5.0 Access Control and Identity Management

5.1 Compare and contrast the function and purpose of authentication services.

• RADIUS
• TACACS+
• Kerberos
• LDAP
• XTACACS
• SAML
• Secure LDAP

5.2 Given a scenario, select the appropriate authentication, authorization or access control.

• Identification vs. authentication vs. authorization
• Authorization
  • Least privilege
  • Separation of duties
  • ACLs
  • Mandatory access control
  • Discretionary access control
  • Rule-based access control
  • Role-based access control
  • Time of day restrictions
• Authentication
  • Tokens
  • Common access card
  • Smart card
  • Multifactor authentication
  • TOTP
  • HOTP
  • CHAP
  • PAP
  • Single sign-on
  • Access control
  • Implicit deny
  • Trusted OS
• Authentication factors
  • Something you are
  • Something you have
  • Something you know
  • Somewhere you are
  • Something you do
• Identification
  • Biometrics
  • Personal identification verification card
  • Username
• Federation
• Transitive trust/authentication

5.3 Install and configure security controls when performing account management, based on best practices.

• Mitigates issues associated with users with multiple account/roles and/or shared accounts
• Account policy enforcement
  • Credential management
  • Group policy
  • Password complexity
  • Expiration
  • Recovery
  • Disablement
  • Lockout
  • Password history
  • Password reuse
  • Password length
  • Generic account prohibition
• Group based privileges
• User assigned privileges
• User access reviews
• Continuous monitoring