In This Guide

• What is Identity and Access Management?

• Why IAM Matters

• Core IAM Components

• Identification vs Authentication vs Authorization vs Accountability

• Authentication Factors

• Multifactor Authentication (MFA)

• Access Control Models

• Identity Lifecycle Management

• Federation and Single Sign-On

• Privileged Access Management

• Zero Trust and IAM

• Real-World Examples

• CISSP Exam Tips

• Common Mistakes

• Practice Questions

• Key Takeaways

Identity and Access Management (IAM)

Identity and Access Management (IAM) is the discipline of ensuring that the right individuals have access to the right resources at the right time—and for the right reasons.

IAM is one of the most important security domains in the CISSP Common Body of Knowledge because nearly every cyberattack involves compromised identities or improperly managed access.

Modern organizations rely on IAM to manage employees, contractors, customers, cloud users, APIs, workloads, service accounts, and machine identities across hybrid environments.

Why IAM Matters

Effective IAM helps organizations:

• Protect sensitive information

• Prevent unauthorized access

• Reduce insider threats

• Support regulatory compliance

• Improve operational efficiency

• Enable secure remote work

• Secure cloud resources

• Support Zero Trust Architecture

Without strong IAM, even the best firewalls and encryption cannot prevent attackers from using stolen credentials.

Core Components of IAM

An effective IAM program includes:

• Identity Management

• Authentication

• Authorization

• Access Control

• Identity Governance

• Federation

• Provisioning

• Deprovisioning

• Privileged Access Management (PAM)

• Auditing and Monitoring

Together these controls ensure users receive only the permissions necessary to perform their job functions.

Identification vs Authentication vs Authorization vs Accountability

This distinction is heavily tested on the CISSP exam.

Example

Employee enters:

Username → Identification

Password + MFA → Authentication

System grants HR records access → Authorization

Logs every action → Accountability

Authentication Factors

Authentication verifies identity using one or more factors.

Something You Know

Examples:

• Password

• PIN

• Passphrase

• Security question

Something You Have

Examples:

• Smart card

• Security token

• Mobile authenticator

• Hardware key (FIDO2)

Something You Are

Examples:

• Fingerprint

• Iris scan

• Facial recognition

• Voice recognition

Somewhere You Are

Examples:

• GPS location

• Corporate office network

Something You Do

Examples:

• Typing rhythm

• Mouse movement

• Signature dynamics

Multifactor Authentication (MFA)

MFA combines two or more different authentication factors.

Example:

• Password

• Hardware token

This is MFA because the factors are different.

Password + PIN is NOT MFA because both are knowledge factors.

Single Sign-On (SSO)

SSO allows users to authenticate once and gain access to multiple applications.

Advantages:

• Better user experience

• Fewer passwords

• Reduced help desk costs

• Improved productivity

Disadvantages:

• Compromise of SSO account may affect many systems

• Requires strong MFA

• High-value attack target

Federation

Federation enables users to authenticate with one organization and access another organization's resources.

Common standards include:

• SAML

• OAuth 2.0

• OpenID Connect (OIDC)

Example:

Logging into Salesforce using Microsoft Entra ID.

Authorization

After authentication, authorization determines permitted actions.

Typical permissions include:

• Read

• Write

• Execute

• Delete

• Approve

• Administer

Authorization should always follow the Principle of Least Privilege.

Access Control Models

Discretionary Access Control (DAC)

Resource owners determine access.

Advantages:

• Flexible

• Easy to manage

Disadvantages:

• Less secure

• Users may grant excessive permissions

Mandatory Access Control (MAC)

Access decisions are based on security labels and classifications.

Examples:

• Secret

• Top Secret

• Confidential

Most commonly used in military and government environments.

Role-Based Access Control (RBAC)

Permissions are assigned based on job roles.

Example:

HR Manager

↓

Receives predefined HR permissions.

Advantages:

• Easy administration

• Consistent permissions

• Widely deployed

Attribute-Based Access Control (ABAC)

Permissions are determined dynamically using attributes.

Examples:

• User department

• Device type

• Time

• Location

• Clearance

• Risk score

ABAC is highly flexible and commonly used in cloud environments.

Identity Lifecycle Management

IAM manages identities throughout their lifecycle.

Joiner

New employee account creation.

Mover

Employee changes department.

Permissions should change accordingly.

Leaver

Employee leaves organization.

Accounts should be disabled immediately.

Failure to remove accounts creates orphaned accounts and increases security risk.

Privileged Access Management (PAM)

Administrative accounts present the highest risk.

PAM solutions provide:

• Credential vaulting

• Password rotation

• Session monitoring

• Just-In-Time (JIT) access

• Approval workflows

• Privileged session recording

Principle of Least Privilege

Users receive only the permissions necessary to perform assigned duties.

Benefits include:

• Smaller attack surface

• Reduced insider threats

• Limited malware spread

• Easier compliance

Least Privilege is one of the most frequently tested CISSP concepts.

Separation of Duties

Critical tasks are divided among multiple individuals.

Example:

One employee:

Creates vendor

Another employee:

Approves payment

This prevents fraud.

Zero Trust and IAM

Zero Trust assumes:

IAM plays a central role through:

• Continuous authentication

• Risk-based authentication

• Device validation

• Least privilege

• Microsegmentation

• Conditional access policies

Identity has become the new security perimeter.

Machine Identities

Modern organizations manage identities beyond human users.

Examples include:

• APIs

• Containers

• Kubernetes workloads

• Cloud services

• Service accounts

• Robots

• IoT devices

Machine identities now outnumber human identities in many enterprises.

Real-World Example

An employee logs into Microsoft 365.

1. User enters username.

2. Password is verified.

3. Microsoft Authenticator approves login.

4. Conditional Access checks device compliance.

5. RBAC grants access to SharePoint.

6. Activity is logged.

7. Risk engine continuously evaluates the session.

This represents a modern enterprise IAM implementation.

CISSP Exam Tips

Remember this sequence:

Identify → Authenticate → Authorize → Audit

Know the differences between:

• Authentication

• Authorization

• Accounting

Understand when to use:

• RBAC

• ABAC

• MAC

• DAC

Expect scenario-based questions involving:

• Least privilege

• Federation

• MFA

• PAM

• Identity lifecycle

• Zero Trust

Common Mistakes

❌ Confusing authentication with authorization

❌ Believing password + PIN is MFA

❌ Forgetting to disable terminated employee accounts

❌ Granting permanent administrator privileges

❌ Sharing privileged accounts

❌ Ignoring service account management

❌ Assigning permissions directly instead of using roles

CISSP Practice Questions

Question 1

Which access control model grants permissions based on job functions?

A. DAC

B. MAC

C. RBAC

D. ABAC

Answer: C

Question 2

Which authentication method uses two different authentication factors?

A. Password + PIN

B. Password + Security Question

C. Password + Fingerprint

D. PIN + Password

Answer: C

Question 3

Which IAM principle grants users only the permissions necessary to perform assigned tasks?

A. Need to Know

B. Separation of Duties

C. Least Privilege

D. Defense in Depth

Answer: C

Question 4

Which protocol is commonly used for enterprise federation?

A. FTP

B. SMTP

C. SAML

D. SNMP

Answer: C

Key Takeaways

• IAM ensures the right users access the right resources.

• Authentication verifies identity; authorization determines permissions.

• MFA significantly strengthens authentication.

• RBAC is role-based, while ABAC evaluates attributes dynamically.

• Identity lifecycle management includes Joiner, Mover, and Leaver processes.

• PAM protects privileged accounts through vaulting and monitoring.

• Zero Trust relies heavily on strong identity verification and least privilege.

• IAM is one of the highest-priority knowledge areas in CISSP Domain 5.

Related Articles

• Least Privilege

• Defense in Depth

• Zero Trust Architecture

• Multi-Factor Authentication (MFA)

• Authentication vs Authorization

• Access Control Models (DAC, MAC, RBAC, ABAC)

• Identity Federation and Single Sign-On (SSO)

• Privileged Access Management (PAM)

• Security Governance

• Data Classification