Section 17: IAM Solutions

identity and access management (IAM)

ensures the right access for the right people at the right times

• identification, authentication, authorization, accounting

provisioning

creating new user accounts, assigning permissions, and providing system access

deprovisioning

removing an individuals’ access rights when the rights are no longer required

identity proofing

verifying the identity of a user before the account is created

interoperability

the ability of different systems, devices, and apps to work together and share info

• ex. SAML, OpenID Connect

attestation

validating that user accounts and access rights are correct and up to date

• involves regular reviews and audits

5 categories of authentication for multi-factor authentication (MFA)

1. something you know—-knowledge based

2. something you have—-possession based

3. something you are——inherence based

4. somewhere you are—-location based

5. something you do—-behavior based

passkeys

passwordless authentication used as an alternative to traditional passwords

• utilize public key cryptography

password security

measures the effectiveness of a password in resisting guessing and brute-force attacks

password length reccommendation

at least 12-16 characters

password managers

store, generate, offer cross-platform access, and autofill passwords to enhance security

cross-platform access

cross-device compatibility, allowing access to passwords from any location or device

biometric authentication

verifies identity through distinct biological characteristics like fingerprints and faceID

hardware token

physical device, like a security key, that generates ever-changing login codes

magic links

one-time links sent via email for automatic login

brute force attacks

tries every possible combination of characters until the correct password is found

dictionary attack

uses a list of commonly used passwords to crack passwords

password spraying

a form of brute force attack the tries a few common passwords against many usernames or accounts

• effective because it avoids account lockouts

hybrid attack

combination of brute force and dictionary attacks

single sign-on (SSO)

authentication process that allows a user to access multiple apps or websites by logging in only once with a single set of credentials

identity provider (IdP)

system that creates, maintains, and manages identity info for principals while providing authentication services to relying apps within a federation or distributed network

• validates user identity using stored credentials

lightweight directory access protocol (LDAP)

used to access and maintain disttributed directory information services over an IP network

open authorization (OAuth)

open standard for token-based authentication and authorization that allows an individual’s account info to be used by third party services without exposing the user’s password

security assertion markup language (SAML)

a standard for logging users into apps based on their sessions in another context

• redirects users to and IdP for authentication

federation

links electronic identities and attributes to store information across multiple distinct identity management systems

• enables users to use the same credentials for login across systems managed by different organizations

priviledged access management (PAM)

helps organizations restrict and monitor privileged access within an IT environment

just-in-time permissions (JIT)

security model where administrative access is granted only when needed for a specific task

password vaulting

stores and manage passwords in a secure environments, often in a digital vault

• requires MFA to access passwords

temporal accounts (temporary accounts)

provides time-limited access to resources, and they are automatically disabled/deleted after a certain period of time

mandatory access control (MAC)

uses security labels to authorize user access to specific resources

• label must be assigned to both the resource and the user

discretionary access control (DAC)

resource’s owner determines which users can access each resource

role-based access control (RBAC)

assigns users to roles and uses these roles to grant permissions to resources

• controls and enforces minimal privileges

rule-based access control (RBAC)

uses security rules or access control lists

• enables admins to apply security policies to all users

attribute-based access control (ABAC)

uses object characterisitics (user, environment, resources) for access control decisons

time-of-day restrictions

restricts resource access based on request times

• prevents unauthorized access during non-working hours

principle of least privilege

granting users the minimum access required for their tasks, without extra priviliges

permission creep (authorization creep)

occurs when a user gain excessive rights during their career progression in the company

user account control (UAC)

ensures that actions requiring administrative rights are explicitly authorized by the user

• access is limited to what the user needs to do a job