L16: IAM - Authentication and Authorization

Identity and Access Management (IAM)

Manage digital identities and access rights across an organization

core components of IAM

• Authentication

• Authorization

• ID governance and lifecycle management

• Privileged account management

authentication

verifying users’ claimed identities

factors of authentication

• something you know (password)

• something you have (token, smart card)

• something you are (biometrics)

entropy

measure of password unpredictability

what increases entropy?

a longer password with varied character types

common password attacks

• brute-froce

• rainbow table

• credential stuffing

rainbow table attack

uses a precomputed table of password hashes to quickly find the corresponding plaintext passwords

credential stuffing

automatic injection of stolen usernames and passwords in hopes that one works

mitigation of password attacks

• store passwords securely

• strong cryptographic hashing algorithms

• use Password-Authenticated Key Exchanges (PAKEs)

how to store passwords securely

• hash passwords

• use salts

recommended hashing algorithms

argon2, bcrypt, scrypt, pbkdf2

examples of biometrics

facial recognition, iris scans

strengths of biometrics

difficult to replace, user-friendly

risks of biometrics

• false positives/negative

• irrevocability if compromised

multi-factor authentication (MFA)

use 2+ different authentication factorsad

advantages of MFA

• reduces risks from password theft

• highly effective in preventing unauthorized access

challenges of MFA

• user inconvenience

• implementation complexity

role based access control (RBAC)

access right assigned based on predefined roles

advantages of RBAC

• efficient

• manageable

• reduce errors

limitations of RBAC

less flexible when handling specific exceptions

attribute based access control (ABAC)

use dynamic policies based on attributes

advantages of ABAC

• flexible

• granular control

challenges of ABAC

• difficulty of initial policy setup

• complex to manage