Security Operations · Topic 2 of 10
Identity and Logging Practices
Identity concepts such as MFA, SSO, SAML, OAuth and PAM, plus logging practices like central collection, time sync and key Windows event IDs for CySA+.
- 4 min
- Authentication proves identity, authorisation grants permissions, accounting records activity.
- MFA needs different factor types, not two of the same type.
- SAML is for federated web SSO, OAuth 2.0 is for delegated authorisation, OIDC adds authentication to OAuth.
What it is
Identity and logging are the two things an analyst relies on most when reconstructing an event. Identity answers who did something, and logs answer what happened, where and when.
Attackers target identity because stolen credentials let them look like normal users. Good logging makes that behaviour visible after the fact.
How it works
Identity concepts
Authentication proves who you are. Authorisation decides what you may do. Accounting records what you did, and together the three are called Authentication, Authorisation and Accounting (AAA).
Multifactor authentication (MFA) combines different factor types, so one stolen secret is not enough.
| Factor | Example |
|---|---|
| Something you know | Password, personal identification number (PIN) |
| Something you have | Hardware token, authenticator app, smart card |
| Something you are | Fingerprint, face |
| Somewhere you are | Location or network used as a signal |
Two passwords are still one factor type, so that is not MFA.
Single sign on and federation
Single sign on (SSO) lets a user sign in once and reach several applications. Federation extends that trust across organisations, so an identity provider at one organisation vouches for a user to a service at another.
| Standard | Purpose |
|---|---|
| Security Assertion Markup Language (SAML) | Passes signed authentication statements, mostly for web SSO |
| OAuth 2.0 | Delegated authorisation using access tokens |
| OpenID Connect (OIDC) | An authentication layer built on top of OAuth 2.0 |
Directory services such as Lightweight Directory Access Protocol (LDAP) based directories hold accounts and groups. In Windows environments, Active Directory is the usual directory.
Access control and privileged accounts
Role based access control (RBAC) grants permissions by job role. Attribute based access control (ABAC) uses attributes such as department, device state or time.
Privileged access management (PAM) protects powerful accounts. It typically vaults credentials, grants access only when needed (just in time), and records the sessions.
Logging practices
Useful logs come from many sources: operating systems, applications, firewalls, proxies, identity providers and cloud audit trails. A good log entry says who, what, when and where.
- Collect centrally. Send logs to a log server or Security Information and Event Management (SIEM) platform, so an attacker who wipes one host cannot erase the evidence.
- Synchronise time. Use the Network Time Protocol (NTP) on every system, and prefer Coordinated Universal Time (UTC), or events cannot be lined up across sources.
- Protect integrity. Restrict who can change or delete logs, and use write once storage or hashing where possible.
- Retain by policy. Keep logs long enough for investigations and for compliance rules.
- Set the right level. Too little detail hides the attack, and too much floods the analyst and storage.
Syslog is the common format for Unix style and network devices, and its severity runs from 0 (emergency) to 7 (debug). Windows systems write to the Windows Event Log.
Windows events worth knowing
| Event ID | Meaning |
|---|---|
| 4624 | Successful logon |
| 4625 | Failed logon |
| 4688 | A new process was created |
| 4720 | A user account was created |
| 1102 | The Security audit log was cleared |
The logon event also carries a logon type. Type 3 is a network logon and type 10 is a remote desktop logon.
EventID: 4625 LogonType: 3 Account: svc_backup Source: 198.51.100.24
EventID: 4625 LogonType: 3 Account: svc_backup Source: 198.51.100.24
EventID: 4624 LogonType: 3 Account: svc_backup Source: 198.51.100.24Repeated failures followed by one success from the same address suggest that guessing eventually worked. That pattern deserves a closer look.
What to remember for the exam
- Authentication proves identity, authorisation grants permissions, accounting records activity.
- MFA needs different factor types, not two of the same type.
- SAML is for federated web SSO, OAuth 2.0 is for delegated authorisation, OIDC adds authentication to OAuth.
- PAM vaults, limits and records the use of privileged accounts.
- Central logging protects evidence from local tampering.
- Time must be synchronised, or timelines across sources do not match.
- Event 4624 is a good logon, 4625 a failed one, 4688 a new process, and 1102 a cleared audit log.
- An audit log that has been cleared is a strong sign of an attacker covering tracks.
A cleared log or a stopped logging service is itself an indicator of compromise. Treat the gap as evidence, not as an absence of events.
Common mistakes
Calling a password plus a PIN multifactor. Both are things you know, so it is a single factor type.
Mixing up OAuth and SAML. OAuth is about what an application may do for you, while SAML carries who you are between organisations.
Leaving logs only on the host. A local log can be edited or deleted by the attacker who owns the machine.
Ignoring time zones. Mixed local times make a correlated timeline wrong, which is why UTC is preferred.
Logging everything at the highest detail. Volume without purpose slows searches and hides important events.
Check yourself
Why is a password plus a security question not MFA?
Both are something you know, so only one factor type is used.
Which Windows event ID records a failed logon?
Event 4625.
Why send logs to a central server?
It keeps copies safe if an attacker alters or wipes logs on the compromised host, and it allows correlation across sources.
Topic 2 of 10 in Security Operations
Test yourself on Security Operations
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.