IAM v2

Question 1

Open Authorization (OAuth):

Answer 1

• Definition: An open standard framework that allows applications to access user data without sharing user credentials, often used for granting third-party applications limited access to user accounts.

Question 2

Access Control (system):

Answer 2

• Definition: A system that manages and enforces policies and permissions, determining who can access what resources or perform specific actions within an organization’s environment.

Question 3

Privilege creep:

Answer 3

• Definition: The gradual accumulation of excessive privileges or access rights by users or accounts over time, potentially leading to security risks.

Question 4

Self-service ID Management:

Answer 4

• Definition: A system that allows users to manage and update their own identity information, reducing the administrative burden on IT departments.

Question 5

Access tokens:

Answer 5

• Definition: Tokens that provide temporary access rights to specific resources or services, often used in OAuth and other authentication systems.

Question 6

MFA vs. SFA (Multi-Factor Authentication vs. Single-Factor Authentication):

Answer 6

• Definition: MFA requires users to provide two or more authentication factors (e.g., password and a one-time code), while SFA relies on a single factor (e.g., just a password) for authentication.

Question 7

Accounting:

Answer 7

• Definition: The process of tracking and recording the activities and access permissions of users within a system or network for audit and security purposes.

Question 8

IDaaS (Identity as a Service):

Answer 8

• Definition: A cloud-based service that provides identity and access management solutions to organizations, allowing them to manage user identities and access controls in the cloud.

Question 9

Identity Proofing:

Answer 9

• Definition: The process of verifying the identity of a person by confirming their claimed attributes or information, often used for secure authentication.

Question 10

ABAC (Attribute-Based Access Control):

Answer 10

• Definition: An access control model that uses attributes of users, resources, and the environment to make access control decisions, offering fine-grained control.

Question 11

Authentication & Authorization:

Answer 11

• Definition: Authentication is the process of verifying the identity of a user, while authorization involves granting or denying access to specific resources or actions based on the user’s identity and permissions.

Question 12

Ethical Wall:

Answer 12

• Definition: A network or communication barrier that prevents certain users or groups from communicating or sharing specific types of information to maintain privacy and regulatory compliance.

Question 13

Data Custodian:

Answer 13

• Definition: An individual or entity responsible for the storage, management, and protection of data, typically following the directives of the data owner or controller.

Question 14

CER (Cross-Enterprise Reference):

Answer 14

• Definition: A reference data system that ensures consistent data naming and categorization across different entities within an organization.

Question 15

Granularity of Controls:

Answer 15

• Definition: The level of detail and specificity in access controls, determining how finely access permissions can be defined and enforced.

Question 16

Data Owner:

Answer 16

• Definition: A person or entity with the ultimate responsibility for data, including defining data access policies and making decisions regarding its use and protection.

Question 17

Data Controller:

Answer 17

• Definition: An entity that determines the purposes and means of processing personal data, often associated with data protection regulations like GDPR

Question 18

Data Processor:

Answer 18

• Definition: An entity that processes personal data on behalf of the data controller, following their instructions and obligations under data protection laws.

Question 19

DAC (Discretionary Access Control):

Answer 19

• Definition: An access control model where data owners or administrators determine access permissions for users and objects based on their discretion.

Question 20

False Acceptance Rate (FAR):

Answer 20

• Definition: A metric in biometric authentication that measures the likelihood of incorrectly accepting an unauthorized user’s identity.

Question 21

False Rejection Rate (Type 1):

Answer 21

• Definition: A metric in biometric authentication that measures the likelihood of incorrectly rejecting an authorized user’s identity.

Question 22

Whaling Attack:

Answer 22

• Definition: A targeted phishing attack aimed at high-profile individuals or senior executives within an organization, often seeking sensitive information.

Question 23

Logical Access Control:

Answer 23

• Definition: Access control mechanisms that operate at the software or system level to manage user access to digital resources.

Question 24

Mandatory Access Control:

Answer 24

• Definition: An access control model that enforces access restrictions based on security labels or classifications assigned to users and data, typically used in government and military settings.