4.6 Identity and access management explained

Objective 4.6 is about the full life of an identity and the controls around it. It is a scenario objective, so expect questions that describe a business need and ask which approach meets it.

Provisioning creates accounts and grants access when someone joins or changes role; deprovisioning removes it when they leave. Both should be driven by a reliable trigger, such as HR records, so nothing is forgotten. Permission assignments should follow the role, and regular access reviews catch permission creep, where people collect rights from every job they've held. Identity proofing checks that a person is who they claim to be before an account is created, for example by verifying government ID.

Federation lets one organisation trust identities issued by another, so partner staff can sign in with their own company accounts. Single sign-on lets a user authenticate once and reach many applications. The protocols to know are SAML (an XML assertion from an identity provider to a service), OAuth (delegated authorisation, letting an app act on a user's behalf) and OpenID Connect (an identity layer on top of OAuth). LDAP is the directory protocol behind many of these systems. Interoperability and attestation complete this part.

Access control models decide who may do what. Mandatory access control (MAC) compares labels and clearances, and only the system can change them. Discretionary access control (DAC) lets the owner of a resource decide who can use it. Role-based access control (RBAC) grants rights through job roles. Rule-based access control applies rules such as allowed times or locations. Attribute-based access control (ABAC) evaluates many attributes together, such as department, device state and data classification. Time-of-day restrictions and least privilege apply across all of them.

Multifactor authentication combines factors from different categories: something you know, have, are, or somewhere you are. Two passwords are still one factor. Implementations include biometrics, hard and soft tokens, and security keys. Passwordless methods and FIDO2 security keys resist phishing because the key is bound to the real site. Password concepts include length, complexity, reuse, expiry, age and password managers.

Privileged access management protects the most powerful accounts. Just-in-time permissions grant elevated access only when approved and only for a set time. A password vault holds privileged credentials so admins check them out instead of knowing them. Ephemeral credentials expire after one use or session.