Study 4 Identity and Access Management with 12 free online flashcards. Review key terms, definitions, and concepts with this interactive flashcard deck.
What does identity and access management (IAM) govern?
Identity and access management governs how people, devices, and software identities are created, verified, and granted access to resources. It aims to limit access to what is needed and for only as long as needed.
How does an account differ from an identity?
An identity represents an entity in a system; an account links that identity to a particular service and its permissions.
What does authentication verify?
Authentication checks evidence that an entity controls a claimed identity. A password, security key, or device certificate can serve as an authenticator.
What does authorization determine?
Authorization determines what an authenticated identity is permitted to do, such as read a file or approve a payment.
What is the principle of least privilege?
Least privilege means granting only the permissions a user, process, or device needs to perform its assigned task.
How does separation of duties reduce risk?
Separation of duties divides sensitive work so one person cannot complete every step alone, reducing the risk of serious harm from a mistake or compromised account.
Who controls access in discretionary access control (DAC)?
In discretionary access control (DAC), a resource owner can grant or revoke access to that resource.
Why should passwords be unique across accounts?
Unique passwords prevent credentials exposed in one breach from being reused to try other accounts. A password manager can generate and store long, unique passwords.
What does multifactor authentication (MFA) require?
Multifactor authentication (MFA) requires evidence from more than one factor, such as something you know, something you have, or something you are.
Why is a one-time code not phishing-resistant?
A one-time code can be safer than a password alone, but it is not phishing-resistant: a fake site may relay the code to the real service.
What are key steps in managing an account lifecycle?
Manage access throughout the account lifecycle: provision accounts through an approved process, change permissions when responsibilities change, disable unneeded accounts promptly, and review access periodically.
How does mandatory access control (MAC) decide access?
Mandatory access control (MAC) uses a centrally enforced policy that compares security labels and user clearances; users cannot freely change the policy.