2.1.5. Identity and Access Management
💡 First Principle: Identity is the new perimeter — in cloud and hybrid environments where traditional network boundaries are fluid, controlling who can access what is more reliable than controlling where traffic comes from.
Credential theft is the single most common initial access technique. Once an attacker has valid credentials, they look exactly like a legitimate user to most security controls. This is why identity controls — MFA, PAM, SSO with anomaly detection — are so critical: they add friction to credential abuse and create detection signals when credentials are used anomalously.
MFA (Multi-Factor Authentication) requires two or more factors: something you know (password), something you have (token, phone), something you are (biometrics). MFA defeats password spray and credential stuffing attacks — knowing the password isn't enough. However, MFA can be bypassed via MFA fatigue attacks (flooding the user with push notifications until they approve one), SIM swapping, and adversary-in-the-middle proxy attacks.
SSO (Single Sign-On) authenticates once and grants access to multiple systems via token. Security benefit: users maintain one strong credential instead of many weak ones; authentication events centralize for monitoring. Risk: a compromised SSO credential grants access to everything it's federated with.
Federation extends identity trust across organizational boundaries — enabling users from one organization to authenticate to another's systems using their own identity provider. SAML and OIDC (an identity layer built on OAuth, which by itself is an authorization framework) are the dominant protocols. Security concerns include token hijacking and misconfigurations in attribute mapping.
PAM (Privileged Access Management) controls and monitors high-privilege accounts (domain admins, root, service accounts). Core PAM capabilities:
- Just-in-time access (privileges granted only when needed, then revoked)
- Session recording (full video and keystroke logs of admin sessions)
- Credential vaulting (admin passwords stored in PAM; users check out credentials rather than knowing them permanently)
- Dual control (two administrators must approve sensitive actions)
CASB (Cloud Access Security Broker) sits between users and cloud services to enforce security policy — visibility into what SaaS apps are being used (shadow IT discovery), data loss prevention for cloud data, and authentication enforcement.
| IAM Control | Primary Threat Defeated | Residual Risk |
|---|---|---|
| MFA | Credential theft, password spray | MFA fatigue, SIM swap, AITM proxy |
| PAM | Insider threat, lateral movement to admin | Over-privileged service accounts outside PAM scope |
| SSO + SIEM | Anomalous login detection | SSO token theft bypasses individual app auth |
| CASB | Shadow IT, cloud data exfil | Encrypted traffic inspection limitations |
| Passwordless | Phishing, keylogging | Device compromise |
⚠️ Exam Trap: SSO creates a "single point of compromise" risk — if the identity provider is breached, all federated applications are exposed. This doesn't make SSO bad (the centralization also centralizes monitoring and security controls), but it means protecting the IdP is critical.
Reflection Question: An attacker steals a developer's SSO session token from their browser cookie store. The developer has MFA enabled. Has MFA been "bypassed"? Explain what happened and what additional control would have detected or prevented the token theft.
