2.5 Security Principles & Access Management

2.5 Security Principles & Access Management

Quick Answer: Identity & Access Management (IAM) manages digital identities across their entire lifecycle. Resource permissions are enforced using four primary Access Control Models: Discretionary (DAC), Mandatory (MAC), Role-Based (RBAC), and Attribute-Based (ABAC). Enterprise authentication utilizes Single Sign-On (SSO) and Identity Federation standards (SAML 2.0, OpenID Connect), while Privileged Access Management (PAM) safeguards superuser credentials.

In modern cloud-centric and hybrid networks, physical network perimeters have dissolved. Identity is the new perimeter. Managing digital identities and controlling access rights across enterprise resources requires structured IAM frameworks.

The Complete Identity Lifecycle

The Identity Lifecycle defines the stages a digital identity moves through within an organization:

[ 1. Provisioning ] ---> [ 2. Maintenance & Modification ] ---> [ 3. Deprovisioning ]
 (Account Created)          (Periodic Access Reviews)             (Account Revoked)

Lifecycle Stages

1. Provisioning: Creating user accounts, configuring mailboxes, assigning digital certificates, and establishing baseline role permissions when an employee joins.
2. Maintenance & Modification: Adjusting permissions as employees transfer departments, receive promotions, or take on temporary project duties.
   • The Danger of Privilege Creep: Over time, employees accumulate cumulative permissions from past roles that they no longer require. Organizations must conduct mandatory Periodic Access Reviews (Attestation / Recertification) to revoke unneeded rights.
3. Deprovisioning (Offboarding): Immediately disabling accounts, revoking access tokens, and invalidating certificates when an employee leaves. Delayed deprovisioning leaves active "orphan accounts" vulnerable to malicious takeover.

Enterprise Access Control Models

Access Control Models define the rules operating systems and applications use to evaluate whether a subject (user/process) can access an object (file/database/device):

1. Discretionary Access Control (DAC)

• Mechanics: The data owner possesses full discretion to grant, modify, or revoke access permissions using Access Control Lists (ACLs).
• Characteristics: Highly flexible and simple to implement, but vulnerable to user error or security decay (e.g., an employee granting public read/write permissions to a directory).
• Primary Applications: Standard desktop operating system file systems (Windows NTFS, Linux POSIX file permissions).

2. Mandatory Access Control (MAC)

• Mechanics: A rigid, non-discretionary model where the operating system kernel enforces access decisions based on user security clearance levels (Unclassified, Secret, Top Secret) compared against object security labels. End users cannot alter permissions.
• Formal Security Models:
  • Bell-LaPadula Model: Focuses strictly on Confidentiality. Enforces Simple Security Property ("No Read Up") and Star-Property ("No Write Down").
  • Biba Model: Focuses strictly on Integrity. Enforces Simple Integrity Property ("No Read Down") and Star-Integrity Property ("No Write Up").
• Primary Applications: Military networks, defense intelligence agencies, and high-security operating systems (SELinux, TrustedBSD).

3. Role-Based Access Control (RBAC)

• Mechanics: Access permissions are assigned to specific organizational job roles (SOC Analyst, HR Specialist, Accounting Manager) rather than individual users. Users assigned to a role automatically inherit all defined permissions.
• Characteristics: Drastically simplifies administration, enforces least privilege across departments, and aligns with business hierarchy.
• Primary Applications: Corporate enterprise networks, Microsoft Active Directory / Entra ID group policies.

4. Attribute-Based Access Control (ABAC)

• Mechanics: Evaluates dynamic boolean rules combining multiple attributes: Subject attributes (role, clearance), Resource attributes (sensitivity label), and Environmental attributes (time of day, source IP, device health posture).
• Characteristics: Provides hyper-granular, context-aware authorization rules. Serves as the foundation for Zero Trust Architecture.
• Primary Applications: Cloud environments (AWS IAM policies, Azure ABAC, XACML policy engines).

Access Control Model Comparison Table

Single Sign-On (SSO) & Identity Federation Protocols

Managing separate passwords for dozens of enterprise cloud applications causes password fatigue and dangerous credential reuse. Single Sign-On (SSO) allows users to authenticate once with a central Identity Provider (IdP) and gain seamless access to multiple connected Service Providers (SPs).

                             [ Identity Federation ]
                                        |
     ___________________________________|___________________________________
    |                                   |                                   |
[ SAML 2.0 ]                       [ OAuth 2.0 ]                    [ OpenID Connect ]
(XML Web SSO)                  (Authorization Framework)             (JWT Authentication)

Federation Protocols Breakdown

1. SAML 2.0 (Security Assertion Markup Language): An XML-based open standard used primarily for enterprise web browser Single Sign-On. The user authenticates at the Identity Provider (IdP) (e.g., Okta, Azure AD), which issues a digitally signed XML SAML assertion to the Service Provider (SP) (e.g., Salesforce, AWS Console).
2. OAuth 2.0: An open authorization framework (not authentication) that allows third-party applications to obtain limited access to user resources via HTTP bearer tokens (Access Tokens) without exposing user passwords.
3. OpenID Connect (OIDC): A lightweight identity authentication layer built on top of OAuth 2.0 using JSON Web Tokens (JWT) and ID Tokens. Standard for modern web apps, mobile apps, and RESTful APIs.
4. Directory Access Protocols (LDAP & Active Directory): Enterprise central identity directories rely on Lightweight Directory Access Protocol (LDAP) over TCP 389 (or LDAPS encrypted over TCP 636) to manage domain accounts centrally.

Privileged Access Management (PAM) & Modern Password Hygiene

Administrative accounts (root, Administrator, Domain Admins) possess unrestricted control over IT infrastructure. Securing superuser credentials is paramount for security analysts.

Privileged Access Management (PAM) Controls

Specialized PAM solutions isolate, manage, and audit administrative access:

• Credential Vaulting: Storing administrative passwords in an encrypted vault. Administrators check out temporary access without ever viewing cleartext passwords.
• Just-In-Time (JIT) Access: Granting temporary administrative elevation for a limited duration (e.g., 2 hours), after which access automatically expires.
• Session Recording: Capturing complete video and command-line audit logs of all privileged administrative sessions for forensics.

Modern Password Hygiene Guidelines (NIST SP 800-63B)

NIST guidelines have updated legacy password practices to improve security and usability:

• Favor Long Passphrases Over Short Complexity: Mandate long passphrases (15+ characters) rather than short, complex strings (P@ss1!) that force users to write down credentials.
• Eliminate Arbitrary Mandatory Rotation: Do not force users to change passwords every 30-90 days unless a compromise is suspected, as mandatory rotation leads to predictable pattern shifts (Spring2026!).
• Screen Against Breached Passwords: Automatically block new passwords that appear on public lists of leaked credentials.