Complete CISSP Guide to Identity and Access Control

Summary

Authentication and Authorization are two of the most fundamental concepts in cybersecurity and are heavily tested throughout the CISSP exam, particularly in Identity and Access Management (IAM). Although the terms are often confused, they serve completely different purposes. Authentication verifies who a user is, while Authorization determines what that user is allowed to access. This comprehensive guide explains identification, authentication methods, authorization models, Multi-Factor Authentication (MFA), Single Sign-On (SSO), federation, Zero Trust, practical examples, CISSP exam tips, common mistakes, and practice questions.

Authentication vs. Authorization

Every secure system answers two important questions:

1. Who are you?

2. What are you allowed to do?

The first question is answered by Authentication.

The second question is answered by Authorization.

Understanding the difference is essential for designing secure systems and is one of the most frequently tested concepts on the CISSP exam.

In This Guide

• Identification

• Authentication

• Authorization

• Accountability

• Authentication Factors

• Multi-Factor Authentication (MFA)

• Single Sign-On (SSO)

• Federation

• Access Control Models

• Zero Trust

• Real-World Examples

• CISSP Exam Tips

• Practice Questions

• Common Mistakes

• Key Takeaways

The Four Identity Concepts (IAAA)

Every secure system follows this sequence:

Think of it as:

This sequence appears repeatedly in CISSP exam scenarios.

Identification

Identification is the act of claiming an identity.

Examples include:

• Username

• Employee ID

• Email address

• Customer account number

At this stage, the system does not know whether the claim is legitimate.

Authentication

Authentication is the process of verifying that an identity claim is genuine.

The system confirms the user is who they claim to be before granting access.

Authentication answers:

Authentication Factors

Authentication factors are grouped into several categories.

Something You Know

Examples:

• Password

• PIN

• Passphrase

Something You Have

Examples:

• Smart card

• Hardware token

• Mobile authenticator

• FIDO2 security key

Something You Are

Examples:

• Fingerprint

• Face recognition

• Iris scan

• Voice recognition

Somewhere You Are

Examples:

• GPS location

• Corporate network

Something You Do

Examples:

• Typing rhythm

• Signature dynamics

• Mouse movement

Multi-Factor Authentication (MFA)

MFA combines two or more different authentication factors.

Examples:

✅ Password + Fingerprint

✅ Password + Smart Card

✅ Password + Hardware Token

Examples that are not MFA:

❌ Password + PIN

❌ Password + Security Question

These use the same authentication factor ("something you know").

Passwordless Authentication

Modern organizations increasingly adopt passwordless authentication.

Common methods include:

• Passkeys

• FIDO2 security keys

• Biometrics

• Windows Hello

• Apple Face ID

• Microsoft Authenticator

Benefits include:

• Reduced phishing risk

• Better user experience

• Stronger security

Authorization

After successful authentication, the system determines what the user is permitted to access.

Authorization answers:

Examples include permissions to:

• Read

• Write

• Modify

• Delete

• Approve

• Execute

• Administer

Authorization is based on business requirements and the Principle of Least Privilege.

Authentication vs. Authorization

Accountability (Accounting)

After users access systems, organizations must record their activities.

Examples include:

• Login records

• Audit logs

• SIEM events

• Database logs

• Administrative actions

Accountability supports:

• Auditing

• Compliance

• Forensics

• Incident response

Access Control Models

Authorization relies on access control models.

Discretionary Access Control (DAC)

Resource owners decide who receives access.

Mandatory Access Control (MAC)

Access is determined by security labels and classifications.

Common in government environments.

Role-Based Access Control (RBAC)

Permissions are assigned based on job roles.

Example:

HR Manager

↓

Receives HR permissions.

Attribute-Based Access Control (ABAC)

Access decisions consider attributes such as:

• Department

• Device

• Location

• Time

• Risk level

• Clearance

ABAC is widely used in cloud environments.

Single Sign-On (SSO)

SSO allows users to authenticate once and access multiple applications.

Benefits include:

• Better user experience

• Fewer passwords

• Lower support costs

• Improved productivity

Risks include:

• Larger attack surface if credentials are compromised

• Increased importance of MFA

Federation

Federation allows one organization to trust another organization's authentication.

Common technologies include:

• SAML

• OAuth 2.0

• OpenID Connect (OIDC)

Example:

Using Microsoft Entra ID to log in to Salesforce.

Authentication Protocols

Examples include:

• Kerberos

• RADIUS

• TACACS+

• LDAP

• SAML

• OAuth

• OpenID Connect

Each protocol serves different authentication and identity management requirements.

Zero Trust and Authentication

Zero Trust changes traditional authentication by requiring:

• Continuous verification

• Device health validation

• Risk assessment

• Context-aware access

• Least Privilege

• Conditional Access

Authentication is no longer a one-time event.

Privileged Access Management (PAM)

Administrative accounts require stronger authentication.

PAM solutions provide:

• Credential vaulting

• Password rotation

• Session recording

• Just-In-Time (JIT) access

• Approval workflows

Real-World Example

An employee accesses a cloud HR application.

1. User enters email address (Identification).

2. Password and authenticator app verify identity (Authentication).

3. RBAC grants access to HR records only (Authorization).

4. All actions are recorded in audit logs (Accountability).

This demonstrates the complete Identity and Access Management lifecycle.

Authentication Best Practices

Organizations should:

• Require MFA

• Enforce strong passwords

• Adopt passwordless authentication where appropriate

• Implement account lockout policies

• Monitor login activity

• Detect impossible travel events

• Use Conditional Access

• Review access permissions regularly

CISSP Exam Tips

Remember:

Authentication = Verify Identity

Authorization = Grant Permissions

Authentication always occurs before authorization.

Think:

Identify → Authenticate → Authorize → Audit

Know:

• MFA

• SSO

• Federation

• RBAC

• ABAC

• Zero Trust

• Least Privilege

These topics frequently appear in scenario-based CISSP questions.

Common Mistakes

❌ Confusing Authentication with Authorization.

✔ Authentication verifies identity.

✔ Authorization grants permissions.

❌ Believing Password + PIN is MFA.

✔ Both belong to the same authentication factor.

❌ Granting administrator access permanently.

✔ Use Just-In-Time (JIT) access whenever possible.

❌ Ignoring audit logging.

✔ Accountability is a critical security principle.

❌ Assuming authentication happens only once.

✔ Zero Trust emphasizes continuous authentication.

CISSP Practice Questions

Question 1

Authentication answers which question?

A. What resources may I access?

B. Who are you?

C. What is your job role?

D. Who approved access?

Answer: B

Question 2

Which action occurs immediately after successful authentication?

A. Encryption

B. Authorization

C. Logging

D. Backup

Answer: B

Question 3

Which example represents Multi-Factor Authentication?

A. Password + PIN

B. Password + Security Question

C. Password + Fingerprint

D. PIN + Password

Answer: C

Question 4

Which access control model assigns permissions according to job responsibilities?

A. DAC

B. MAC

C. RBAC

D. ABAC

Answer: C

Question 5

Which technology enables users to authenticate once and access multiple applications?

A. VPN

B. SIEM

C. Single Sign-On

D. IDS

Answer: C

Key Takeaways

• Identification claims an identity; Authentication verifies it.

• Authorization determines what an authenticated user is allowed to access.

• Accountability records user actions for auditing and forensic analysis.

• MFA significantly strengthens authentication by requiring multiple authentication factors.

• RBAC and ABAC are widely used authorization models.

• SSO improves usability, while federation enables trusted authentication across organizations.

• Zero Trust requires continuous authentication and authorization rather than one-time verification.

• Authentication and Authorization are foundational concepts tested throughout the CISSP exam.

Related Articles