4.6 Given a scenario, implement and maintain identity and access management

★ Starred in your notes: Kerberos is SSO · EAP · RADIUS · TACACS+ · SID (-500 admin / -501 guest) · key escrow vs. recovery agent · GPO order.

Breakdown 1 — Account lifecycle

• Provisioning / de-provisioning: create with least privilege on hire/role change; disable immediately on departure (offboarding). Automate via HR feeds (4.7).
• Permission assignments and implications: every extra permission is attack surface; review regularly; avoid permission creep.
• Identity proofing: verifying a person is who they claim before issuing credentials (ID documents, knowledge checks).
• Attestation: periodic review where managers confirm their people's access is still appropriate. (Class also used "attestation" for a trusted system proving its state — EAL/TPM — that's 1.4/3.1 usage.)

From class — account types: user, privileged, shared/generic (airport kiosk — avoid; no accountability), guest, service. Credential management: keychain/password managers, KMS (key management service), PAM (privileged access management — "holds people accountable"). Distribution groups = mail groups (not security groups).

Windows specifics: SID — security identifier; RID -500 = built-in Administrator, -501 = Guest. NTFS uses ACEs (access control entries) in the ACL. AGDLP: put Accounts in Global groups, global groups in Domain Local groups, assign Permissions to the domain local group. Share permissions: Read, Change/RW, Full Control; combined with NTFS the most restrictive wins.

Breakdown 2 — Federation and SSO

Term	Know
SSO	Log in once, access many systems — Kerberos is SSO (class): you get a ticket (TGT from the KDC) and use it for services; clocks must be synced (NTP), port 88
Federation	Trust between organizations' identity providers so one login works across them (partner portals, cloud apps); "transitive trust: you trust me, you trust her"
LDAP	Directory protocol (AD); 389 / LDAPS 636
SAML	XML-based federation for web SSO: IdP authenticates, SP consumes the assertion
OAuth 2.0	Delegated authorization ("delegate permission" — class): let app X access your data at Y without your password
OpenID Connect	Authentication layer on top of OAuth (the "Log in with Google" part)
Interoperability	Standards (SAML/OIDC/SCIM) so systems can share identity

Breakdown 3 — Access control models (class Chapter 8)

Model	Rule	Example
Discretionary (DAC)	Owner controls who gets access	NTFS permissions set by the file owner
Mandatory (MAC)	Administrator/military, labels — system enforces clearance vs. classification; users can't change it. Bell-LaPadula: no read up, no write down (your notes said "no read up, no read down" — the second rule is no write down)	SELinux, classified systems
Role-based (RBAC)	Permissions attached to roles (job functions)	"Help desk" role
Rule-based	System-wide rules regardless of identity — firewall ACLs, MAC-address filters (class)	Block after 6 p.m.
Attribute-based (ABAC)	Decisions from attributes: time of day, location, device, department	Allow if in office AND on managed laptop
Time-of-day restrictions	Login only in business hours
Least privilege	Minimum necessary, always

From class — location controls: geofencing (virtual boundary — the room/building), geolocation (IP-based location). Both feed ABAC/adaptive identity.

Breakdown 4 — Multifactor authentication

Factors: something you know (password/PIN), have (token, smart card, phone), are (biometric — inherence), somewhere you are (location).

Factor / attribute	Includes
Something you know (knowledge)	Password, PIN, passphrase, security questions, CAPTCHA response
Something you have (possession)	Smart card / CAC / PIV, USB security key (FIDO2), hardware token, RFID badge, phone (TOTP app, push), key
Something you are (inherence)	Fingerprint, face, iris/retina, voiceprint, vein, DNA
Somewhere you are (location)	GPS, geofencing, IP geolocation, Wi-Fi/cell location
Something you do (behavior — attribute)	Handwriting, signature dynamics, typing rhythm, gait
Something you exhibit (attribute)	Personal traits, behavior patterns (UEBA)
Someone you know (association)	Web of trust, vouching, digital signature from a trusted party

The exam names the first four as factors; the last three are attributes (ronbert's extended list). Two of the same factor (password + PIN) is not MFA (class: "multi-factor = 2 or more different factors").

Implementations: biometrics (fingerprint, face, iris, gait = walking — class), hard tokens (key fob, YubiKey security key/FIDO2), soft tokens (authenticator app: TOTP time-based, HOTP counter-based), SMS codes (weakest — SIM swap).

From class — biometric limits: Type I = False Rejection Rate (FRR) — legit user denied; Type II = False Acceptance Rate (FAR) — impostor accepted (worse); CER/crossover error rate — where FRR = FAR; lower CER = better system.

Breakdown 5 — Password concepts and PAM

Best practices (NIST SP 800-63B — class): length over complexity; screen against breached lists; no forced periodic expiration unless compromised; block reuse (history); minimum age (stops immediately cycling back — class); rate-limit/lock out. Password managers generate/store unique passwords. Passwordless = FIDO2 security keys, passkeys, Windows Hello.

Privileged access management tools: just-in-time permissions (elevate only when needed, then revoke), password vaulting (admin creds checked out from a vault, rotated after use), ephemeral credentials (short-lived certs/tokens that expire automatically).

Breakdown 6 — Authentication protocols (class Chapter 7 Module B)

Protocol	Know
PAP	Clear-text password — don't use
CHAP / MS-CHAP	Challenge/response — legacy; don't use
EAP	Extensible framework carrying the real method (EAP-TLS, PEAP…) — used by 802.1X and wireless
802.1X	Supplicant (client) → authenticator (switch/AP) → authentication server (RADIUS)
RADIUS	Full AAA, UDP 1812/1813, encrypts only the password
TACACS+	Cisco device admin, TCP 49, encrypts the whole payload — "if the question mentions encryption of the entire session → TACACS+" (class)
Kerberos	Tickets (TGT → service ticket), KDC, port 88, needs NTP sync
SAML / OAuth / OIDC	Web federation (above)

Exam tip: "Owner decides" → DAC. "Labels/clearances" → MAC. "Firewall rule" → rule-based. "Depends on time/location/device" → ABAC. "Admin creds checked out for 1 hour" → PAM JIT/vault. "SMS code + password" → MFA (have + know). "Fingerprint + face" → not MFA (both inherence). "One login for many partner sites" → federation/SAML. "App wants to post to your Twitter" → OAuth.

Quick self-check

• Which is worse, FAR or FRR? (FAR — impostor accepted.)
• RADIUS vs. TACACS+ transport and encryption? (UDP/password-only vs. TCP/whole body.)
• What does SID -500 mean? (Built-in Administrator.)
• AGDLP stands for? (Accounts, Global, Domain Local, Permissions.)