Prof Messer CompTIA Security+ SY0-701 - 4.6

Identity and Access Management (IAM)

The security discipline that enables the right people to access the right resources at the right times

prevent unauthorized access

access control

authentication and authorization

identity governance

- track an entity's resource access

permission assignments (IAM)

least privilege

files that a user creates are private to them by default

- even if someone else is using that comp

identity proofing (IAM)

resolution = the system confirming your identity

validating

- passwords, security questions, etc

verification/attestaion

- additional info from the user to confirm identity (passport, etc)

Single sign-on (SSO)

provide credentials once; get access to what you need

usually for a limited time

underlying auth process and infrastructure has to support SSO

LDAP (Lightweight Directory Access Protocol)

protocol for reading and writing directories over a network

used to query and update a x.500 directory

- used in Windows Active Directory, Apple OpenDirectory, etc

X.500 Distinguished names

attribute=value pairs

X.500 Directory Information Tree

Hierarchical structure

Builds a tree

Container objects

• Country, organization, organizational units

Leaf objects

• Users, computers, printers, files

SAML (Security Assertion Markup Language)

open standard for authentication and authorization

- auth through a 3rd party

not designed for mobile apps

SAML authentication flow

OAuth

created by Twitter, Google and many others

- big industry support

not an auth protocol

auth framework

allows auth between apps

federation

authnticate and authorize between 2 orgs

("log in with facebook")

3rd parties must establish a trust relationshup

Mandatory Access Control (MAC)

OS limits user access to objects by labeling them

admin decides who gets access to what security level

Discretionary Access Control (DAC)

owner of object controls who has access

can modify access at any time

very flexible; but also very weak

Role-Based Access Control (RBAC)

admins provide access based on the role of the user

rights are gained implicitly instead of explicitly

rule based access control

access is determined through system enforced rules

Attribute-based access control (ABAC)

"next gen" authorization model

combine and evaluate multiple parameters

- IP address

- time of day

- desired action

etc

multifactor authentication

use diff methods to prove who you are

factors

- something you know

- something you have

- something you are (biometrics)

- somewhere you are

password strength

minimum of 8 chars

- this will change as computers get faster

uppercase, lowercase, #s and special chars

password age

how long since a password was modified

password manager

store all passwords in a database

- encrypted and protected

built into many OS's and browsers

passwordless authentication

authenticate without a password

can be used with a password or additional factors

just in time permissions

grant admin access for a limited time

just in time accounts are temporary

- with temp password