IV - Identity and Access Management

Question 1

Principle of least privilege required

Answer 1

Grant lowest required access rights necessary to perform required duties.

Question 2

Role-based access controls

Answer 2

Level of access is determined by a person’s role in the organization. Easy to maintain.

Question 3

user-based access controls

Answer 3

Access to systems is user-based and heavily personalized. More difficult to maintain.

Question 4

Context-aware access control

Answer 4

Granular access control that could be based on current attributes like IP address, device security level, or location. Someone could have the right authorization (according to user-based ACLs) but isn’t on the right IP address.

Question 5

Cross-enterprise authentication and authorization

Answer 5

Single sign-on (SSO)/SAML

Question 6

Federated Identity

Answer 6

A person’s identity is authenticated in a trusted, centralized service. Uses tokens (SSO).

Question 7

Single-factor authentication

Answer 7

Only uses one form of authentication to log into an account.

Question 8

Multifactor authentication

Answer 8

Requires multiple forms of authentication to log in.

Question 9

Something you know

Answer 9

Username and password

Question 10

Something you are

Answer 10

Biometrics (fingerprint, facial recognition)

Question 11

Something you have

Answer 11

A token/key (e.g. a yubikey)

Question 12

Where you are

Answer 12

Physical location. This is sometimes also considered part of “something you are.”