-: In this section of the course,
we are going to discuss
troubleshooting identity and access management.
The troubleshooting identity and access management section
of the course focuses on domain three, security engineering,
specifically objective 3.1,
which states that given a scenario,
you must be able to troubleshoot common issues
with identity and access management components
in an enterprise environment.
Troubleshooting identity and access management
involves ensuring the right people have the right access
to the right resources at the right time,
this is done by managing user identities
and controlling user and system access.
As enterprise systems become more complex
and especially when they're integrated with cloud services,
proper management frameworks and policies are necessary,
additionally, monitoring, assessing, and adjusting access
keeps data and resources safe from unauthorized access.
As we go through this section, we will cover many topics
related to troubleshooting identity and access management,
including management frameworks, subject access control,
user identity control, secrets management,
authentication and authorization,
cloud identity and access management
access and trust policies,
wifi authentication, access control,
conditional access, and finally, logging and monitoring.
First, we will look at management frameworks.
Management frameworks in the context
of troubleshooting identity and access management
are how identities and access controls
are managed, monitored, and maintained
within an organization.
Management framework concepts include identity proofing,
privilege, and identity management.
Authentication and authorization are core processes,
authentication verifies a user's identity
and authorization determines
what resources the user can access.
Identity proofing is the process of verifying
an individual's claimed identity is accurate,
identity proofing is typically done
during the initial setup of user accounts.
Next, privileged identity management focuses
on managing and controlling access to critical systems
and information by granting elevated permissions
only when necessary,
it also involves closely monitoring privileged accounts,
in practice, an IT administrator
might undergo identity proofing
when their account is created
to ensure they are who they claim to be.
The IT administrator
may then use privileged identity management
to gain temporary elevated privileges
to perform a specific task.
Throughout this process,
their actions would be logged and monitored
according to the organization's management framework.
Next, we will explore subject access control,
subject access is the mechanism
that determines and enforces which subjects have access
to specific resources within a network environment.
Subjects are defined
as users, processes, devices, and services.
Let's take a minute to discuss how each subject interacts
with enterprise access control.
A user is an individual or entity
that requires and receives access to resources,
next, a process is an instance of a program
that requires permissions to perform operations
on behalf of a user or system function.
Next, a device is any physical or virtual hardware
that connects to the network,
devices often require authentication
to ensure they're authorized to access resources.
Finally, a service is a system function or application
that operates continuously
in the background, providing users
the seamless machine interaction they expect.
Services manage tasks like processing data,
handling requests, and maintaining system performance,
all without requiring direct user intervention.
Services may also interact
with other services, devices or users,
and must be controlled to prevent unauthorized access.
After that, we will look at user identity control,
user identity control is the process used
to manage, verify, and secure the identities of users
to ensure they have appropriate access to resources.
User identity control concepts include credentials,
the use of biometrics, and multi-factor authentication.
Credentials are the information that users provide
to prove their identity,
examples of credentials include passwords,
pins, and certificates.
Biometrics like facial recognition and fingerprints
may also be used to validate identity,
authentication is then the process of validating
user presented credentials or biometric data
to confirm a user's identity,
authorization is then used to determine what resources
the authenticated user is allowed to access.
Multi-Factor authentication, or MFA,
requires users to provide two or more verification factors
before being granted access to the enterprise network.
Verification factors, also called authentication factors,
include something that I know, such as a password,
something that I have, such as an authentication token,
and something that I am, such as a fingerprint.
Next, we will explore secrets management,
secrets management is securely storing,
managing, and controlling access to sensitive information
to prevent unauthorized access.
Secrets management concepts include tokens, certificates,
passwords, keys, rotation, and deletion.
Tokens are temporary digital credentials
used for authentication or authorization.
Certificates are digital documents that verify the identity
of entities and enable secure communication.
Passwords are traditional secret strings of characters
used for authentication,
and keys are cryptographic elements that secure data
through encryption and decryption processes.
In order to maintain security,
secrets should be regularly rotated,
meaning updated or replaced,
and to prevent unauthorized access,
secrets should be securely deleted when no longer needed.
In practice, an enterprise administrator
might rotate encryption keys regularly
to mitigate the risk of compromise,
delete old tokens that are no longer valid,
and update passwords on a recurring basis.
Each of these actions could be managed
within a secrets management framework
to ensure ongoing protection of sensitive information.
Following that, we will look
at authentication and authorization.
The process of authentication and authorization
involves verifying a user's identity
and determining their access rights
to resources within a system.
Authentication and authorization concepts
include attestation, the use
of the security assertion markup language, or SAML,
OpenID, OAuth, and federation.
Attestation is the process of verifying
that a system or entity complies
with certain policies or standards,
often as a part of the authentication process.
SAML, the security assertion markup language,
is a standard for exchanging authentication
and authorization data between parties,
OpenID is an authentication protocol
that allows users to log in to multiple services
using a single identity provider.
An identity provider is a service
that manages user identity information
and asserts authentication to enable secure access
to multiple applications or systems.
OAuth is an authorization framework
that allows third party applications to access user data
without passing their credentials to the third party.
Don't forget that the auth in OAuth is for authorization,
not authentication, for authentication,
OAuth may employ OpenID.
Federation refers to the practice
of asserting identities across multiple domains,
for example, in a federated environment,
the security assertion markup language might be used
to authenticate a user via OpenID
with OAuth managing the authorization
for a third party application.
Then we will explore cloud identity and access management,
access and trust policies.
Cloud identity and access management
access and trust policies are used to manage and enforce
who has access to cloud resources and under what conditions.
Furthermore, cloud identity and access management
is a framework that is used to assign roles and permissions
to users, groups, and services,
directing what actions they can perform
within the cloud environment.
Trust policies are then used to define the relationships
and trust boundaries
between different cloud accounts or services.
For example, in a multi-cloud environment,
a trust policy might allow one cloud account
to assume a specific role in another account,
in this scenario,
cloud identity and access management could be used
to manage the permissions associated with the role,
ensuring that access is controlled
and monitored across the entire cloud infrastructure.
Next, we will explore wifi authentication,
wifi authentication is used to manage and secure user access
to wireless networks.
Wifi authentication concepts include
the Institute of Electrical and Electronics Engineers,
or IEEE 802.1X,
the Extensible Authentication Protocol, or EAP,
and the Simultaneous Authentication of Equals.
802.1X is a network access control protocol
that provides an authentication framework for devices
connecting to a wifi network,
furthermore, 802.1X ensures that only authorized users
gain network access
by enabling the process of authentication.
The Extensible Authentication Protocol
is a flexible authentication framework used
within the 802.1 x framework,
this supports multiple authentication methods
between a client, known as a supplicant,
and the wireless enterprise network.
Simultaneous Authentication of Equals
is a secure password based key exchange protocol
used in WPA3 to provide a secure handshake process,
resistant to offline dictionary attacks.
Then we will explore access control,
access control manages and enforces
who can access specific resources within a system,
based on predefined policies and user roles.
Access control concepts include single sign-on, Kerberos,
and privileged access management.
Single sign-on, or SSO, is an authentication process
that allows users to access
multiple applications or services
with one set of login credentials.
Single sign-on streamlines a user's access
within an organization's domain
because the user only has to remember
one set of credentials.
Kerberos is a network authentication protocol
that uses tickets to allow entities to securely prove
their identity to one another over a non-secure network.
Kerberos is commonly used in single sign-on implementations
for secure authenticated access to services.
Privileged Access Management, or PAM,
controls and monitors access
to critical systems and sensitive information
by granting elevated privileges, only when needed.
This just-in-time method of elevating privileges
ensures that only authorized users
can perform high risk tasks
while minimizing security risks.
Following that, we will look at conditional access,
conditional access policies grant or deny access
to resources based on specific conditions,
such as user identity, device status,
or other contextual factors.
Conditional access concepts include configuration,
user-to-device binding, time-based conditions,
and geographic location.
Configuration requires the setup and customization
of conditional access policies to ensure they align
within organization security requirements.
Conditional access policies may specify
which users or devices can access certain resources.
User-to-device binding is a security measure
that links a user's identity to a specific device,
this binding ensures that access is granted
only when the user is using an approved device.
Time-based and geographic location conditions
add additional layers of security
by restricting access to certain times of the day
or specific geographical areas,
for example, an organization might configure
conditional access to allow a user to access sensitive data
only from a company issued device,
using user-to-device binding during business hours,
which is a time-based conditional
and within a specific geographical location, such as the US.
Finally, we will look at logging and monitoring,
logging, and monitoring is the recording and analyzing
of access events and user activities
to detect, investigate, and respond to
potential security incidents.
Logging is the collection of data related to user actions,
system changes, and access attempts.
Logging provides a detailed record
of who accessed what resources and when,
monitoring on the other hand involves the real time
or periodic review of logs
to identify unusual or unauthorized activities.
Unusual or unauthorized activities
include failed login attempts
or access from unfamiliar locations
and may indicate a security event,
for example, an identity and access management system
might log every access attempt to a sensitive database
and monitor these logs to detect patterns
of failed attempts, triggering an alert
if an unusual number of failures occur
and allowing security teams to respond quickly
to potential data breaches.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course
and we'll review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into troubleshooting
identity and access management
in this section of the course!