Define identity concepts Flashcards
How has digital collaboration changed the landscape of enterprise security?
With remote work, BYOD, and SaaS applications, the traditional on-premises network perimeter has expanded, necessitating a shift in security models.
Why is identity considered the new security perimeter?
As traditional network boundaries dissolve with remote work and cloud services, securing access based on identity rather than location has become crucial.
Define Identity in the context of cybersecurity.
Identity refers to the characteristics or information used to authenticate and authorize someone or something within an organization’s systems.
What are the four pillars of identity infrastructure?
Administration - Managing the creation, modification, and deletion of identities.
Authentication - Verifying that users are indeed who they claim to be.
Authorization - Determining what resources an authenticated identity can access.
Auditing - Monitoring and logging activities for compliance and security analysis.
Explain the role of Administration in identity infrastructure.
Administration involves the lifecycle management of identities, including how they’re created, updated, or removed, and under what policies.
What is the purpose of Authentication in identity security?
Authentication ensures that only legitimate users have access to systems by verifying their credentials, often through methods like passwords or multi-factor authentication.
Describe Authorization in the context of identity security.
Authorization controls what an authenticated user can do within the system, specifying rights and permissions based on their identity.
Why is Auditing important in identity management?
Auditing tracks activities to ensure compliance, detect security anomalies, and provide accountability for actions taken within the system.
How do SaaS applications affect the security perimeter?
SaaS applications extend the security perimeter outside the corporate network, as these services are often hosted in the cloud and accessed from various locations.
What security implications does the use of IoT devices bring?
IoT devices introduce new vulnerabilities due to their connectivity, requiring identity-based security to manage access and control.
What is Authentication?
Authentication is the process of verifying that someone or something is who or what it claims to be. For example, using a password or ID to prove identity.
Give an example of Authentication in everyday life.
When you buy something with a credit card, showing a driver’s license to prove you are the cardholder is an authentication process.
What does AuthN stand for?
AuthN stands for Authentication.
How does Authentication work in computer systems?
Typically, a user enters a username (to identify who they are) and a password (which should be known only to that user) to gain access to the system.
What is Authorization?
Authorization involves determining what resources a user can access or what actions they can perform after they have been authenticated.
Provide an example of Authorization using a hotel scenario.
After checking in (authentication), a hotel guest receives a keycard (authorization) which only allows access to certain areas like their room.
What does AuthZ stand for?
AuthZ stands for Authorization.
How does Authorization relate to Authentication?
Authorization comes after authentication. Once an identity is verified (authenticated), the system then decides what that identity is allowed to do or access.
Why are both Authentication and Authorization necessary?
Authentication confirms the identity, while Authorization ensures that the identified user has permission to perform certain actions or access specific resources, providing a layered security approach.
Can one have Authorization without Authentication?
No, generally, Authorization depends on Authentication; first, you verify identity, then you grant access based on permissions associated with that identity.
