CySA+
  • CySA+ CS0-002 Exam Objectives
  • Threat Intelligence Cycle
  • Intelligence Sources
  • Security Intelligence Sharing
  • Threat Classification and Threat Actors
  • Threat Research and Indicators of Compromise
  • Attack Frameworks and The Cyber Kill Chain
  • Defining Threat Modeling and Threat Hunting
  • Vulnerability Identification and Validation
  • Vulnerability Scan Results and CVSS Scores
  • Nmap and Enumeration
  • Security Controls
  • Defense in Depth Security Baselines
  • Security Trend Analysis
  • Remediation Issues
  • Asset, Change, and Configuration Management
  • Software Development Lifecycle & Development Models
  • Software Assessment and Code Review
  • Mitigating Attack Types Part 1
  • Mitigating Attack Types Part 2
  • Mitigating Attack Types Part 3
  • Password Cracking and Hashing
  • Privilege Escalation & Man-in-the-Middle
  • Network Based IoCs
  • Host Based IoCs
  • Network Architecture and Segmentation
  • Network Traffic, Packet, and Protocol Analysis
  • Pentesting and Active Defense
  • Firewalls
  • URL Analysis & DNS in Malware
  • Network Access Control and Port Security
  • Identity and Access Management (IAM)
  • Web Application Scanners
  • SSL/TLS Digital Certificate Management
  • Mobile Threats
  • Email Threats and Mitigation
  • Data Loss Prevention (DLP)
  • Endpoint Security and Behavior Analysis
  • Hardware Assurance
  • Blackholes and Sinkholes
  • IoT, Embedded Systems & ICS/SCADA Threats
  • Log Analysis & Continuous Security Monitoring
  • SIEM and Event Correlation
  • Malware Analysis
  • Cloud Models and Service Threats
  • Cloud Automation and Other Cloud Threats
  • VDI, Containers, and Microservices
  • CI/CD, IaC, DevOps
  • AI and Machine Learning
  • Digital Forensics
  • Technical Controls for Securing Data
  • Non-Technical Controls for Securing Data
  • Security Policies and Procedures
  • Continuity Planning and Risk Assessment
  • Incident Response Phases and Communication
Powered by GitBook
On this page

Identity and Access Management (IAM)

  • It’s all about accounts and permissions.

  • Account Types

    • User accounts

    • Endpoint accounts

    • Server accounts

    • Software accounts

    • Roles

  • IAM System Responsibilities

    • Store and keep track of accounts

    • Onboarding and offboarding

    • Daily management tasks

    • Auditing activity

    • Scanning for threats (ideally)

    • Maintaining compliance

  • Two Big Problems with IAM

    • Root/administrator users

    • Shared accounts

  • Password Policy

    • Guideline that tells users how to protect their credentials

    • Password length, complexity, expiry

    • Can be enforced by OS

    • NIST SP 800-63B

    • Some things cannot be technically enforced

  • Mitigating Password Reuse

    • Lots of accounts, lots of passwords

    • SSO (Signle Sign-On)

      • Sign in once, gain broad access

      • Kerberos in Windows.

      • Pro: one password to remember

      • Con: one password to compromise

    • MFA (multifactor authentication

      • Something you know

      • Something you have

      • Something you are

  • Privilege Management

    • Privileges are tied to the authorization function

    • Least privilege principle

    • Separation of duties

    • DAC – Discretionary Access Control

      • Creator of resource is initial owner

      • Owner can grant access to others

      • Example: file system permissions

    • MAC – Mandatory Access Control

      • Clearance levels and labels

      • Users can access objects at their clearance level or below

      • Compartments

      • Enforced by the system (non-discretionary)

      • Example: SELinux, AppArmor, military, secret service

    • RBAC – Role Based Access Control

      • Move the discretionary part of DAC to the admins

      • Privileges assigned per roles

      • Example: user groups with permissions attached

    • ABAC – Attribute Based Access Control

      • Based on multiple subject and object attributes

  • Directory Services

    • Database for IAM

    • Manages authentication and authorization

    • Can be queried (AAA, Radius, TACACS+)

    • Windows AD, OpenLDAP, Apache DS, OpenDS, RedHat Directory

  • Federation

    • Extending SSO across companies or services

    • Service provider (SP) trusts a third-party Identity Provider (IdP)

    • Issues with password rreset/recovery

  • SAML, OAuth, OpenID

    • SAML

      • XML framework

      • Exchanges security info: authentication, entitlement, attributes

      • Allows SSO, federation

      • Communication based on assertions

        • Authentication assertions

        • Attribute assertions

    • OAuth, OpenID: Sharing profile-related info between web apps

      • App to app interaction and REST APIs

      • Oauth focuses on authentication

      • OpenID focuses on authorization

  • IAM monitoring and logging

    • Accounting

    • Manual review

    • Privilege Creep – as users change roles, they get more permissions than they need

PreviousNetwork Access Control and Port SecurityNextWeb Application Scanners

Last updated 2 years ago