CompTIA Security+

Security+: Implementing identity and access management (IAM) controls [updated 2021]

Identity and access management (IAM) are among the most essential information security controls. After all, making sure a user actually is who they are claiming to be before providing access based on the minimal privilege principle is a sound way of ensuring data confidentiality, integrity and even availability.

Since most of Security+ focuses on real-world situations, it stands to reason that, given a scenario, candidates must have the skills necessary to implement identity and access management controls. The topic of IAM is also covered in Security+ Domain 3: Implementation, where "access control schemes" can be found.

Become a SOC Analyst: get Security+ certified!

More than 47,000 new SOC analysts will be needed by 2030. Get your CompTIA Security+ to leap into this rapidly growing field — backed with an Exam Pass Guarantee.

View Pricing

Identity and access management controls

Here is a list of IAM controls exam takers should be aware of:

1. Access control models: in order to implement IAM, it is necessary to have a way of defining what an object (a user or a process) can interact with other securable objects. Access control models are responsible for just that: they are used to create a paradigm that defines the relationships among permissions, operations, objects and subjects. There are a few different models that Security+ candidates must understand.
2. MAC: in the mandatory access control model, users have limited power (or even no power at all) for defining who can access their files. Access policies are enforced by the system administrator, for example, by creating clearance levels for users and classifying data (public, confidential, secret or top secret). A user with the clearance level of secret can access data classified within this category, but cannot grant access to another user, even when they are considered data owners.
3. DAC: using the discretionary access control model, users can be defined as data owners, which means that they can determine who can access specific resources within their ownership. For example, a user can create a file and set it up in a way that other users, a group of users or a process can read, change or even delete it.
4. ABAC: attribute-based access control is a paradigm in which access rights are granted to users through the use of policies that combine attributes (user attributes, resource attributes, object or environment attributes) together. ABAC supports Boolean logic so it can create rules based on IF-THEN situations, taking into consideration who is making the request, the resource, and the action. For example, if the requestor is an admin, allow him to change (action) a user password (object).
5. Role-based access control: as you may have already gathered from this method’s name, access is granted based on the role of the object. This can be considered a middle ground between MAC and DAC. For example, the role can be a group, a job position or security clearance level; users that are members of a specific role are granted access based on that.
6. Rule-based access control: in this paradigm, access control is based on rules that either allow or deny or access to resources. One of the simplest examples of this method are the access control lists (ACLs) commonly used by routers. Rules can be used to determine what IPs (sources or destinations) and/or ports are allowed through the router.
7. Physical access control: as a principle, applying security controls to the physical environment is not all that different from protecting pure data. Controls should be enforced to make sure identity is confirmed before granting access and, once access is actually granted, it is limited and monitored.
8. Proximity cards: it is quite common to use proximity cards to grant access to doors or door locks. The user simply moves the card close to the reader and presto! The door unlocks. In truth the proximity card is a passive device, powered inductively from the reader, that stores a small amount of information, usually a single identifier. Once read, this identifier is validated and either grants or denies access. 
9. Smart cards: while similar in format to proximity cards, smart cards are embedded with integrated circuit chips that can store a little more data, such as a cryptographic key used for authenticating with the reader. Smart cards may also contain useful data for other forms of authentication, such as biometric measures that are too large for high-volume remote authentication. An important point to remember regarding authentication is that both proximity and smart cards fall into the something you own category. Because losing such a card is somewhat common, relying solely on it for physical access can create a huge security gap. The best approach is combining multiple factors such as something you know (a password) or something you are (a biometric read).
10. Biometric factors: many physical attributes of the human body can be used for identification/authentication purposes, including reads from fingerprints, retina, iris, voice/facial recognition and even ear shape. Since this falls under the something you are category, it usually helps prevent problems such as a user forgetting a password or losing a card. Depending on the physical attribute being used, biometrics can provide a high level of accuracy, reducing the false acceptance rate (FAR) (cases where the biometric security system will incorrectly accept an access attempt by an unauthorized user). It is also important to keep a close eye on the false rejection rate (FRR), the cases where an authorized user is incorrectly denied access. The crossover error rate (CER) is the rate where both FRR and FAR are equal. In terms of protection, the lower the CER, the better (and more secure) the biometric system is.
11. Tokens: one of the best something you have authentication methods is using a token. This can be either a physical device, usually a small build, quite similar to a USB stick, or a software-based solution, such as an app installed on a mobile device. Physical tokens can either be used to store encrypted authentication information (such as a certificate), making it necessary to physically connect the device, usually at an USB port, for authentication, or have a mechanism such as a button that, once pressed, makes the device display the password.Tokens can generate passwords by using either a time-based one-time password (TOTP) algorithm, generating new passwords at fixed intervals (a new password every 60 seconds, for example) or implement a HMAC-based one-time password (HOTP) algorithm, so new passwords are created not at fixed intervals, but by using a non-repeating one-way function such as a hash or hash message authentication code (HMAC).
12. Certificate-based authentication: certificates (or digital certificates) are a form of trust-based, third-party authentication technology that uses asymmetric public key cryptography. Certificates can be used to verify the identity of devices, applications, systems, networks and even organizations. In essence, certificates are simply digital files that can be stored (securely or not) on a system folder or on devices such as smart cards and tokens. These files can be lost or, even worse, stolen and used as a basis for an impersonation attack, so they should be handled with care. A safer solution for storing certificates is using a hardware security module (HSM), a physical device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing.

Good examples of certificate-based authentication using smartcards are the PIV (personal identity verification) card, which is mandatory for all U.S. government employees and contractors, and the common access card (CAC), a similar solution used to identify Department of Defense (DoD) military personnel and DoD civilian government employees. These cards are used not only for identifying the person and authenticating in buildings and systems but can also be employed to encrypt and digitally sign emails.

Better security through identity and access management implementation

As mentioned before, implementing identity and access management controls is a key task any good information security professional should be familiar with. For instance, when designing a new system, IAM is a major consideration for a security architect. On the other hand, a pentester must understand how authentication works if they’re supposed to exploit it. The same analogy goes for physical protection, as information security experts should be able to both design and test identification/authentication controls for critical areas such as a datacenter.

In the end, the implementation of IAM controls is a rather important subject in the Security+ exam, so candidates should prepare accordingly. 

For more on the Security+ certification, view our Security+ certification hub.