Skip to main content

Module 6: Identity & access management

Estimated time: 3-4 hours (including the lab) · Prerequisites: M0-M5

Firewalls used to be the wall around the castle. In a world of cloud apps, remote work and phones, identity is the perimeter now: if an attacker gets a valid login, they don't need to "break in". They sign in. That's why most corporate breaches involve stolen or misused credentials, and why IAM analyst is one of the most realistic entry roles in the industry.

Security+ SY0-701 mapping: Domain 1 (General Security Concepts: AAA, authentication factors) and Domain 4 (Security Operations: identity and access management operations).

What you'll get from this module​

  • Explain authentication vs authorisation vs accounting (AAA) and why the distinction matters.
  • Compare the authentication factors and explain why passwords alone fail.
  • Choose the right MFA type and rank them by strength, and describe an MFA fatigue attack.
  • Explain SSO and federation at a concept level, naming SAML and OIDC.
  • Describe Active Directory / Entra ID, the joiner-mover-leaver lifecycle, RBAC and least privilege.
  • Complete an identity hygiene lab on your own accounts: real security value today.

1. Identity is the new perimeter​

Twenty years ago, everything important sat inside an office network. Today your email, files, HR system and payroll are cloud services reachable from anywhere, by design. The only thing standing between an attacker in another country and your company's data is whether they can authenticate as someone.

So the modern defensive questions are identity questions: Who are you? Should you have this access? Are you still the person who logged in? Every topic in this module is a piece of answering those questions well.

2. AAA: authentication, authorisation, accounting​

You met AAA in M4. Here's where it becomes concrete:

TermQuestion it answersExample
AuthenticationWho are you?Password + authenticator app code
AuthorisationWhat are you allowed to do?You can read the payroll folder but not edit it
AccountingWhat did you do?Logs show your account exported a file at 2:14 am

Keep these separate in your head: proving identity, granting rights, and recording actions are three different controls, and they fail in different ways. A SOC analyst lives in the accounting layer (logs); an IAM analyst works mostly in the first two.

3. Authentication factors, and why passwords fail​

The classic three factors:

  • Something you know: password, PIN.
  • Something you have: phone with an authenticator app, hardware security key, smart card.
  • Something you are: fingerprint, face (biometrics).

Why passwords alone fail: people reuse them across sites, so one breached website exposes many accounts; they get phished; they get guessed or cracked when a site's password database leaks. The password isn't a bad idea. The problem is that it's a single, stealable, reused secret.

Two practical fixes you should adopt personally:

  • Password managers generate and store a unique strong password per site, killing reuse in one move. Recommending one is standard professional advice.
  • Passkeys are the emerging replacement for passwords: a cryptographic key pair stored on your device, unlocked by your fingerprint/face/PIN. Nothing reusable ever leaves your device and there's no shared secret to phish, which is why the industry is moving toward them. You'll see them offered on major accounts already. Take the offer.

4. MFA: types, strengths, and how attackers fight back​

Multi-factor authentication (MFA) requires factors from different categories (know + have, for example). It's on the Essential Eight (M5) because it defeats the most common attack there is: using a stolen password.

Not all MFA is equal:

MFA typeStrengthNotes
Hardware security key (FIDO2)StrongestPhishing-resistant: the key checks the site's identity
Authenticator app (TOTP codes / push)StrongThe everyday recommendation
SMS codesWeakest MFAVulnerable to SIM-swapping and interception, but still far better than no MFA

MFA fatigue (push bombing): an attacker with a stolen password triggers repeated push notifications (sometimes at 3 am) hoping the victim taps Approve to make the noise stop. It has worked in major real-world breaches. Defences: number-matching prompts (you type a code shown on screen rather than tapping approve), rate limiting, and users who know that an unexpected MFA prompt means someone has your password: report it, don't approve it.

5. SSO, federation and directories​

  • Single sign-on (SSO): you authenticate once to a central identity provider and it vouches for you to many apps. Fewer passwords, and one place to enforce MFA and cut off a leaver.
  • Federation: the trust arrangement that makes SSO work across organisations and products. The two protocol names you should recognise (not master) are SAML and OIDC (OpenID Connect). At this level: they're the standard languages an identity provider uses to tell an app "this user is authenticated."
  • Directory services: the databases of who exists and what groups they're in:
    • Active Directory (AD): Microsoft's on-premises directory, the identity backbone of most corporate Windows networks since 2000. Most serious corporate breaches touch AD at some point, because owning the directory means owning everything, which is why AD knowledge is prized in both SOC and IAM roles.
    • Microsoft Entra ID (formerly Azure AD): Microsoft's cloud identity platform, handling sign-in for Microsoft 365 and thousands of federated apps. Most organisations run AD and Entra ID together in hybrid mode.

Curated learning (free, link-only): Microsoft's SC-900: Introduction to Microsoft Security, Compliance, and Identity course on Microsoft Learn is an excellent, free deep-dive on these concepts, and the SC-900 exam is a respectable add-on cert for IAM-leaning candidates. (Free to study.)

6. The identity lifecycle: joiner, mover, leaver​

Real IAM work is mostly lifecycle work:

  1. Joiner: a new starter needs accounts and access on day one: provisioning. Best practice grants access via roles (see below), not ad-hoc requests.
  2. Mover: someone changes jobs internally. The classic failure is privilege creep: they gain the new role's access but nobody removes the old role's. After a few moves, they can touch everything.
  3. Leaver: the highest-risk step. Deprovisioning must be fast and complete; dormant accounts of ex-staff are a gift to attackers.
  4. Access reviews: periodic recertification where managers confirm "does this person still need this access?" Tedious, vital, and frequently a junior analyst's responsibility, which is precisely why it's an entry door.

Two principles govern all of it:

  • Least privilege (from M1): every account gets the minimum access needed, nothing more.
  • Role-based access control (RBAC): bundle permissions into roles ("Finance Officer", "Service Desk L1") and assign people to roles. Reviews then ask one question (right roles?) instead of auditing thousands of individual permissions.

Privileged access management (PAM) in one paragraph: admin accounts are the crown jewels, so mature organisations manage them separately: admins use ordinary accounts for daily work and check out privileged access from a PAM vault only when needed, with sessions recorded and passwords rotated automatically. If you see tools like CyberArk or Delinea in a job ad, this is what they do.

7. IAM analyst: the entry role hiding in plain sight​

IAM analyst roles are genuinely junior-friendly because the work is process-heavy rather than deeply technical at entry level. A typical day: processing joiner/mover/leaver tickets, resetting MFA for a locked-out user, chasing managers to complete access reviews, checking that a leaver's access actually all disappeared, and documenting it for auditors. It rewards accuracy, follow-through and communication, strengths career changers from admin, HR, banking and service-desk backgrounds already have. It also feeds naturally into GRC (access reviews are audit evidence) and into security engineering (identity platforms).

🧪 Lab 6: Identity hygiene on your own accounts​

This lab is done entirely on your own accounts, safe, legal, and it measurably improves your personal security today. Practising an access review on yourself is also honest interview material.

Steps:

  1. Audit your MFA coverage. List your critical accounts: primary email, banking, myGov, Microsoft/Apple/Google, and your main socials. For each, record: MFA on? What type (SMS / app / key / passkey)? Primary email matters most: it can reset everything else.
  2. Upgrade the weak spots. Install an authenticator app (e.g. Microsoft Authenticator, Google Authenticator, or a free open-source option like Aegis on Android) and switch at least your primary email from SMS (or nothing) to app-based MFA or a passkey. Save the recovery codes somewhere safe and offline.
  3. Run a personal access review. In your Google Account, review Security → Third-party apps & services (and Your connections to third-party apps); in a Microsoft account, review Apps and services you've given access to (account privacy settings). List every connected app/OAuth grant, then revoke anything you don't recognise or no longer use, that's a deprovisioning decision, exactly like the corporate version.
  4. Write it up (portfolio, sanitised): a short table: account · MFA before · MFA after · stale grants revoked. Do not include real account identifiers; the method is the artefact.

Lab success = MFA verified or upgraded on your critical accounts, at least one stale third-party grant reviewed/revoked, and a sanitised one-page write-up.

Self-check​

Answer before you reveal. The attempt is what makes it stick. Your score and card ratings are saved on this device only.

Scored self-check

Check your understanding

Commit to an answer before you check: the attempt is what makes it stick. Your first answer to each question is the one scored; practising again afterwards doesn't change it. Saved on this device only.

Question 1 of 7Your company’s email, files and payroll all sit in cloud services reachable from anywhere, by design. What is the only thing standing between an attacker in another country and that data?

Question 2 of 7A log shows that an account downloaded 400 files at 3 am. Which A of AAA produced that piece of evidence?

Question 3 of 7A shopping site you used years ago gets breached, and within days, someone is inside your email account too. Which password failure mode does this show?

Question 4 of 7Your manager asks you to rank the team’s MFA options from weakest to strongest. Which order is right?

Question 5 of 7An MFA push notification lands on your phone at 3 am, but you’re not logging in anywhere. What’s the right response?

Question 6 of 7A job ad for an IAM role lists “SAML and OIDC”. At the level this module works at, what are they?

Question 7 of 7After five years and three internal moves, an employee can still open systems from every role they’ve ever held. What has happened, and which routine control exists to catch it?

Identity is where the entry-level jobs are, so these terms have to be automatic: IAM job ads, interviewers and the Security+ exam all assume them without explaining them.

Flashcards · spaced repetition

Drill the key terms

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 18

Prompt

Why is identity “the new perimeter”?

Next module​

➡️ M7: Threats & social engineering: why attackers target people, and how to recognise phishing, BEC and malware.