Here is a comprehensive summary of CISSP Domain 5: Identity and Access Management (IAM), complete with the core concepts and the "Management Mindset". This guide is structured to provide in-depth executive-level insights, covering the essential knowledge required for both the exam and real-world application.

Comprehensive Summary: CISSP Domain 5 - Identity and Access Management (IAM)

Exam Weight: 13% of the CISSP Exam Primary Objective: This domain focuses on controlling who and what can access your organization's assets. Identity and Access Management (IAM) is the discipline that enables the right individuals to access the right resources at the right times for the right reasons. In the modern era of cloud computing and remote work, identity has become the ultimate enterprise perimeter.

Part 1: The Foundation of IAM (IAAA)

Before discussing complex systems, security professionals must master the core life cycle of access, often referred to as the IAAA model: Identification (Who are you?): The process of a subject claiming an identity (e.g., typing in a username, swiping a badge). Identification must be unique to ensure accountability. Authentication (Prove it!): The process of verifying the claimed identity. Management must enforce Multi-Factor Authentication (MFA) using at least two of the following factors: Something you know: Password, PIN, or passphrase. Something you have: Smart card, hardware token, or mobile phone. Something you are (Biometrics): Fingerprint, retina scan, or facial recognition. Somewhere you are: Geolocation or IP address restriction. Something you do: Typing cadence or signature dynamics. Authorization (What are you allowed to do?): Once authenticated, the system determines the subject's access rights and permissions based on organizational policies. Accountability (Who did what?): Ensuring that every action can be traced back to a specific, unique subject. This relies heavily on logging and auditing to ensure Non-repudiation (the inability to deny performing an action).

Part 2: Access Control Models

Organizations must choose how they enforce access permissions. CISSP tests your knowledge of how these models align with different business and security needs:

1. Discretionary Access Control (DAC)

• Concept: The owner of the data/file determines who has access.
• Use Case: Typical in commercial environments and desktop operating systems (e.g., Windows NTFS permissions). It is highly flexible but vulnerable to insider threats and malware (like Trojan horses) because access is entirely at the user's discretion.

2. Mandatory Access Control (MAC)

• Concept: The operating system enforces access policies based on Security Clearance (the subject) and Data Classification Labels (the object, e.g., "Top Secret").
• Use Case: Military and highly regulated intelligence environments. Users cannot alter access permissions, providing the highest level of security at the cost of operational flexibility.

3. Role-Based Access Control (RBAC)

• Concept: Access is granted based on the user's job function or role within the organization (e.g., "HR Manager", "Database Admin").
• Use Case: The most common model for medium to large enterprises. It drastically reduces administrative overhead, especially in environments with high employee turnover, because administrators manage roles instead of individual user permissions.

4. Attribute-Based Access Control (ABAC)

• Concept: The most granular, next-generation model. Access is granted based on dynamic rules analyzing multiple attributes: the user (department), the environment (time of day, geolocation), and the resource (classification).
• Use Case: Modern Zero Trust architectures and cloud platforms. For example, a user can access a file from the corporate office during business hours but is blocked if trying to download it from a foreign country at 3 AM.

Part 3: The Identity Management Lifecycle

IAM is not a set-and-forget technology; it is a continuous business process.

• Provisioning & Onboarding: Creating the initial identity and granting the exact minimum privileges required for the new employee to function.
• Maintenance & Review: Over time, employees change roles or take on temporary projects. Management must enforce periodic Access Recertification (Privileged Access Reviews) to ensure users still need the access they possess.
• The Threat of Privilege Creep (Aggregation): When an employee moves to a new department, they are often granted new privileges without their old privileges being revoked. This accumulation of excessive access (Privilege Creep) creates massive insider threat vulnerabilities.
• Deprovisioning (Termination): The most critical step. Upon termination or resignation, access must be revoked immediately to prevent sabotage or data theft from disgruntled former employees.

Part 4: Authentication Systems and Federation

As enterprises scale and use multiple cloud services (SaaS), requiring users to remember dozens of passwords leads to poor security hygiene.

5. Single Sign-On (SSO)

Allows a user to authenticate once and gain access to multiple internal applications without re-entering credentials.

• Kerberos: The most prominent internal SSO protocol. It uses symmetric encryption and a ticketing system (Ticket Granting Tickets - TGT) issued by a Key Distribution Center (KDC) to prevent replay attacks and secure internal network authentication.

6. Federated Identity Management (FIM)

While SSO works inside an organization, Federation extends SSO across different, unaffiliated organizations (e.g., using your corporate login to access a third-party HR cloud portal).

• SAML (Security Assertion Markup Language): An XML-based standard used heavily in business-to-business (B2B) federation to exchange authentication and authorization data.
• OAuth 2.0 & OpenID Connect (OIDC): Modern, token-based protocols heavily used for mobile and web applications (e.g., "Log in with Google/Microsoft"). OAuth handles authorization, while OIDC handles authentication.

7. Network Access AAA

• RADIUS & TACACS+: Protocols used to centralize Authentication, Authorization, and Accounting (AAA) for network devices, ensuring that network administrators log into switches and routers securely. TACACS+ is often preferred in enterprise networks because it encrypts the entire payload and separates authentication from authorization.
• 💡 Key Takeaways: The CISSP Management Mindset When tackling Domain 5 scenarios on the CISSP exam or designing enterprise IAM architecture in the real world, always apply the following executive-level logic: Identity is the New Perimeter (ตัวตนคือปราการด่านใหม่):
• Mindset: Traditional network firewalls are no longer enough in a cloud-first, mobile workforce. Executive leadership must shift to a Zero Trust architecture where the verification of Identity—coupled with device health and context—is the primary mechanism for defending corporate data. Enforce the Principle of Least Privilege & Need-to-Know (ให้สิทธิ์เท่าที่จำเป็นเท่านั้น):
• Mindset: Users should be granted exactly the minimum amount of access necessary to perform their daily job functions, and absolutely no more. Need-to-Know requires that even if someone has the top-level clearance, they still cannot access a file unless their specific task requires it. Over-provisioning is a major business risk. Implement Separation of Duties (SoD) (การแบ่งแยกหน้าที่เพื่อป้องกันการทุจริต):
• Mindset: No single individual should have enough authority to execute a critical or sensitive transaction end-to-end. By forcing collusion (requiring two or more people to conspire to commit fraud), management drastically reduces the risk of insider threats and financial manipulation. For example, the person who creates a vendor account cannot be the same person who authorizes payments to that vendor. Privilege Creep is a Silent Killer (ระวังการสะสมสิทธิ์ที่เกินความจำเป็น):
• Mindset: Executive leadership must mandate formal, regular Access Recertification (Audits) managed by Business Owners, not IT. IT does not know if an employee still needs access to a financial database; only the department manager does. Regular audits strip away accumulated privileges before they can be exploited. Multi-Factor Authentication (MFA) is Mandatory, Not Optional (การยืนยันตัวตนหลายปัจจัยคือข้อบังคับ):
• Mindset: Passwords alone are effectively broken. Whether dealing with remote access, administrative logins, or third-party cloud services, management must enforce MFA globally to neutralize the threat of stolen, guessed, or brute-forced passwords.

🔒 Dossier Classified: The localized translation is restricted.