Cybersecurity - Ch. 19

CompTIA Security+ SY0-701: Implementing and Maintaining Identity and Access Management

  • Chapter 19 of the Pearson IT Certification Guide, authored by Lewis Heuermann.

  • Includes information regarding a 10% discount on exam vouchers via Pearson IT Certification.

  • The chapter covers critical components of Identity and Access Management (IAM), including account lifecycles, authentication protocols, and access control models.

User Account Lifecycle: Provisioning and De-provisioning

  • Provisioning:

    • The formal process of setting up a user account.

    • Involves configuring all necessary permissions and access settings required for the user to perform their role.

  • De-provisioning:

    • The process of disabling or removing permissions and settings from a user account.

    • This is typically triggered when a user leaves the organization or changes roles, ensuring that access remains current.

  • Crucial Importance:

    • Well-managed provisioning and de-provisioning are vital for ensuring users always have exactly the appropriate level of access—no more and no less.

Permission Assignments

  • Definition: Permission assignment refers to the act of granting specific levels of access or specific activities (such as read, edit, or delete) to users, groups, or system processes.

  • Types of Permission Assignments:

    • User-level: Permissions granted directly to an individual user account.

    • Group-level: Permissions granted to a collection of users; any user added to the group inherits these permissions.

    • Role-based: Permissions assigned to specific organizational roles rather than individuals.

    • Resource-based: Permissions attached to specific resources (like a file or a database) which define who can access them.

Identity Proofing and Verification

  • Core Concept: Identity proofing is the rigorous process of verifying a user's or system's identity within an organization.

  • Authentication Layers: It involves multiple levels of authentication, ranging from standard passwords to more complex biometric data.

  • Continuous Assurance: The process extends beyond the initial login. It includes:

    • Periodic re-authentication to ensure the user is still the authorized individual.

    • Session time-outs to prevent unauthorized access to unattended active sessions.

Federation and Single Sign-On (SSO)

  • Federation:

    • A system-to-system arrangement where one system authenticates users and subsequently sends that authentication information to other participating systems.

    • This allows for cross-boundary or cross-organizational authentication.

  • Single Sign-On (SSO):

    • Enables a user to use one single set of credentials to gain access to multiple services or applications.

    • The primary goal is to minimize the number of times a user must authenticate after their initial login.

  • SSO Protocols:

    • LDAP (Lightweight Directory Access Protocol): Used for accessing and maintaining distributed directory information services.

    • OAuth (Open Authorization): An open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites without giving them passwords.

    • SAML (Security Assertion Markup Language): An XML-based framework for communicating user authentication, entitlement, and attribute information.

  • SAML Operational Modes:

    • IdP-Initiated Mode: The Identity Provider starts the authentication process.

    • SP-Initiated Mode: The Service Provider starts the authentication process by redirecting the user to the IdP.

Interoperability in IAM

  • Definition: The ability of different, potentially disparate systems to work together effectively.

  • IAM Integration Requirements:

    • IAM systems must integrate seamlessly with various databases, applications, and authentication protocols.

    • A lack of integration can significantly interfere with the organization's needs for access and auditing.

  • External Collaboration: Interoperability is essential when working with external partners, requiring secure cross-boundary authentication and authorization.

  • Strategic Benefit: Interoperable systems can adapt to new technologies and changing compliance requirements without the need to completely overhaul existing infrastructure.

Attestation Mechanisms

  • General Definition: Attestation provides evidence or proof that allows one program or system to authenticate itself to another.

  • Remote Attestation:

    • Enables a system to make reliable statements about the specific software it is running to another system.

    • The receiving system can then make informed authorization decisions based on that software-state information.

  • TPM (Trusted Platform Module):

    • Uses a "quote operation" to verify the contents of the chip's Platform Configuration Registers (PCRs) during the provisioning process.

  • Security Threats to Attestation:

    • Attestation methods may be vulnerable to specific cyberthreats, including replay attacks and masquerading.

Access Control Models

  • Role-Based Access Control (RBAC):

    • Controlled by the system rather than the resource owner.

    • Users are assigned to roles, and they automatically receive the access rights associated with those roles.

  • Rule-Based Access Control:

    • Also referred to as Label-Based Access Control.

    • Relies on specific rules governing access. Example: Access is only permitted to specific IP addresses during certain hours of the day.

  • Mandatory Access Control (MAC):

    • The strictest of all models.

    • Settings are established by the system, using pre-defined security classifications for data.

  • Discretionary Access Control (DAC):

    • Access is generally determined by the owner of the resource.

  • Attribute-Based Access Control (ABAC):

    • A dynamic and context-aware model.

    • Combines various attributes from the user, the group, and the resource to determine if access should be granted.

  • Least Privilege Principle: A fundamental security concept where a user is granted only the minimum level of access required to perform their specific job functions.

Historical Security Standards

  • The Orange Book:

    • Formally known as the Trusted Computer System Evaluation Criteria (TCSEC).

    • Developed by the United States Department of Defense (DoD).

    • It was superseded in 2005 by the Common Criteria for Information Technology Security Evaluation (commonly called Common Criteria).

  • The "Rainbow Series":

    • A series of security standards published by the DoD throughout the 1980s and 1990s.

  • The Red Book:

    • Part of the Rainbow Series, specifically known as the Trusted Network Interpretation standard.

Multifactor Authentication (MFA)

  • Definition: The process of authenticating a user by validating two or more claims from different categories of factors.

  • Two-Factor Authentication (2FA): A specific subset of MFA requiring exactly two factors.

  • Authentication Factor Categories:

    • Something you know: (e.g., a password or PIN).

    • Something you have: (e.g., a hardware security key or a smart card).

    • Something you are: (e.g., biometrics such as distinctive body measurements).

    • Somewhere you are: (e.g., location-based authentication or IP geofencing).

Password Concepts and Best Practices

  • Role: Passwords serve as the primary barrier for protecting sensitive information and limiting access.

  • Key Requirements for Password Policies:

    • Password Length: The minimum number of characters required.

    • Password Complexity: The requirement to use diverse character types (uppercase, lowercase, numbers, symbols).

    • Password Reuse: Restrictions on how frequently an old password can be recycled.

    • Password Expiration: The timeframe after which a password must be changed.

    • Password Age: The minimum amount of time a password must be used before it can be changed again.

  • Ancillary Tools:

    • Password Managers: Tools to store and manage credentials.

    • Passwordless Authentication: Methods that remove the need for traditional passwords entirely.

Privileged Access Management (PAM) Tools

  • Purpose: PAM tools centrally manage access to privileged (administrative) accounts based strictly on the principle of least privilege.

  • Just-In-Time (JIT) Permissions: Providing access for a strictly limited period, only when it is needed.

  • Ephemeral Credentials:

    • Automatically generated for specific sessions or tasks.

    • They are invalidated shortly after the task is completed.

    • They typically expire much more quickly than JIT permissions.

  • Password Vaulting: The use of a centralized, highly encrypted repository to store various access credentials.

Questions & Discussion

Knowledge Review 1

  • Question: In the context of user account management, what is the key difference between provisioning and de-provisioning?

  • Options:

    • a. Provisioning sets up user access while de-provisioning removes or disables it.

    • b. Provisioning grants access while de-provisioning monitors access.

    • c. Provisioning creates user accounts while de-provisioning deletes them permanently.

    • d. Provisioning manages passwords while de-provisioning manages permissions.

  • Correct Answer: a. Provisioning sets up user access while de-provisioning removes or disables it.

Knowledge Review 2

  • Question: In a federated identity management system, how does user authentication typically work?

  • Options:

    • a. Each system independently authenticates users.

    • b. Users are required to authenticate with every system individually.

    • c. A central server stores all user credentials and handles all authentication requests.

    • d. One system authenticates users and shares that authentication information with other systems.

  • Correct Answer: d. One system authenticates users and shares that authentication information with other systems.

Knowledge Review 3

  • Question: Which access control method is generally considered the strictest, using security classifications for data and being set by the system rather than the resource owner?

  • Options:

    • a. Role-based access control (RBAC)

    • b. Rule-based access control

    • c. Mandatory access control (MAC)

    • d. Resource-owner access control

  • Correct Answer: c. Mandatory access control (MAC)

Knowledge Review 4

  • Question: Privileged Access Management (PAM) tools help organizations secure and control access to sensitive systems and data. Which of the following best describes the core principle upon which PAM tools operate?

  • Options:

    • a. Open access for all authorized personnel

    • b. Least privilege

    • c. Unlimited administrative rights

    • d. Network segmentation

  • Correct Answer: b. Least privilege