Protection of Information Assets · Topic 2 of 8
Identity and Access Management
Identification, authentication and authorization, MFA and biometrics, least privilege, RBAC, provisioning, access reviews and privileged access.
- 3 min
- Unique IDs enable accountability; avoid shared accounts.
- MFA needs different factor types.
- Owners approve access; administrators implement it.
What it is
Identity and access management (IAM) makes sure each person or system has a unique identity, proves it, and gets only the access their role requires, for only as long as they need it. It covers the whole life cycle of an account: request, approval, provisioning, change, review and removal.
How it works
Identification, authentication, authorization
| Step | Question | Example |
|---|---|---|
| Identification | Who are you? | A unique user ID |
| Authentication | Prove it | Password, token, biometric |
| Authorization | What may you do? | Permissions based on role |
| Accountability | What did you do? | Logs tied to the unique ID |
Shared and generic accounts break accountability, because actions cannot be traced to one person.
Authentication factors
| Factor | Examples |
|---|---|
| Something you know | Password, PIN |
| Something you have | Hardware token, smart card, phone authenticator app |
| Something you are | Fingerprint, face, iris |
Multifactor authentication (MFA) combines factors of different types. A password plus a security question is still one factor.
Biometrics
| Measure | Meaning |
|---|---|
| False rejection rate (FRR) | Authorized users wrongly rejected (type I error) |
| False acceptance rate (FAR) | Unauthorized users wrongly accepted (type II error); the more serious for security |
| Crossover (equal) error rate (CER/EER) | Point where FAR equals FRR; a lower CER means a more accurate system |
Access principles
- Least privilege: only the access needed for the job.
- Need to know: access to data only when the task requires it.
- Segregation of duties: incompatible permissions split between people.
- Role-based access control (RBAC): permissions assigned to roles, and users assigned to roles.
- Default deny: anything not explicitly allowed is blocked.
Provisioning and access reviews
- Access is requested, approved by the data or system owner, and set up by an administrator who is not the approver.
- Movers have old access removed when they change roles, avoiding privilege creep.
- Leavers lose access on their last day or at notification.
- Periodic access reviews by owners confirm each account and permission is still needed; the reviewer must receive a complete, accurate list from the system.
Privileged access
Administrator and service accounts need extra control: separate named admin accounts, MFA, a privileged access management (PAM) tool with password vaulting and session recording, just-in-time elevation, and independent review of privileged activity.
Single sign-on and federation
Single sign-on (SSO) lets a user authenticate once to reach several systems; federation extends trust across organizations using standards such as SAML or OpenID Connect. SSO improves usability and central control, but the single credential becomes a high-value target, so it should be protected with MFA.
When a question asks who should approve access to a system, choose the data or system owner, not the IT administrator who grants it.
How the exam asks about this
- "Several staff share one administrator account." Accountability is lost; issue named accounts and use PAM.
- "Employees keep old permissions after changing roles." Privilege creep; review and remove access on transfer.
- "Which biometric error rate matters MOST for security?" The false acceptance rate.
What to remember for the exam
- Unique IDs enable accountability; avoid shared accounts.
- MFA needs different factor types.
- Owners approve access; administrators implement it.
- Remove access promptly for movers and leavers; review access periodically.
- Control privileged accounts with PAM, MFA and independent review.
An access review that uses a list supplied by the system administrator, rather than one extracted independently from the system, may omit the very accounts that should be found.
Common mistakes
Calling two passwords "two-factor". Both are something you know.
Letting the administrator approve and grant the same access.
Ignoring service accounts in access reviews.
Check yourself
What is privilege creep?
The build-up of unnecessary access as users change roles without old permissions being removed.
Which biometric measure indicates overall accuracy?
The crossover (equal) error rate; lower is better.
Who should approve a user's access to a business application?
The data or system owner.
Topic 2 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.