Dennis Academy crestDENNIS ACADEMY

4.0 Security Operations

Identity and Access Management

Sign in to track progress

Simple explanation

IAM is the full lifecycle of controlling who (or what) can access what, from the moment an account is created to the moment it's removed — plus the mechanisms (passwords, MFA, SSO) used to actually verify identity along the way.

Technical explanation

Lifecycle: provisioning (creating an account/access) and de-provisioning (removing it — a commonly missed step that leaves former employees or contractors with lingering access).

Permission assignments and implications — every grant of access is also a grant of potential misuse; permissions should map tightly to actual job function.

Identity proofing — verifying someone actually is who they claim to be before an account is created for them.

Federation — allowing identity from one system to be trusted by another, without creating a separate account in each (a user logs into their organization's identity provider once, and that trust extends to partner systems).

Single Sign-On (SSO) and its underlying protocols: LDAP (Lightweight Directory Access Protocol — a protocol for querying/managing directory information, like an internal user directory), OAuth (an authorization framework — grants a third-party app limited access without sharing the actual password), SAML (Security Assertion Markup Language — an XML-based standard for exchanging authentication/authorization data between an identity provider and a service, common in enterprise SSO).

Interoperability — different systems being able to work together using these shared standards.

Attestation — periodically confirming that granted access is still appropriate (a manager re-certifying their team's permissions).

Access control models: mandatory (MAC) (access determined by fixed system-enforced labels, not owner discretion — common in military/government), discretionary (DAC) (the resource owner decides who gets access), role-based (RBAC) (access tied to job role), rule-based (access determined by defined if/then rules), attribute-based (ABAC) (access determined by a combination of attributes — user, resource, environment), time-of-day restrictions, and least privilege (the overarching principle behind all of them).

MFA implementations and factors: something you know (password), something you have (token, phone), something you are (biometric), somewhere you are (location-based), something you do (behavioral). True MFA requires factors from different categories, not just two passwords.

Password concepts: best practices around length, complexity, reuse prevention, expiration, and age; password managers; and passwordless authentication (e.g., biometrics or hardware keys replacing passwords entirely).

Privileged Access Management (PAM): just-in-time permissions (elevated access granted only for the duration needed, then automatically revoked), password vaulting (privileged credentials stored and rotated centrally, not memorized/shared), ephemeral credentials (short-lived, auto-expiring access rather than standing permanent privilege).

Synonyms / related terms

| Term | Means | |---|---| | RBAC | Role-Based Access Control | | ABAC | Attribute-Based Access Control | | PAM | Privileged Access Management |

Concept Check

"A user authenticates with a password and a security question about their mother's maiden name. Is this true multi-factor authentication?" No — both are "something you know." True MFA requires factors from different categories (e.g., password + a physical token), not simply two pieces of knowledge.

Interview-style Q&A

Q: Why is de-provisioning as important as provisioning, even though it gets less attention? A: "Provisioning failures are usually noticed quickly — someone can't do their job. De-provisioning failures are silent — a former employee's account just... still works, and nobody notices until it's misused or an audit catches it. It's a classic gap between two different teams' handoff (HR offboarding vs. IT access removal), which is exactly why it needs to be a formal, checked step, not an assumption."

Memory trick

"MAC is Mandatory, DAC is Discretion, RBAC is Role" — say each model's name alongside the word it's built from, and the definitions stop needing separate memorization.