Lesson 4 - CertMaster Content

Lesson 4: Implement Identity and Access Management

Lesson Introduction

• Importance of IAM: Control access to applications, data, and services in an organization.

• User and device identification: Each must have an account for access control.

• Authentication technologies: Ensure that only valid users or devices operate accounts.

• Credential submission: Requires account holders to submit credentials that should be privately known to them.

• Network management: Manage identities across on-premises and cloud environments.

Lesson Objectives

• Topic 4A: Authentication

  • Implement password-based and multifactor authentication.

  • Implement account policies and authorization solutions.

  • Implement single sign-on and federated identity solutions.

Exam Objectives Covered

Implement and Maintain IAM

• Authentication verifies account holder identity post-creation and secure identity verification.

• Authentication technologies include passwords, biometrics, and tokens.

Authentication Design

• Process of authentication: User presents credentials; server compares with stored credentials.

• Authentication factors:

  • Knowledge Factor: Something the user knows (e.g., username/password).

  • Confidentiality: Protecting credentials from leakage.

  • Integrity: Reliable and non-bypassable authentication methods.

  • Availability: Authentication should not delay workflows.

Additional Credential Factors

• PINs: Valid for single-device authentication.

• Improper credential management leads to network attacks; strong policies needed.

Password Concepts

Credential Management Practices

• Need for strong password policies and user training.

• Password management best practices:

  • Length: Minimum and maximum restrictions.

  • Complexity: Certain character requirements and restrictions on using usernames.

  • Age and Reuse Policies: Users prompted to select new passwords periodically; previous passwords restricted.

Password Manager Applications

• Increase password security by creating unique, complex passwords.

• Password managers generate secure passwords and assist with login processes.

Multifactor Authentication (MFA)

Types of Authentication Factors

• Something You Have: (ownership factors) e.g., smart cards, tokens.

• Something You Are: (biometric factors) e.g., fingerprints, facial recognition.

• Somewhere You Are: (location factors) e.g., using IP addresses for location verification.

Biometric Authentication Metrics

• Metrics used to evaluate biometric systems:

  • False Acceptance Rate (FAR): Rate of unauthorized access.

  • False Rejection Rate (FRR): Legitimate users not recognized.

  • Crossover Error Rate (CER): Point where FRR and FAR are equal.

  • Throughput: Speed of template creation and authentication.

  • Failure to Enroll Rate (FER): Users who cannot complete enrollment.

Hard and Soft Authentication Tokens

Types of Tokens

1. Hard Tokens: Generate codes securely (e.g., smart cards).

2. Soft Tokens: OTPs via SMS or email; less secure than hard tokens but used for two-step verification.

Authorization Concepts

Implementing Access Control Models

1. Discretionary Access Control (DAC): Resource owner determines access rights.

2. Mandatory Access Control (MAC): Access based on security classifications, preventing user discretion.

3. Role-Based Access Control (RBAC): Permissions assigned based on job roles, enhancing flexibility without compromising security.

4. Attribute-Based Access Control (ABAC): Uses user attributes and context to make access decisions.

Principles of Least Privilege

• Users should have the least amount of privilege necessary to perform their tasks.

• Regular audits required to prevent privilege escalation (authorization creep).

User Account Provisioning

Provisioning and Deprovisioning Processes

1. Provisioning: Creating user accounts and assigning access rights.

2. Deprovisioning: Revoking access when employment ends or projects conclude.

Access Policies and Attributes

1. Identity proofing verifies users’ identities.

2. Credential issuance for secure access methods (passwords, biometrics).

3. Awareness of security policies and training to mitigate social engineering attacks.

Identity Management Techniques

Implementing Federated Identity Solutions

• Federated identity allows users to access services across different networks without creating multiple accounts.

• Use of protocols like SAML for secure communication between identity providers and service providers.

OAuth and RESTful Authentication

• OAuth allows users to share account information without sharing passwords.

• Utilizes tokens to grant access rights across different applications/API calls.

Lesson 4 Summary

• Assess IAM design in terms of confidentiality, integrity, and availability.

• Implement multifactor, passwordless authentication, and federated identity management as per protocols and product guides.