quizlet.com/867633436/identity-and-access-management-comptia-security-sy0-701-46-flash-cards/

Identity and Access Management (IAM)

The security discipline that enables the right individuals to access the right resources at the right times for the right reasons

User Account Definition

name, attributes, groups permissions, other permission

provisioning and de-provisioning user accounts

Account creation and removal occur during

- Hiring

- transfer

- Promotions

- Job separation

Permission assignment

- Just enough to do their job

- Group assignments are common

- Storage and files can be private to that user

- No privileged access to the OS

Identity proofing

The process of collecting and verifying information about a person for the purpose of proving that a person who has requested an account, a credential, or other special privilege is indeed who he or she claims to be and establishing a reliable relationship that can be trusted electronically between the individual and said credential for purposes of electronic authentication.

Verification / Attestation

passport, in person meeting, etc

Automated verification

single sign-on (SSO)

Allows a user to authenticate once to gain access to multiple systems, without requiring the user to independently authenticate with each system

Usually limited by time.

AAA server

A server that is dedicated to performing authentication, authorization, and accounting functions.

Lightweight Directory Access Protocol (LDAP)

Protocol for reading and writing directories over an IP network

- An organized set of records, like a phone directory

X.500 specification was written the the International Telecommunications Union (ITU)

- Knows as directories

DAP ran on the the OSI protocol stack

- the protocol is light weight

Is the protocol used to query and update an X.500 directory

- Used in Active Directory, Apple oneDirectory

X.500 Directory Information Tree

Hierarchical structure

• Builds a tree

Container objects

• Country, organization, organizational units

Leaf objects

• Users, computers, printers, files

Security Assertion Markup Language (SAML)

An Extensible Markup Language (XML) standard that allows secure web domains to exchange user authentication and authorization data.

Not designed for mobile apps

OAuth (Open Authorization)

Standard for federated identity management, allowing resource servers or consumer sites to work with user accounts created and managed on a separate identity provider.

Federation

Provides network access to others

- Not just employees - partners, suppliers, customers, etc

- Provides SSO and more

Third-party can establish a such network

- Authenticate and authorize between the two organizations

- Login with facebook credentials

Third parties must establish a trust relationship

Interoperability

Many different ways to communicate with an authentication server

- More than a simple login process

Often determined by what is at hand

- VPN concentrator can talk to a LDAP server

- We have an LDAP server

A new app uses OAuth

- Need to allow authentication APi access

LDAP Server

Provides directory services (not a database)