Lesson Seventeen

Identity and Access Management Foundations

SierraTec Secure CISSP Certification Preparation Course

Lesson Overview

Security ultimately depends on controlling a fundamental relationship:

Who or what is requesting access to which resource, and should that access be permitted?

Firewalls, encryption, network segmentation, endpoint protection, and secure architecture are important. However, if an attacker successfully assumes the identity of an authorized administrator, many technical controls may treat the attacker's activity as legitimate.

Identity and Access Management therefore establishes and manages:

• identities;

• authentication;

• authorization;

• permissions;

• credentials;

• sessions;

• access accountability;

• identity lifecycle processes.

IAM applies to much more than human employees.

Modern organizations must manage identities belonging to:

• employees;

• contractors;

• customers;

• administrators;

• applications;

• APIs;

• servers;

• cloud workloads;

• service accounts;

• devices;

• automated processes.

The current CISSP examination allocates 13% of the examination to Domain 5 — Identity and Access Management (IAM).

The current Domain 5 objectives include:

5.1 — Control physical and logical access to assets

Including access to:

• information;

• systems;

• devices;

• facilities;

• applications;

• services.

5.2 — Design identification and authentication strategy

Including:

• groups and roles;

• Authentication, Authorization and Accounting;

• MFA;

• passwordless authentication;

• session management;

• registration;

• identity proofing;

• establishment of identity;

• Federated Identity Management;

• credential-management systems;

• password vaults;

• Single Sign-On;

• Just-In-Time access.

5.3 — Federated identity with third-party services

Across:

• on-premises;

• cloud;

• hybrid environments.

5.4 — Implement and manage authorization mechanisms

Including:

• RBAC;

• rule-based access control;

• MAC;

• DAC;

• ABAC;

• risk-based access control;

• policy decision and enforcement concepts.

5.5 — Manage the identity and access provisioning lifecycle

Including:

• access reviews;

• provisioning;

• deprovisioning;

• onboarding;

• offboarding;

• transfers;

• role transitions;

• privilege escalation;

• service accounts.

5.6 — Implement authentication systems.

Lesson Seventeen establishes the IAM foundation and introduces Objective 5.1 and the core concepts of 5.2.

Later lessons will expand:

• federation;

• SAML;

• OAuth;

• OpenID Connect;

• Kerberos;

• LDAP;

• RADIUS;

• TACACS+;

• access-control models;

• privileged access management;

• identity lifecycle automation.

The central Lesson Seventeen question is:

How should an organization establish identity, prove identity, authenticate subjects, authorize appropriate access, maintain accountability, and prevent identities from receiving more access than their legitimate business need requires?

CISSP Exam Objective Alignment

Learning Objectives

After completing this lesson, you should be able to:

1. Define Identity and Access Management.

2. Distinguish identity from an account.

3. Define subjects and objects.

4. Explain identification.

5. Explain authentication.

6. Explain authorization.

7. Explain accounting.

8. Explain accountability.

9. Describe the AAA model.

10. Explain physical versus logical access.

11. Explain access to information.

12. Explain access to systems.

13. Explain access to devices.

14. Explain access to facilities.

15. Explain access to applications.

16. Explain access to services.

17. Explain identity proofing.

18. Explain identity registration.

19. Explain identity enrollment.

20. Explain credential issuance.

21. Explain credentials.

22. Explain authenticators.

23. Distinguish authentication factors.

24. Explain something you know.

25. Explain something you have.

26. Explain something you are.

27. Explain contextual and behavioral authentication signals.

28. Define multifactor authentication.

29. Distinguish MFA from two-step authentication using the same factor category.

30. Explain passwordless authentication.

31. Explain passkeys conceptually.

32. Explain phishing-resistant authentication conceptually.

33. Explain biometric authentication.

34. Explain False Acceptance Rate.

35. Explain False Rejection Rate.

36. Explain Equal Error/Crossover Error Rate.

37. Explain groups.

38. Explain roles.

39. Explain why group-based access is preferable to excessive individual permissions.

40. Explain least privilege.

41. Explain need to know.

42. Explain separation of duties.

43. Explain privileged accounts.

44. Explain service accounts.

45. Explain shared-account risk.

46. Explain credential-management systems.

47. Explain password vaults.

48. Explain Single Sign-On.

49. Explain the benefits and risks of SSO.

50. Explain Just-In-Time access.

51. Explain session establishment.

52. Explain session identifiers.

53. Explain session expiration.

54. Explain reauthentication.

55. Explain device identities.

56. Explain workload/service identities.

57. Explain non-human identity risk.

58. Explain basic identity federation.

59. Explain IAM decision flow.

60. Apply CISSP reasoning to IAM scenarios.

Part I — What Is Identity and Access Management?

1. IAM Defined

Identity and Access Management is the discipline used to:

• establish identities;

• authenticate identities;

• assign access;

• control permissions;

• monitor use;

• modify access;

• terminate access.

2. IAM Security Question

Nearly every access decision can be simplified to:

WHO OR WHAT?

      │

      ▼

REQUESTS ACCESS

      │

      ▼

TO WHICH RESOURCE?

      │

      ▼

FOR WHAT PURPOSE?

      │

      ▼

UNDER WHAT CONDITIONS?

      │

      ▼

ALLOW OR DENY

3. Identity Is the New Security Boundary

Traditional network thinking often relied heavily on:

INSIDE NETWORK

      =

TRUSTED

Modern architecture increasingly evaluates:

IDENTITY

    +

DEVICE

    +

CONTEXT

    +

RESOURCE

    +

POLICY

before access is granted.

This aligns with the Zero Trust principle introduced earlier.

Part II — Identity Versus Account

4. Identity

An identity represents:

An entity that can be recognized and distinguished from other entities.

Examples:

• Sallieu Kanu;

• Finance Application;

• Server-DB01;

• Backup Service;

• Employee Laptop 1042.

5. Account

An account is a system representation used to enable an identity to interact with a resource.

Example:

PERSON

Sallieu Kanu

     │

     ▼

IDENTITY

Employee 1045

     │

     ▼

ACCOUNT

skanu

An identity may have multiple accounts.

6. Why the Distinction Matters

One person might have:

• ordinary user account;

• privileged administrative account;

• cloud administrator account.

These accounts correspond to the same human identity but serve different functions.

Part III — Subjects and Objects

7. Subject

A subject is an active entity requesting or performing an action.

Examples:

• user;

• process;

• application;

• service;

• device.

8. Object

An object is a resource being accessed.

Examples:

• file;

• database;

• application;

• server;

• printer;

• API;

• building.

9. Access Relationship

SUBJECT

   │

   │ requests action

   ▼

OBJECT

Example:

ALICE

  │

  │ READ

  ▼

PAYROLL FILE

Part IV — Identification

10. Identification

Identification is the act of claiming an identity.

Example:

Username: skanu

The system now knows:

which identity is being claimed.

It does not yet know whether the claimant is genuinely that person.

11. Identification Question

Identification answers:

Who do you claim to be?

Part V — Authentication

12. Authentication

Authentication determines whether the claimant can demonstrate control of appropriate authenticators associated with the claimed identity.

Authentication asks:

Can you prove the claim?

NIST's current Digital Identity Guidelines describe authentication as establishing that a claimant is the subscriber associated with a previously established digital identity.

13. Example

IDENTIFICATION

Username: skanu

      │

      ▼

AUTHENTICATION

Password + Security Key

      │

      ▼

IDENTITY CONFIRMED

Part VI — Authorization

14. Authorization

Authorization determines:

What an authenticated subject is permitted to do.

Authentication occurs first.

Authorization follows.

15. Example

Alice successfully authenticates.

But Alice is a:

Human Resources Analyst.

She may be authorized to:

• view employee records;

but not:

• change firewall rules.

16. Authentication Does Not Equal Authorization

A user can be:

Authenticated

but:

Not Authorized

for a requested resource.

Part VII — Accounting

17. Accounting

Accounting records information about activity.

Examples:

• login time;

• logout time;

• commands;

• resources accessed;

• changes made.

18. AAA

A useful IAM framework is:

AUTHENTICATION

Who are you?

       │

       ▼

AUTHORIZATION

What may you do?

       │

       ▼

ACCOUNTING

What did you do?

Part VIII — Accountability

19. Accountability

Accountability means actions can be associated with a responsible identity.

Example:

Weak:

Account:

admin



Users:

12 administrators

Strong:

Administrator:

skanu-admin



Action:

Firewall Rule Changed



Time:

14:03

20. Why Shared Accounts Are Dangerous

Shared credentials weaken:

• accountability;

• auditing;

• investigation;

• revocation.

Part IX — Access to Assets

21. Current Objective 5.1

ISC2 explicitly requires CISSP candidates to understand physical and logical access to:

• information;

• systems;

• devices;

• facilities;

• applications;

• services.

Part X — Information Access

22. Information

Access decisions should consider:

• classification;

• sensitivity;

• business need;

• legal requirements.

Example:

PUBLIC DATA

    │

Broad access



CONFIDENTIAL DATA

    │

Restricted access



HIGHLY SENSITIVE DATA

    │

Strongly restricted

Part XI — System Access

23. Systems

System access includes:

• servers;

• databases;

• operating systems;

• management platforms.

Privileged system access generally deserves stronger controls.

Part XII — Device Access

24. Devices

Devices include:

• laptops;

• smartphones;

• network devices;

• industrial equipment;

• removable storage.

Access may require:

• authentication;

• device certificates;

• physical controls.

Part XIII — Facility Access

25. Facilities

IAM applies to physical access as well.

Example:

EMPLOYEE BADGE

      │

      ▼

BUILDING

      │

      ▼

SERVER ROOM?

   ┌──┴──┐

 YES    NO

Being authorized for the building does not automatically mean being authorized for the data center.

Part XIV — Application Access

26. Applications

Application permissions may control:

• features;

• records;

• administrative functions.

Example:

A payroll employee may access:

payroll processing.

But not:

application security configuration.

Part XV — Service Access

27. Services

Services include:

• APIs;

• cloud services;

• infrastructure services;

• automation interfaces.

Modern IAM therefore protects:

machine-to-machine access as well as humans.

Part XVI — Identity Lifecycle Foundation

28. Identity Has a Lifecycle

IDENTITY NEED

     │

     ▼

PROOF

     │

     ▼

REGISTER

     │

     ▼

CREDENTIAL

     │

     ▼

ACCESS

     │

     ▼

REVIEW

     │

     ▼

MODIFY

     │

     ▼

REVOKE / TERMINATE

Part XVII — Identity Proofing

29. Identity Proofing

Identity proofing establishes confidence that:

the applicant is actually the person or entity they claim to be.

NIST SP 800-63A-4 focuses specifically on identity proofing and enrollment and defines three levels of identity assurance.

30. Authentication Cannot Repair Bad Proofing

Suppose an organization incorrectly enrolls an attacker as:

Alice.

The attacker later authenticates correctly using credentials issued to the fraudulent identity.

The authentication process worked.

The identity-establishment process failed.

31. CISSP Principle

Identity proofing comes before trusting authentication.

Part XVIII — Registration

32. Registration

Registration creates the identity record.

For employees, information may originate from:

• HR systems;

• approved hiring workflows.

33. Example

NEW EMPLOYEE

     │

     ▼

HR VERIFIES EMPLOYMENT

     │

     ▼

IDENTITY RECORD CREATED

     │

     ▼

ACCOUNT PROVISIONING

Part XIX — Enrollment

34. Enrollment

Enrollment binds:

• identity;

• authenticator;

• credential information.

Example:

Employee receives:

• smart card;

• security key;

• passkey;

• authenticator application.

Part XX — Credential

35. Credential

A credential is evidence used in relation to an identity or authorization.

Examples may include:

• certificate;

• smart card;

• password credential;

• security key.

Part XXI — Authenticator

36. Authenticator

An authenticator is something possessed or controlled by the claimant and used to demonstrate identity during authentication.

Examples:

• password;

• cryptographic security key;

• authenticator application;

• private key.

Part XXII — Authentication Factors

37. Classic Factor Categories

CISSP candidates should know:

SOMETHING YOU KNOW

         │

SOMETHING YOU HAVE

         │

SOMETHING YOU ARE

Additional contextual and behavioral signals may also be considered.

Part XXIII — Something You Know

38. Knowledge Factor

Examples:

• password;

• PIN;

• passphrase.

39. Risk

Knowledge can be:

• guessed;

• phished;

• reused;

• shared.

Part XXIV — Something You Have

40. Possession Factor

Examples:

• smart card;

• hardware security key;

• authenticator device.

The security assumption is:

the legitimate user controls the authenticator.

Part XXV — Something You Are

41. Inherence Factor

Biometrics rely on physical or behavioral characteristics.

Examples:

• fingerprint;

• iris;

• facial characteristics.

Part XXVI — Contextual Signals

42. Somewhere You Are

Location can sometimes contribute to an authentication or risk decision.

Example:

• expected country;

• authorized facility.

43. Something You Do

Behavioral characteristics can include:

• typing behavior;

• interaction patterns.

These are often used as:

additional risk signals

rather than sole identity proof.

Part XXVII — Multifactor Authentication

44. MFA

Multifactor authentication uses independent authentication factors from more than one factor category.

Example:

PASSWORD

Something you know

       +

SECURITY KEY

Something you have

       =

MFA

The current CISSP outline explicitly includes MFA under AAA and authentication strategy.

45. Two Passwords Are Not MFA

Password + PIN:

KNOW

 +

KNOW

Both are knowledge factors.

That is not true multifactor authentication merely because two values were entered.

Part XXVIII — MFA Security Value

46. Why MFA Helps

If an attacker steals the password, the attacker may still lack:

the second authentication factor.

47. MFA Is Not Perfect

MFA may still face:

• phishing;

• token theft;

• push fatigue;

• session theft;

• recovery-process attacks.

Therefore:

The strength of the MFA method matters.

Part XXIX — Passwordless Authentication

48. Passwordless

The current CISSP outline explicitly includes passwordless authentication.

Passwordless authentication allows users to authenticate without relying on a traditional memorized password as the primary authenticator.

49. Examples

Passwordless methods may involve:

• security keys;

• platform authenticators;

• passkeys;

• cryptographic credentials.

Part XXX — Passkeys

50. Passkey Concept

A passkey uses public-key cryptography.

Conceptually:

DEVICE

   │

   ├── PRIVATE KEY

   │      stays protected

   │

   ▼

SERVICE

   │

   └── PUBLIC KEY

Authentication proves control of the private key without transmitting a reusable password.

51. Modern NIST Context

NIST's 2025 revision of the Digital Identity Guidelines explicitly added support and guidance for modern syncable authenticators such as synchronized passkeys.

Part XXXI — Phishing Resistance

52. Phishing-Resistant Authentication

Some cryptographic authentication methods bind authentication to the legitimate service and reduce reliance on secrets that users can accidentally enter into an attacker-controlled site.

CISSP principle:

Strong authentication should reduce dependence on transferable reusable secrets where feasible.

Part XXXII — Biometrics

53. Biometric Authentication

Biometric systems compare captured biological or behavioral characteristics against enrolled reference information.

Examples:

• fingerprint;

• iris;

• face.

54. Biometric Process

ENROLLMENT

     │

     ▼

BIOMETRIC TEMPLATE

     │

     ▼

STORED REFERENCE



AUTHENTICATION

     │

     ▼

NEW SAMPLE

     │

     ▼

COMPARE

     │

     ▼

MATCH / NO MATCH

Part XXXIII — FAR

55. False Acceptance Rate

FAR measures how often an unauthorized individual is incorrectly accepted.

Security concern:

Unauthorized access.

Part XXXIV — FRR

56. False Rejection Rate

FRR measures how often an authorized person is incorrectly rejected.

Operational concern:

Legitimate user denied access.

Part XXXV — CER / EER

57. Crossover or Equal Error Rate

The point at which:

FAR = FRR

is commonly used as a comparative biometric performance concept.

Generally:

Lower CER/EER indicates better overall discrimination performance.

Part XXXVI — Biometric Tradeoff

58. Threshold

STRICT THRESHOLD

      │

      ├── Lower false acceptance

      └── Potentially higher false rejection



LOOSER THRESHOLD

      │

      ├── Easier legitimate use

      └── Potentially higher false acceptance

Part XXXVII — Biometric Exam Trap

59. Biometrics Are Not Secrets in the Traditional Sense

If a password is compromised:

Change it.

If biometric data is compromised:

You cannot simply replace your fingerprint.

Protect biometric templates carefully.

Part XXXVIII — Groups

60. Group

A group collects identities with similar access characteristics.

Example:

FINANCE GROUP

   ├── Alice

   ├── Bob

   └── Maria

Permissions can then be applied to the group.

61. Why Groups Help

Without groups:

100 USERS

   ×

20 APPLICATIONS

   =

MANY INDIVIDUAL PERMISSIONS

Groups simplify administration.

Part XXXIX — Roles

62. Role

A role represents job or functional responsibilities.

Examples:

• HR Analyst;

• Security Administrator;

• Accounts Payable Clerk.

63. Role-Based Assignment

PERSON

   │

   ▼

ROLE

   │

   ▼

PERMISSIONS

This is easier to manage than assigning every permission manually.

Detailed RBAC theory will be covered in the authorization lesson.

Part XL — Role Versus Group

64. Group

A group is an administrative collection of identities.

65. Role

A role expresses:

a functional responsibility.

They can overlap in implementation but are conceptually distinct.

Part XLI — Least Privilege

66. Least Privilege

Grant subjects only the privileges necessary to perform authorized responsibilities.

Example:

A help-desk employee may reset passwords.

That does not mean the help-desk employee should be able to:

• alter firewall policy;

• read payroll records;

• disable audit logs.

Part XLII — Need to Know

67. Need to Know

Need to know asks:

Does this person need this specific information to perform an authorized duty?

68. Least Privilege Versus Need to Know

Part XLIII — Separation of Duties

69. Separation of Duties

Critical tasks may be divided among multiple individuals.

Example:

EMPLOYEE A

Creates payment



EMPLOYEE B

Approves payment

No single person controls the entire transaction.

70. IAM Relevance

Roles should be designed to avoid combinations that create unacceptable conflicts.

Part XLIV — Privileged Accounts

71. Privileged Account

A privileged account has elevated capabilities.

Examples:

• root;

• domain administrator;

• database administrator;

• cloud administrator.

72. Privileged Account Risk

Compromise may permit:

• configuration changes;

• account creation;

• security-control disablement;

• data access.

Part XLV — Separate Administrative Accounts

73. Good Practice

An administrator may use:

skanu

for normal work.

And:

skanu-admin

for privileged administration.

This supports separation of ordinary and privileged activity.

Part XLVI — Privileged Access Management

74. PAM Introduction

Privileged Access Management can help control:

• privileged credentials;

• session authorization;

• password rotation;

• session monitoring;

• temporary elevation.

Detailed PAM is covered later.

Part XLVII — Service Accounts

75. Service Account

A service account is used by:

• applications;

• services;

• scheduled processes;

• automation.

76. Service Accounts Are Identities

They should have:

• defined owner;

• defined purpose;

• least privilege;

• credential lifecycle;

• monitoring.

Part XLVIII — Service-Account Risk

77. Common Problems

Service accounts may:

• have passwords that never expire;

• receive excessive privilege;

• be poorly documented;

• outlive the application.

These identities can become high-value attack targets.

Part XLIX — Non-Human Identities

78. Modern IAM Includes Machines

Organizations increasingly manage:

PEOPLE

   +

DEVICES

   +

APPLICATIONS

   +

SERVICES

   +

WORKLOADS

All may require authenticated identity.

Part L — Device Identity

79. Device Identity

A device may authenticate using:

• certificate;

• hardware-bound credential;

• cryptographic key.

Example:

USER AUTHENTICATED?

       │

       ▼

DEVICE TRUSTED?

       │

       ▼

ACCESS DECISION

Part LI — Workload Identity

80. Service-to-Service Access

A cloud service may need to access:

Database B.

The application should not necessarily use:

a human administrator's password.

Instead, workload identities and controlled service credentials can be used.

Part LII — Credential Management

81. Credential Lifecycle

ISSUE

  ↓

STORE

  ↓

USE

  ↓

ROTATE

  ↓

REVOKE

  ↓

DESTROY / RETIRE

82. Credential Protection

Credentials should not casually appear in:

• source code;

• spreadsheets;

• shared messages;

• public repositories.

Part LIII — Password Vaults

83. Password Vault

A password vault securely stores and manages credentials.

The current CISSP outline explicitly identifies password vaults as credential-management systems.

84. Enterprise Vault Capabilities

Depending on the solution:

• secure storage;

• access logging;

• rotation;

• checkout;

• approval.

85. Vault Risk

The vault itself becomes:

a high-value security asset.

Protect it appropriately.

Part LIV — Single Sign-On

86. SSO

Single Sign-On allows a user to authenticate once and access multiple authorized applications without repeatedly authenticating separately.

USER

  │

  ▼

AUTHENTICATION

  │

  ▼

SSO

 ├── APPLICATION A

 ├── APPLICATION B

 └── APPLICATION C

The CISSP outline explicitly includes SSO under identification and authentication strategy.

Part LV — Benefits of SSO

87. Advantages

SSO can improve:

• user experience;

• centralized authentication;

• credential management;

• consistent policy.

Part LVI — SSO Risk

88. Concentrated Impact

If an attacker compromises the user's primary SSO session:

Multiple applications may become accessible.

Therefore strong:

• authentication;

• session security;

• monitoring

are particularly important.

Part LVII — SSO Is Not Automatic Authorization

89. Important Distinction

SSO proves/authenticates the user through a common mechanism.

Each application still needs to determine:

What is this user authorized to do here?

Part LVIII — Session Management

90. Session

After authentication, systems often establish a session.

AUTHENTICATE

     │

     ▼

SESSION CREATED

     │

     ▼

AUTHORIZED ACTIVITY

     │

     ▼

SESSION EXPIRES

Part LIX — Session Identifier

91. Session Token

Systems commonly issue:

• session cookie;

• token;

• session identifier.

If an attacker steals a valid session identifier, the attacker may be able to act as the authenticated user.

Part LX — Session Security

92. Session Protections

Consider:

• unpredictable identifiers;

• encryption;

• secure storage;

• timeout;

• revocation;

• reauthentication.

Part LXI — Idle Timeout

93. Idle Sessions

An unattended authenticated session may allow unauthorized access.

Therefore policy may terminate sessions after:

a period of inactivity.

Part LXII — Absolute Session Lifetime

94. Maximum Duration

A system may also restrict how long a session can exist regardless of activity.

Part LXIII — Step-Up Authentication

95. Higher-Risk Activity

A user may authenticate normally to view an account.

But changing bank information may require:

stronger reauthentication.

This is sometimes called:

Step-up authentication.

Part LXIV — Just-In-Time Access

96. JIT

The current CISSP outline explicitly includes Just-In-Time under identification and authentication strategy.

JIT access provides privileges only when they are needed.

97. Traditional Model

ADMIN ACCOUNT

      │

24/7 PRIVILEGE

98. JIT Model

ADMIN

  │

  ▼

REQUEST PRIVILEGE

  │

  ▼

APPROVAL / POLICY

  │

  ▼

TEMPORARY PRIVILEGE

  │

  ▼

TASK

  │

  ▼

PRIVILEGE REMOVED

Part LXV — JIT Security Benefit

99. Reduce Standing Privilege

JIT reduces:

the amount of time privileged access exists.

This reduces the attacker's opportunity if credentials are compromised.

Part LXVI — Federation Introduction

100. Identity Federation

Federation allows one trusted identity provider to provide authentication information or assertions for separately administered services.

NIST SP 800-63C-4 defines federation around identity providers/credential providers and relying parties exchanging identity assertions.

101. Simple Model

USER

  │

  ▼

IDENTITY PROVIDER

  │

  │ Assertion

  ▼

APPLICATION

RELYING PARTY

102. Why Federation Exists

Without federation:

APP A → Account/password

APP B → Account/password

APP C → Account/password

APP D → Account/password

With federation:

CENTRAL IDENTITY PROVIDER

       │

 ┌─────┼─────┐

 ▼     ▼     ▼

A      B     C

Part LXVII — On-Premises, Cloud, and Hybrid

103. Current Objective 5.3

ISC2 explicitly requires understanding federated identity with third-party services in:

• on-premises;

• cloud;

• hybrid environments.

Detailed federation protocols are reserved for the next lesson.

Part LXVIII — Identity Assurance

104. Identity Confidence

Not all identity processes require the same level of confidence.

A newsletter account may require relatively little proofing.

A high-value financial or government identity may require substantially more.

Part LXIX — NIST Digital Identity Assurance

105. Current NIST Framework

NIST published SP 800-63 Revision 4 as final guidance in July 2025, superseding Revision 3.

Its companion volumes address:

• identity proofing and enrollment;

• authentication and authenticator management;

• federation and assertions.

106. Three Assurance Dimensions

At a high level, NIST uses concepts including:

IAL

Identity Assurance Level.

How strongly was the real-world identity established?

AAL

Authenticator Assurance Level.

How strongly is the user authenticated?

FAL

Federation Assurance Level.

What assurance applies to federated assertions?

These are useful conceptual distinctions.

Part LXX — Identity Assurance Example

107. Scenario

An organization strongly authenticates a person with a hardware security key.

But the original account was created based only on:

an anonymous email address.

Authentication may be strong.

Identity proofing may be weak.

Part LXXI — Recovery Is Part of Authentication Security

108. Account Recovery

An attacker may bypass strong MFA by exploiting:

a weak password-reset process.

109. Recovery Principle

Account recovery should provide assurance appropriate to the protected account.

Otherwise:

STRONG MFA

    +

WEAK RECOVERY

    =

WEAK EFFECTIVE AUTHENTICATION

Part LXXII — Help Desk Risk

110. Social Engineering

Attackers may contact a help desk and claim:

“I lost my phone. Reset my MFA.”

Identity verification before recovery is therefore critical.

Part LXXIII — Authentication Versus Identification

111. High-Yield Comparison

Part LXXIV — Access Decision Flow

112. Complete Flow

SUBJECT

   │

   ▼

IDENTIFY

   │

   ▼

AUTHENTICATE

   │

   ▼

AUTHORIZE

   │

   ▼

ACCESS RESOURCE

   │

   ▼

LOG ACTIVITY

   │

   ▼

REVIEW / TERMINATE

Part LXXV — Policy Enforcement

113. Policy Determines Access

An access decision may depend on:

• user;

• role;

• device;

• location;

• resource;

• risk.

Detailed policy decision and enforcement concepts will be covered under Objective 5.4.

Part LXXVI — Default Deny

114. Access Philosophy

A strong authorization approach generally begins from:

Deny unless authorized

rather than:

Allow unless prohibited.

Part LXXVII — Access Creep

115. What Is Access Creep?

Access creep occurs when users accumulate permissions as their roles change.

Example:

ACCOUNTANT

   │

Permissions A

   │

PROMOTED TO MANAGER

   │

Permissions A + B

   │

TRANSFERRED TO HR

   │

Permissions A + B + C

Old access was never removed.

116. Security Risk

Eventually a user may possess:

significantly more access than required.

Provisioning lifecycle controls will address this in depth later.

Part LXXVIII — Dormant Accounts

117. Inactive Identity

Dormant accounts may remain:

• enabled;

• privileged;

• forgotten.

Attackers value unused accounts because legitimate owners may not notice suspicious activity quickly.

Part LXXIX — Orphan Accounts

118. Orphan Account

An orphan account no longer has an appropriate active owner.

Example:

Former employee account still enabled.

These are serious IAM hygiene issues.

Part LXXX — Shared and Generic Accounts

119. Generic Account

Examples:

• admin;

• support;

• operator.

Generic accounts may be necessary in limited technical circumstances but reduce individual accountability when broadly shared.

120. CISSP Preference

Where feasible:

Use individually attributable identities.

Part LXXXI — Emergency Accounts

121. Break-Glass Account

Emergency accounts may exist for exceptional conditions such as:

• identity-provider outage;

• administrative recovery.

122. Break-Glass Controls

They should receive:

• strong protection;

• limited use;

• monitoring;

• post-use review.

Part LXXXII — Machine Identity

123. Automated Systems Need Authentication

Example:

APPLICATION A

      │

      ▼

AUTHENTICATE

      │

      ▼

API B

Do not solve machine authentication by embedding:

human passwords.

Part LXXXIII — Secrets Management

124. Machine Credentials

Applications may use:

• certificates;

• tokens;

• API credentials;

• cryptographic keys.

These need secure storage and rotation.

Part LXXXIV — IAM and Zero Trust

125. Identity-Centric Security

Zero Trust decisions commonly evaluate:

SUBJECT

   +

DEVICE

   +

RESOURCE

   +

CONTEXT

   +

POLICY

Identity is therefore a major control point in modern architectures.

Part LXXXV — Continuous Authentication Concepts

126. Authentication Is Not Always One-Time

Risk can change during a session.

Examples:

• impossible travel;

• unusual device behavior;

• sudden privilege use.

Systems may respond with:

• reauthentication;

• access restriction;

• session termination.

Part LXXXVI — Adaptive Authentication

127. Risk-Based Authentication

A low-risk login may receive normal authentication.

A high-risk login may require:

stronger authentication.

Example:

KNOWN DEVICE + NORMAL LOCATION

          │

          ▼

STANDARD AUTHENTICATION



NEW DEVICE + HIGH-RISK LOCATION

          │

          ▼

STEP-UP AUTHENTICATION

Part LXXXVII — IAM Governance

128. IAM Is Not Just Technology

An IAM program also requires:

• policies;

• ownership;

• approvals;

• access reviews;

• lifecycle processes.

Part LXXXVIII — Data Owner Role

129. Who Should Approve Access?

Security administrators should not necessarily decide:

who has a legitimate business need for every piece of information.

The appropriate:

• data owner;

• system owner;

• business owner

often participates in authorization decisions.

Part LXXXIX — Security Administrator Role

130. Security Administration

Security administrators may:

• implement access;

• manage systems;

• enforce approved decisions.

They should not automatically:

approve their own business access.

Part XC — IAM Control Hierarchy

131. Governance Flow

BUSINESS REQUIREMENT

      │

      ▼

ACCESS POLICY

      │

      ▼

OWNER APPROVAL

      │

      ▼

IAM IMPLEMENTATION

      │

      ▼

ACCESS

      │

      ▼

MONITORING

      │

      ▼

REVIEW

Part XCI — SierraTec Secure IDENTITY Model

132. IDENTITY Framework

Use the SierraTec Secure IDENTITY model for IAM questions.

I — Identify the Subject

Who or what is requesting access?

D — Demonstrate Identity

How is identity proved and authenticated?

E — Establish Appropriate Rights

What access is legitimately required?

N — Need-to-Know and Least Privilege

Limit access to the minimum necessary.

T — Track Activity

Maintain accountability and logs.

I — Inspect Access Regularly

Review permissions and unusual behavior.

T — Terminate Unneeded Access

Remove rights promptly when conditions change.

Y — Yield Trust Only When Policy Is Satisfied

Trust is the result of validation and policy—not assumption.

133. IDENTITY Diagram

I

IDENTIFY SUBJECT

      │

      ▼

D

DEMONSTRATE IDENTITY

      │

      ▼

E

ESTABLISH RIGHTS

      │

      ▼

N

NEED TO KNOW

      │

      ▼

T

TRACK ACTIVITY

      │

      ▼

I

INSPECT ACCESS

      │

      ▼

T

TERMINATE

      │

      ▼

Y

YIELD TRUST

Part XCII — Worked CISSP Scenarios

134. Scenario 1 — Identification

A user enters:

skanu

into a login screen.

What has occurred?

A. Identification
B. Authorization
C. Accounting
D. Federation

Correct Answer

A

The user has claimed an identity.

135. Scenario 2 — Authentication

After entering a username, the user enters a password and uses a hardware security key.

What process is occurring?

A. Authentication
B. Authorization
C. Accounting
D. Data classification

Correct Answer

A

136. Scenario 3 — Authorization

A successfully authenticated employee attempts to open the payroll database.

What determines whether the employee may proceed?

A. Authorization
B. Identification
C. Encryption only
D. Availability

Correct Answer

A

137. Scenario 4 — Accounting

A system records that Administrator Alice changed a firewall rule at 10:32.

Which AAA function is represented?

A. Accounting
B. Authentication
C. Authorization
D. Identification

Correct Answer

A

138. Scenario 5 — MFA

Which combination provides true multifactor authentication?

A. Password + PIN
B. Password + security key
C. Password + security question
D. PIN + passphrase

Correct Answer

B

Password is knowledge.

Security key is possession.

139. Scenario 6 — Weak Proofing

A system uses excellent MFA, but accounts are issued without verifying who applicants actually are.

What is the PRIMARY weakness?

A. Identity proofing
B. Encryption
C. Availability
D. Logging

Correct Answer

A

140. Scenario 7 — Least Privilege

A help-desk employee needs permission to reset ordinary user passwords.

Which access is BEST?

A. Domain Administrator
B. Delegated password-reset permission only
C. Full database administrator
D. Enterprise root account

Correct Answer

B

141. Scenario 8 — Separation of Duties

One employee can create a supplier and approve payment to that supplier.

What is the PRIMARY concern?

A. Failure of separation of duties
B. Weak encryption
C. Lack of network bandwidth
D. Certificate expiration

Correct Answer

A

142. Scenario 9 — Shared Account

Five network administrators share one account called:

netadmin

What is the GREATEST concern?

A. Accountability is weakened.

B. Availability is too high.

C. Encryption becomes impossible.

D. The account cannot be privileged.

Correct Answer

A

143. Scenario 10 — Service Account

A database service account has enterprise administrator privileges even though it only needs access to one database.

Which principle is MOST clearly violated?

A. Least privilege
B. Availability
C. Data minimization only
D. Nonrepudiation

Correct Answer

A

Part XCIII — Additional Scenarios

144. Scenario 11 — Password Vault

Administrators store shared emergency credentials in an encrypted enterprise system that logs checkout and rotates passwords.

What solution is being used?

A. Credential/password vault
B. IDS
C. CDN
D. VLAN

Correct Answer

A

145. Scenario 12 — SSO

A user authenticates once and then accesses several authorized business applications without entering credentials separately for each.

What concept is represented?

A. SSO
B. DAC
C. VPN
D. Hashing

Correct Answer

A

146. Scenario 13 — SSO Compromise

A user's central SSO session is stolen.

Why is the incident especially serious?

A. Multiple connected applications may become exposed through one compromised session.

B. SSO prevents authentication.

C. SSO automatically removes authorization.

D. SSO eliminates logging.

Correct Answer

A

147. Scenario 14 — JIT

An administrator receives elevated privileges only for one approved maintenance window, after which the privileges automatically expire.

What concept is demonstrated?

A. Just-In-Time access
B. Permanent privilege
C. DAC only
D. Federation

Correct Answer

A

148. Scenario 15 — Session Theft

An attacker obtains a user's valid authenticated session token.

What is the PRIMARY concern?

A. The attacker may hijack the authenticated session without repeating normal authentication.

B. The password has automatically changed.

C. The account is automatically disabled.

D. The user becomes anonymous.

Correct Answer

A

149. Scenario 16 — Biometric

A fingerprint scanner incorrectly allows an unauthorized user to authenticate.

Which metric does this affect?

A. FAR
B. FRR
C. Throughput
D. Jitter

Correct Answer

A

150. Scenario 17 — Biometric Rejection

A legitimate user is repeatedly denied by an iris scanner.

Which metric is relevant?

A. FRR
B. FAR
C. ARO
D. ALE

Correct Answer

A

151. Scenario 18 — Role Change

An employee transfers from finance to human resources but retains finance access.

What problem is occurring?

A. Access creep
B. Strong separation of duties
C. Secure federation
D. Network segmentation

Correct Answer

A

152. Scenario 19 — Former Employee

An employee left the company two months ago, but the account remains active.

What is the PRIMARY problem?

A. Deprovisioning failure
B. Strong authentication
C. Excessive auditing
D. Data classification

Correct Answer

A

Detailed provisioning lifecycle controls will be covered in a later Domain 5 lesson.

153. Scenario 20 — Machine Identity

An application uses a developer's personal administrator password to access a production database.

What is the BEST improvement?

A. Establish a dedicated controlled service/workload identity with least privilege.

B. Share the password with additional developers.

C. Remove authentication.

D. Publish the password in documentation.

Correct Answer

A

Part XCIV — Common CISSP Exam Traps

154. Trap — Identification Is Authentication

No.

Identification:

“I am Alice.”

Authentication:

“Prove it.”

155. Trap — Authentication Means Authorized

No.

A valid employee can still be denied access to payroll.

156. Trap — Authorization Happens Before Authentication

Usually, identity must first be established sufficiently to make the authorization decision.

157. Trap — Two Passwords Equal MFA

No.

Two knowledge factors are not independent factor categories.

158. Trap — Biometrics Are Perfect

Biometrics involve probabilistic matching.

False acceptance and false rejection are possible.

159. Trap — Lower FRR Always Means More Secure

Reducing false rejection by loosening the threshold may increase false acceptance.

Security and usability must be balanced.

160. Trap — SSO Reduces Security Automatically

SSO can improve centralized control.

But it also concentrates authentication/session risk.

161. Trap — SSO Means Same Authorization Everywhere

No.

Applications still enforce their own appropriate authorization policies.

162. Trap — Service Accounts Do Not Need Owners

Every important non-human identity should have:

• purpose;

• owner;

• lifecycle.

163. Trap — Password Vault Solves All Credential Risk

Vaults improve control but themselves become high-value assets.

164. Trap — User Authentication Alone Is Enough

Modern access decisions may also evaluate:

• device;

• context;

• resource;

• risk.

165. Trap — Inside Network Means Identity Is Trusted

Network location alone should not establish identity.

166. Trap — Strong MFA Fixes Weak Identity Proofing

No.

Authentication proves control over issued authenticators.

It cannot retroactively prove the enrollment process identified the correct person.

167. Trap — Account Recovery Can Be Weak Because MFA Is Strong

No.

Recovery can become a bypass around stronger authentication.

168. Trap — Administrator Should Use Privilege for Email and Web Browsing

Separate ordinary and privileged activity where feasible.

169. Trap — More Access Is Better for Productivity

CISSP generally favors:

minimum access necessary for the legitimate business requirement.

Part XCV — Knowledge Check

170. Question 1

What does identification answer?

A. Who do you claim to be?
B. What are you allowed to do?
C. What did you do?
D. Which data should be encrypted?

Correct Answer

A

171. Question 2

What does authentication establish?

A. Confidence that the claimant controls appropriate authenticators for the claimed identity.
B. Business authorization.
C. Data ownership.
D. Backup scheduling.

Correct Answer

A

172. Question 3

What does authorization determine?

A. What an authenticated subject may do.
B. Who the subject claims to be.
C. Whether backups succeed.
D. Which network topology exists.

Correct Answer

A

173. Question 4

Which AAA component records user activity?

A. Accounting
B. Authentication
C. Authorization
D. Availability

Correct Answer

A

174. Question 5

Which is an example of a possession factor?

A. Hardware security key
B. Password
C. PIN
D. Passphrase

Correct Answer

A

175. Question 6

Which combination is MFA?

A. Password + smart card
B. Password + PIN
C. Password + security question
D. PIN + passphrase

Correct Answer

A

176. Question 7

What is identity proofing?

A. Establishing confidence in the real identity of an applicant.
B. Assigning firewall rules.
C. Encrypting credentials.
D. Logging out a user.

Correct Answer

A

177. Question 8

Which biometric metric represents unauthorized users incorrectly accepted?

A. FAR
B. FRR
C. MTTR
D. RTO

Correct Answer

A

178. Question 9

Which biometric metric represents authorized users incorrectly rejected?

A. FRR
B. FAR
C. RPO
D. ALE

Correct Answer

A

179. Question 10

What is the principle of least privilege?

A. Grant only permissions necessary for authorized duties.
B. Grant all employees administrator rights.
C. Deny all logging.
D. Share credentials.

Correct Answer

A

180. Question 11

Need to know primarily concerns:

A. Access to required information.
B. Network throughput.
C. Power availability.
D. Certificate expiration.

Correct Answer

A

181. Question 12

What does separation of duties attempt to prevent?

A. Excessive control of a sensitive process by one individual.
B. Authentication.
C. Network segmentation.
D. Encryption.

Correct Answer

A

182. Question 13

Which is the greatest concern with shared privileged accounts?

A. Reduced accountability.
B. Increased bandwidth.
C. Excessive encryption.
D. Strong identity proofing.

Correct Answer

A

183. Question 14

What should a service account have?

A. Defined purpose, owner, least privilege, and lifecycle.
B. Unlimited privilege.
C. Shared human password.
D. No monitoring.

Correct Answer

A

184. Question 15

What is the primary benefit of SSO?

A. One authentication experience can support access to multiple authorized services.
B. It eliminates authorization.
C. It removes session risk.
D. It eliminates identity proofing.

Correct Answer

A

185. Question 16

What is Just-In-Time access?

A. Privilege provided only when required and removed afterward.
B. Permanent administrative privilege.
C. Shared accounts.
D. Public access.

Correct Answer

A

186. Question 17

Which is a major session-security concern?

A. Theft of a valid session token.
B. VLAN numbering.
C. UPS capacity.
D. Fire suppression.

Correct Answer

A

187. Question 18

What is federation?

A. Trusted sharing of identity/authentication information across separately administered systems.
B. Local disk encryption.
C. Firewall clustering.
D. Data destruction.

Correct Answer

A

188. Question 19

What does AAL represent in NIST's digital-identity framework?

A. Authentication assurance level.
B. Asset availability level.
C. Application authorization list.
D. Annual audit limit.

Correct Answer

A

189. Question 20

Which statement is MOST accurate?

A. IAM must govern human and non-human identities throughout their lifecycle.
B. IAM applies only to employee passwords.
C. Authentication eliminates authorization requirements.
D. Network location proves identity.

Correct Answer

A

Part XCVI — Original CISSP-Style Practice Questions

190. Practice Question 1

A user successfully authenticates to the enterprise but attempts to access a classified project unrelated to their job.

Which control should prevent access?

A. Authorization
B. Identification
C. Authentication only
D. Accounting only

Correct Answer

A

191. Practice Question 2

A company wants administrators' actions to be individually traceable.

Which approach is BEST?

A. Issue unique administrative identities and log privileged activity.

B. Use one shared root account.

C. Disable logging.

D. Allow anonymous administration.

Correct Answer

A

192. Practice Question 3

An attacker convinces a help-desk employee to reset an executive's MFA enrollment without adequate identity verification.

What failed?

A. Identity verification/recovery procedures
B. Encryption
C. Network routing
D. Availability

Correct Answer

A

193. Practice Question 4

A user has permissions accumulated from five previous job roles.

Which control is MOST needed?

A. Access review and role-transition lifecycle management.

B. Stronger encryption only.

C. Additional network bandwidth.

D. More shared accounts.

Correct Answer

A

194. Practice Question 5

An administrator requires domain-level privilege for one maintenance task each month.

Which approach BEST reduces risk?

A. Just-In-Time privilege elevation.

B. Permanent domain-administrator membership.

C. Shared administrator password.

D. Disable auditing.

Correct Answer

A

195. Practice Question 6

A customer enters two passwords to access a banking system.

Management claims this is MFA.

Which statement is MOST accurate?

A. It is not true MFA because both credentials are knowledge factors.

B. It is automatically three-factor authentication.

C. Passwords are possession factors.

D. Factor categories do not matter.

Correct Answer

A

196. Practice Question 7

A company wants to reduce the number of reusable passwords while improving resistance to credential phishing.

Which technology should be considered?

A. Cryptographic passwordless authenticators such as appropriately implemented passkeys/security keys.

B. Shared passwords.

C. Telnet.

D. Public password spreadsheets.

Correct Answer

A

NIST Revision 4 explicitly incorporates modern syncable authenticators such as passkeys into its authentication guidance.

197. Practice Question 8

A service account belongs to an application that was retired two years ago, but the account remains enabled with privileged access.

What is the PRIMARY concern?

A. Orphaned non-human identity with unnecessary privilege.

B. Strong availability.

C. Excessive MFA.

D. Too much federation.

Correct Answer

A

198. Practice Question 9

A user authenticates once to a central identity service and then accesses several cloud applications.

Which architecture is MOST directly involved?

A. SSO/federated identity.

B. DAC only.

C. Physical security.

D. Network cabling.

Correct Answer

A

199. Practice Question 10

A company wants access decisions to consider user identity, device condition, location, and current threat risk.

Which approach BEST reflects that objective?

A. Contextual/risk-aware authentication and authorization.

B. Static shared password.

C. Unrestricted network trust.

D. Anonymous access.

Correct Answer

A

Part XCVII — IAM Memory Table

Part XCVIII — Authentication Factors Table

Remember:

MFA normally requires independent factor categories.

Part XCIX — Biometric Memory Table

Part C — Account-Type Comparison

Part CI — Modern Identity Architecture

200. Integrated IAM Model

                 IDENTITY SOURCE

                       │

                       ▼

                 IDENTITY PROOFING

                       │

                       ▼

                  REGISTRATION

                       │

                       ▼

               AUTHENTICATOR ISSUE

                       │

                       ▼

                 AUTHENTICATION

                       │

                       ▼

                 AUTHORIZATION

                       │

                ┌──────┼───────┐

                ▼      ▼       ▼

              APP    DATA    SERVICE

                │      │       │

                └──────┼───────┘

                       ▼

                   ACCOUNTING

                       │

                       ▼

                  ACCESS REVIEW

                       │

                       ▼

               MODIFY / TERMINATE

CISSP Exam Focus

For IAM questions, think in this order:

WHO OR WHAT?

      ↓

IS THE IDENTITY VALID?

      ↓

HOW IS IT AUTHENTICATED?

      ↓

WHAT ACCESS IS REQUIRED?

      ↓

IS THAT ACCESS MINIMAL?

      ↓

HOW IS ACTIVITY RECORDED?

      ↓

WHEN SHOULD ACCESS CHANGE?

      ↓

WHEN SHOULD ACCESS END?

Remember:

• Domain 5 currently represents 13% of the CISSP examination.

• Objective 5.1 covers physical and logical access to information, systems, devices, facilities, applications, and services.

• Identification is a claim.

• Authentication verifies the claimant.

• Authorization determines permitted activity.

• Accounting records activity.

• Accountability requires attributable identities.

• Shared accounts generally weaken accountability.

• Identity proofing occurs before credential-based authentication can be meaningfully trusted.

• NIST's current final Digital Identity Guidelines are SP 800-63 Revision 4, published in July 2025.

• Revision 4 separately addresses identity proofing, authentication, and federation.

• MFA requires more than simply entering two passwords.

• Passwordless authentication is explicitly included in the current CISSP outline.

• Modern passkeys use cryptographic authentication rather than reusable passwords.

• Biometrics have false-acceptance and false-rejection tradeoffs.

• Least privilege limits actions.

• Need to know limits information exposure.

• Separation of duties divides sensitive responsibilities.

• Privileged identities need stronger protection and monitoring.

• Service accounts are identities and require lifecycle management.

• SSO improves usability and centralized authentication but increases the importance of protecting the central authentication/session environment.

• JIT access reduces standing privilege.

• Session tokens must be protected because session theft can bypass normal login steps.

• Account recovery should not become a weak bypass around strong MFA.

• Machines, workloads, and applications require managed identities just as humans do.

• Identity federation allows trusted identity information to cross separately administered systems.

• Strong IAM is a lifecycle—not just a login screen.

Lesson Summary

Lesson Seventeen established the foundation of Identity and Access Management.

The fundamental IAM process is:

IDENTIFY

    ↓

AUTHENTICATE

    ↓

AUTHORIZE

    ↓

ACCESS

    ↓

ACCOUNT

    ↓

REVIEW

    ↓

TERMINATE

You learned the AAA model:

AUTHENTICATION

Who are you?

      ↓

AUTHORIZATION

What may you do?

      ↓

ACCOUNTING

What did you do?

You learned that authentication begins before the login screen.

Identity must first be established:

APPLICANT

   ↓

IDENTITY PROOFING

   ↓

REGISTRATION

   ↓

ENROLLMENT

   ↓

CREDENTIAL / AUTHENTICATOR

   ↓

AUTHENTICATION

NIST's current SP 800-63 Revision 4 suite reflects this separation among identity proofing, authentication, and federation.

You examined authentication factors:

KNOW

 +

HAVE

 +

ARE

and learned that multiple values from the same category do not automatically provide true multifactor authentication.

You studied:

• passwords;

• security keys;

• passkeys;

• passwordless authentication;

• biometrics;

• FAR;

• FRR;

• CER/EER.

You then examined authorization principles:

LEAST PRIVILEGE

       +

NEED TO KNOW

       +

SEPARATION OF DUTIES

       =

CONTROLLED ACCESS

You learned that IAM also governs non-human identities:

USERS

DEVICES

SERVICES

APPLICATIONS

WORKLOADS

Finally, you examined:

• credential management;

• password vaults;

• SSO;

• session management;

• JIT access;

• identity federation.

The central Lesson Seventeen principle is:

Trust should never begin with an account or a password. Effective IAM establishes identity, authenticates with appropriate assurance, authorizes only the minimum required access, records activity, continually reassesses access, and removes trust when it is no longer justified.

Exam Readiness Check

Before continuing to Lesson Eighteen, make sure you can explain without reviewing:

• What IAM means.

• The difference between an identity and an account.

• What a subject is.

• What an object is.

• What identification means.

• What authentication means.

• What authorization means.

• What accounting means.

• What accountability means.

• The AAA model.

• Why shared accounts weaken accountability.

• How IAM applies to information.

• How IAM applies to systems.

• How IAM applies to devices.

• How IAM applies to facilities.

• How IAM applies to applications.

• How IAM applies to services.

• What identity proofing means.

• Why authentication cannot correct weak identity proofing.

• What registration means.

• What enrollment means.

• What credentials and authenticators are.

• The three classic authentication-factor categories.

• What constitutes true MFA.

• Why two passwords are not true MFA.

• What passwordless authentication means.

• What a passkey is conceptually.

• Why phishing resistance matters.

• What FAR means.

• What FRR means.

• What CER/EER means.

• What groups are.

• What roles are.

• How roles and groups differ.

• What least privilege means.

• What need to know means.

• What separation of duties means.

• Why privileged accounts require stronger controls.

• Why separate ordinary and privileged accounts.

• What a service account is.

• Why non-human identities require ownership and lifecycle management.

• What a credential vault does.

• What SSO does.

• The security benefit and risk of SSO.

• What session management means.

• Why stolen session tokens are dangerous.

• What idle timeout means.

• What step-up authentication means.

• What JIT access means.

• Why standing privilege increases risk.

• What identity federation means.

• What IAL, AAL, and FAL mean conceptually.

• Why recovery processes are part of authentication security.

• What dormant and orphan accounts are.

• Why break-glass accounts require strong monitoring.

• Why IAM increasingly includes users, devices, applications, services, and workloads.

Coming Next

Lesson Eighteen: Authentication Systems, Federation, SSO, and Identity Protocols

Lesson Eighteen will deepen Objectives 5.2, 5.3, and 5.6.

It will cover:

• authentication architecture;

• centralized authentication;

• decentralized authentication;

• LDAP;

• Active Directory concepts;

• Kerberos;

• Kerberos entities;

• KDC;

• Authentication Server;

• Ticket Granting Server;

• Ticket Granting Ticket;

• service tickets;

• Kerberos workflow;

• Kerberos security risks;

• NTLM concepts;

• RADIUS;

• TACACS+;

• Diameter;

• certificate-based authentication;

• smart cards;

• FIDO2;

• WebAuthn;

• passkeys;

• federation;

• Identity Providers;

• Service Providers/Relying Parties;

• SAML;

• assertions;

• OAuth 2.0;

• delegated authorization;

• OpenID Connect;

• authentication versus authorization;

• identity tokens;

• access tokens;

• SSO;

• federation trust;

• on-premises federation;

• cloud federation;

• hybrid identity;

• SCIM introduction;

• identity brokers;

• federation risks;

• original diagrams;

• exam traps;

• CISSP-style scenarios.

The central Lesson Eighteen question will be:

How do authentication and federation technologies allow identities to prove who they are and securely access services across organizational, cloud, and application boundaries?

Publication and Independence Notice

This lesson is independently developed educational material for the SierraTec Secure CISSP Certification Preparation Course.

CISSP is administered by ISC2. SierraTec Secure's course is independent certification-preparation material and should not be represented as official ISC2 training unless separately authorized.

Current Domain 5 scope and examination weighting were verified against the official ISC2 CISSP Certification Exam Outline. Domain 5 currently represents 13% of the examination and includes physical/logical access, authentication strategy, federation, authorization mechanisms, identity provisioning lifecycle, and authentication systems.

Digital-identity concepts were updated against the final NIST SP 800-63 Revision 4 suite published in July 2025. Revision 4 supersedes Revision 3 and addresses identity proofing and enrollment, authentication and authenticator management, and federation and assertions.

The SierraTec Secure IDENTITY framework, diagrams, scenarios, knowledge checks, tables, and practice questions are original instructional material and are not actual, recalled, leaked, or official CISSP examination questions.