Domain 4.6

Provisioning/de-provisioning user accounts

Creating or removing user accounts

Permission assignments

Giving users access rights

Identity proofing

Verifying someone’s identity

Federation

Sharing login identity across systems

Single sign-on (SSO)

One login for many systems

Lightweight Directory Access Protocol (LDAP)

access and manage directory services over a network.

Open Authorization (OAuth)

Allows apps to access accounts without passwords

Security Assertion Markup Language (SAML)

Protocol used for SSO authentication

Interoperability

Systems working together

Attestation

verifying that system / device is secure

Access controls

Methods that limit system access

Mandatory access control (MAC)

system controls access

Discretionary access control (DAC)

Owner decides who gets access

Role-based access control (RBAC)

Access based on job role

Rule-based access control

Access based on set rules

Attribute based access control (ABAC)

Access based on user attributes like role, location, or time.

Time-of-day restrictions

Access allowed only at certain times

Least privilege

Give only the access needed

Multifactor authentication (MFA)

Using multiple login factors

Biometrics

Login using physical traits

Authentication tokens

Devices or apps that generate login codes

Security keys

Physical device used for login

Privileged access management (PAM) tools

Tools that manage admin access

Just-in-time permissions

Temporary access when needed

Ephemeral credentials

Short-term login credentials