Lesson 7 of 12 — Identity & Access Management
Authentication factors, MFA, SSO, federation, the AAA framework, access control models, privilege creep, the Joiner-Mover-Leaver lifecycle, and Privileged Access Management — controlling who can access what, when, and for how long.
Every security control you have studied so far — firewalls, IDS/IPS, DLP, endpoint protection — ultimately protects resources from people who should not have access to them. Identity and Access Management is the discipline that defines who those people are, what they are allowed to do, and when their access should end. Without strong IAM, every other security control can be bypassed by an attacker who obtains a valid credential.
IAM is one of the most heavily tested areas of the Security+ exam because it combines technical mechanisms (MFA, SSO, Kerberos) with organizational processes (user provisioning, access reviews, offboarding). The scenario questions in this domain test your ability to identify IAM failures in realistic situations — a user who still has access six months after changing departments, an admin account with persistent privileges that should be temporary, a contractor who left but whose VPN account is still active. By the end of this lesson, you will recognize these patterns instantly and know exactly which control addresses each failure.
A hospital network administrator notices that Dr. Chen — who transferred from Oncology to the Emergency Department six months ago — still has full access to the oncology patient database, chemotherapy medication orders, and the departmental budget system. Last week, she was assigned ED access on top of her existing rights. Meanwhile, a former IT contractor who left the organization in January still has an active VPN account with no owner.
Discussion prompt: What IAM principles were violated? What could go wrong? Which controls should have prevented each failure?
The three pillars of access control — and the five factor types that define what MFA really means.
AAA: prove who you are (Authentication), determine what you can do (Authorization), log what you did (Accounting). MFA requires credentials from two distinct factor categories. Password + PIN = NOT MFA. Password + TOTP token = MFA.
One credential for many systems — and the protocols (Kerberos, SAML, OAuth) that enable trust within and across organizational boundaries.
SSO = single org (Kerberos/LDAP). Federation = cross-org (SAML, OAuth 2.0, OIDC). DAC, MAC, RBAC, ABAC each assign permissions differently — RBAC aligns to job roles and is most exam-tested. Least privilege limits blast radius of any compromise.
Joiner-Mover-Leaver governance, privilege creep prevention, orphaned account risk, and Privileged Access Management for protecting admin credentials.
The Joiner-Mover-Leaver lifecycle must revoke old access during moves and all access on departure. Orphaned accounts are standing attack surfaces. PAM vaults admin credentials, enforces JIT access, records sessions, and rotates passwords automatically after each use.
The foundational access control model and the five types of authentication credentials
Every enterprise access decision is governed by the AAA framework. Before any resource is accessed, a system must answer three questions: who is this user? what are they allowed to do? and what did they do while they were here? Authentication, Authorization, and Accounting each answer one of these questions.
The process of verifying that a user, device, or system is who or what it claims to be. Authentication happens before any authorization decision can be made.
Determining what an authenticated identity is permitted to do. Authorization is not the same as authentication — a fully authenticated user may still be denied access if they lack the required permissions.
Logging and auditing what authenticated, authorized users actually do — creating the audit trail that supports forensic investigation, compliance reporting, and insider threat detection.
MFA is not simply "two passwords." It requires credentials from two or more distinct factor categories. Combining factors from the same category is two-step verification, not true multi-factor authentication.
Password + PIN = NOT MFA — both are Type 1 (Something you know). Two facts are not two factors.
Password + SMS code = Weak MFA — SMS is Type 2 but vulnerable to SIM-swapping. Attackers convince the mobile carrier to transfer your number to a SIM they control.
Password + TOTP app = Strong MFA — Time-based One-Time Passwords generated locally are not interceptable via SIM-swap.
Password + FIDO2 hardware key = Strongest MFA — Phishing-resistant. The key performs a cryptographic challenge-response that is domain-bound — a fake login page cannot steal a FIDO2 response.
Authenticate once, access many — and choose the right permission model for your organization
Users authenticating to dozens of systems individually creates password fatigue, reuse, and weak credentials. SSO and Federation solve this — but with different scopes and different risk profiles. Access control models determine how permissions are assigned once a user is authenticated.
One authentication event grants access to multiple systems within a single trust boundary — typically an Active Directory domain. The user logs in once; Kerberos tickets or LDAP sessions are used to access integrated internal systems transparently.
Identity trust extended across organizational boundaries — a user authenticates with their home organization's Identity Provider (IdP) and can access external services (Service Providers / SPs) without separate credentials.
| Feature | SSO | Federation |
|---|---|---|
| Scope | Single organization / domain | Cross-organization, cloud services |
| Primary protocols | Kerberos, LDAP | SAML, OAuth 2.0, OIDC |
| Key risk | Single point of authentication failure | Trust chain compromise via IdP |
| Best analogy | Master key for all doors in your building | TSA PreCheck trusted across all airlines |
The resource owner decides who has access. Each object (file, folder) has an Access Control List (ACL) that the owner controls.
Access is controlled by the system based on security labels and clearance levels. Users cannot override the system's access decisions — even resource owners cannot grant access beyond their clearance level.
Permissions are assigned to job roles; users inherit permissions through role membership. Role changes automatically adjust access — the most common model in enterprise environments and the most tested on Security+.
Access decisions are based on attributes — characteristics of the user, resource, and environment evaluated at access time. More granular than RBAC.
Provisioning, privilege creep, deprovisioning, orphaned accounts, and protecting the crown jewels of the environment
Identity governance answers the question: does the right person still have the right access for the right reason? This question must be answered continuously — not just at hire — because identities change throughout their lifecycle. Privileged accounts demand an additional tier of control because compromising an admin account gives an attacker far greater access than any other initial foothold.
When a new user joins, access should be provisioned through a documented workflow using role-based templates — not manual, ad-hoc assignment. The provisioning process must enforce least privilege from day one.
When a user transfers departments or changes roles, the correct process is: remove old role access FIRST (or simultaneously), then add new role access. Adding new access without removing old access creates privilege creep — and every mover event compounds it.
Deprovisioning is time-critical. The moment an employee's departure is known — whether voluntary resignation or termination — the deprovisioning process should begin immediately, not wait until their final physical day. The correct order of operations:
Immediate actions (same day as departure notice):
Post-departure (within 30 days):
Privileged accounts — domain administrators, root accounts, service accounts, database administrators — are the highest-value targets in any environment. A threat actor who obtains a privileged credential gains the ability to access or modify any system that account can reach. Standard MFA and access controls are insufficient — privileged accounts require their own security tier.
Classify each IAM control or concept into its correct category
Select a real-world IAM scenario and identify the correct control, failure type, or remediation
Select the best answer for each question, then submit for graded feedback
