CISSP cheat sheet · Domain 5 · 13% of exam
Identity and Access Management
Controlling who (and what) can access which resources: identification, authentication factors, access control models, federation and the identity lifecycle.
Rule cards
| IAAA | Identification (unique ID) → Authentication (prove it) → Authorization (permissions) → Accountability (logs). Shared accounts destroy accountability → unique IDs. |
|---|---|
| Factors | Type 1 = something you know (PIN) · Type 2 = have (smart card, token, passkey device) · Type 3 = are (biometric) · MFA = different TYPES · Best low-friction secure = native biometrics / passkeys (FIDO2) · SMS OTP and security questions are weak. |
| Biometrics | Type I error = false rejection (FRR, annoying) · Type II = false acceptance (FAR, dangerous) · lower CER/EER = more accurate. Lowering sensitivity → FRR down, FAR up. |
| Access control models | DAC = owner decides · MAC = labels and clearances · RBAC = job role · ABAC = attributes (department + time + device + location) · Rule-based = global rules · Content-dependent = what is inside · Context-dependent = circumstances (time, session, location). |
| SSO / federation | SAML: IdP authenticates, SP consumes the assertion · OAuth 2.0 = authorization (delegated access) · OIDC = authentication on top of OAuth (ID token) · Federation = trust across organisations. |
| Kerberos | KDC = AS (issues TGT) + TGS (service tickets) · symmetric crypto · needs time sync · KDC = single point of failure · Golden ticket = KRBTGT hash (whole domain) · Silver ticket = one service account. |
| Lifecycle | Provision → review → revoke · privilege creep → periodic access review / recertification · disable access at termination · password guessing → account lockout · admins → JIT / PAM. |
| Session management | Idle + absolute timeouts · new session ID after login (prevents fixation) · Secure/HttpOnly cookies · re-authenticate for sensitive actions. |
Hard words made simple
| Term | Simple meaning | Example / analogy | Exam hook |
|---|---|---|---|
| Federation | Trust between organisations so users log in with home credentials | Partner staff use their own company login | SAML / OIDC |
| IdP / SP | Identity provider (logs you in) / service provider (the app) | “Sign in with Google” for an app | IdP issues the assertion |
| OAuth vs OIDC | OAuth = permission to access · OIDC = proves who you are | “Allow app to read your calendar” vs “Login with Google” | Login/identity → OIDC |
| TGT | Ticket Granting Ticket: the Kerberos entry pass | A day pass at a theme park | Issued by the AS |
| Privilege creep | Access piling up as people change roles | Old finance rights after a move to HR | → access recertification |
| JIT access / PAM | Admin rights only when needed, then removed | 2-hour approved admin window | No standing privilege |
| Dual control vs split knowledge | Two people needed together vs each knows half a secret | Two keys for a vault vs half a password each | Not the same as periodic review |
| Clipping level | Allowed failures before action | Lock after 5 wrong passwords | Brute-force / guessing control |
| Session fixation | Attacker forces a known session ID on the victim | — | Fix: new session ID after login |
| Passwordless / FIDO2 | Login with device biometrics or passkey, no password | Face ID on a phone | Phishing-resistant + low effort |