4: Implement Identity and Access Management

Each network user and host device must be identified with an account so that you can control their access to your organization's applications, data, and services.

What is Authentication?

Proving a user is who or what they say they are.

What are the Multifactor Authentication Factors?

• Something you have (ownership, card, key)

• Something you are (biometric)

• Somewhere you are (location-based)

What is a PIN?

Personal Identification Number

What is a password best practices policy?

Something that instructs users on choosing and maintaining passwords

What are the requirements for user-selected passwords?

• Password Length

• Password Complexity

• Password Age

• Password Reuse and History

What are the 3 main types of token generation?

• Certificate-base Authentication

• One-Time Password (OTP)

• Fast Identity Online (FIDO) / Universal 2nd Factor (U2F)

What is a hard authentication token?

A token generated within a secure cryptoprocessor. This means there is no transmission of the token itself.

• Smart cards

• One-time Password (OTP)

• Security key

What is a soft authentication token?

A one-time password generated by the identity provider and transmissted to the supplicant. (using Okta to sign into Mines)

What is passwordless authentication?

The whole authentication system no longer processes knowledge-based factors. (It is going off of who you are, not what you know)

What is Authorization?

What rights a user has on each resource and enforcing those rights

What is Discretionary Access Control (DAC)?

In DAC, every resource has a owner. The owner creates a file or service although ownership can be assigned to another user. The owner has full control over the resource and they can modify its ACL to grant rights to others.

What is Mandatory Access Control (MAC)?

In MAC, access is based on security clearance levels. Rather than defining ACLs on resources, each object (system) is given a classification label and each subject (person) a granted clearance level.

What is Role-Based Access Control (RBAC)?

An organization defines its permission requirements in terms of the tasks that an employee or service must be able to perform. Each set of permissions is a role

What is Attribute-Based Access Control?

An ABAC system makes access decisions based on a combination of subject and object attributes. This is the most fine-grained access control model.

What is the concept of least privilege?

a user is granted the minimum possible sufficient rights to complete a task that they are authorized to perform

What is Federation as it refers to IAM?

the notion that a network needs to be accessible to more than just a well-defined group of employees

What is SSO (single sign-on)?

A system that allows the user to authenticate in one system and receive authorizations on integrated servers without having to enter credentials again. Sign in once, authenticated everywhere.

What is Kerberos?

A SSO service used on many networks, most notably used in Microsoft’s Active Directory (AD) service. It is based on a time-sensitive, ticket-granting system.

What does SAML stand for?

Security Assertion Markup Language

What is SAML?

an open standard protocol used to pass user identity and access data between different systems. acts like a digital passport