Security Assertion Markup Language)

XML-based open standard for exchanging authentication and authorization data between and SP and an IdP

IdP (Identity Provider)

system responsible for authenticating user's identity

SP (Service Provider)

- system/application the users wants to access

- relies on the IdP's decision for whether to trust the user's identity and grant access to its resources

OAuth 2.0

open standard protocol to provide access to resources without sharing credentials

Authorization Server API/ Resource

server that authenticates the user and issues an access token to the resource server

Client Application

application that want access to the protected resource

Resource Owner

user who owns the protected resource

Identification

how a subject is uniquely recognized

Authentication

how an identity is proven to be genuine (to an authentication system)

Authorization

how acces rights and permissions are granted

Factor

proof of identity given to an authentication system

Credential

combination of a username and factor(s)

4 Authetication Factors

Knowledge, Possession, Biometric, Location

Knowledge

something you know (e.g. passwrod, passphrase, PIN, out-of-wallet question)

Possession

something you have (e.g. OTP, token, smartcard, cell phone)

Biometric

- something a user is or does

- physical or behavioral human characteristics that can be used to digitally identify a person

Location

somewhere you are (e.g GeoIP, Geofence, Lat/Long)

NIST 800-63 Password Guidelines

- prioritize length over complexity

- allow ASCII/Unicode

- don't allow dictionary words

- reset infrequently

- have show password option (but no hints)

- permit paste functionality

- unique passwords (via password manager)

Password Vaults

- a.k.a password manager

- used to securely store and manage passwords and other sensitive credentials

- passwords are stored encrypted and can only be accessed by authorized individuals (e.g. via 2FA)

OTP (One-time Password)

generated by something you have or sent to something you have

Time OTP (TOTP)

hardware or software token that generates an OTP using a secret shared with the authentication server and the current time

Hash OTP (HOTP)

hardware or software token that generates an OTP using a secret key and cryptographic hash function

SMS | Voice OPT

numeric or alphanumerica code sent to a phone number either via voice or text

Single-factor

only one factor is requeired for authentication

Multi-layer

two or more of the same type of factor required for authentication

Multi-factor

two or more different types of factors are required for authentication

2-step verification

confirms a user's identity by requiring a response (e.g. repeating back a code sent to your phone)

Passwordless Authentication

- method of authentication that eliminatres the need for passwords

- relies on alternative factors to authenticate users

Physiological Markers

- what you are

- e.g. fingerprint, retinal (eye), iris (eye), vein, facial

Behavioral Traits

- what you do

- e.g. voiceprint, handwriting, gait (walking)

Retinal (eye)

unique structure of capilaries that supply the retina with blood

Vein

unique vein patterns in palm and finger

(T or F) Biometric factors may inadverently detect drug use, pregnancy, or illness.

True

FRR (False Reject Rate)

- leads to user frustration (system is too sensitive)

- type 1 error

- higher FAR is acceptable for cases where security is important enough to deal with user frustration (e.g. data center)

FAR (False Accept Rate)

- security issues (system isn't sensitive enough)

- type 2 error

CER (Crossover Rate Error)

- intersection beween FRR and FAR

- generally a good point to shoot for in terms of tuning

Access Control

lets orgranizations manage who is authorized to access data/resources and what the are allowed to do

Rights

entitlements granted to users (e.g. change system time, create a user)

Permissions

specific authriozations that define what a user can do with specific files, directories, and resource (e.g. read, write, delete, modify)

Subjects

active entities (e.g. person, process or devices) that cn change system state

Objects

passive entities (resource) that contain or receive information or instructions

MAC (Mandatory Access Control)

- access is based on the relationship between subject clearance, need-to-know, and object classification.

- even if the subject has the required clearance, if they don't "need to know" they don't have acess

DAC (Discretionary Access Control)

- access is determined by the data owner

- polar opposite of MAC

(RBAC) Role-based Access Control

- access is based on the subject's assigned roles

- a.k.a non-discretionary since you can't decided exaclty who has access (it's just anyone that has the right role)

Rule-base Access Control

- access is based on compliance with established rules (e.g. firewall)

(ABAC) Attribute-Based Access Control

- access is determined by a combination of subject/object attributes, operations and the environment

- supports complex Boolean rule sets that can evalute many different attributes

- XACML is an example of an access control framework that follows ABAC

Risk-base Access Control

- access is influence by dynamic factors and contextual data analytics

XACML (Extensible Access Control Markup Language)

an access control framework that is consistent with ABAC authorization model

Atypical Travel

risk-based trigger that identifies two sign-ins from geographically distant locations where at least one is unusual based on past behavior

Impossible Travel

risk-based trigger that identifies two sign-ins from geographically distant locations where its impossible to get from one to the other in the time between sign-ins

Privileged Account

any account that provides rights/permissions beyond those of a standard account

Standing Privilege

accounts that have persistent privileged access 24/7/365 (e.g. admin)

ZSP (Zero Standing Privilege)

- a way to implement a ZT environment

- aims to minimize standing privileges

- required continuous reauthentication, and least privilege

Service Account

often have elevated privileges to acces required system resources or network services

Embedded Application Account

hardcoded credentials embedded in software (used for development purpose)

Privileged Account Discovery

identify and catalog all privileged accounts

Privileged Account Credentials

enforce strict controls over privileged account credentials (e.g. encryption, secure storage, rotation)

Just-in-Time Privileged Access

privileged access is provided only for a limited duration and for specific tasks

Privileged Elevation and Delegation

mechanism for granting temporary privilege when needed - which reduces the dependency on persistent privileged accounts

PAM (Privileged Access Management)

set of technologies and practices to manages and secure privileged accounts