Identity and Access Management (IAM) · Topic 1 of 4
Access Control and Authentication Strategy
Physical and logical access control, AAA, authentication factors, MFA, passwordless, biometric error rates, session management, credential management and SSO.
- 3 min
- MFA means different factor types.
- FRR is Type I, FAR is Type II; lower CER is better.
- Phishing-resistant MFA uses public key methods such as FIDO2.
What it is
Access control decides who or what may reach information, systems, devices, facilities, applications and services. It starts with a strong identification and authentication strategy: knowing reliably that a person, device or service is who it claims to be.
How it works
What access control covers
Physical and logical access are both in scope: information, systems, devices, facilities, applications and services. The same principles apply: least privilege, need to know and accountability.
AAA and accountability
Authentication, authorization and accounting (AAA): prove identity, grant rights, record activity. Accountability needs unique identities; shared accounts break it.
Authentication factors
| Factor | Examples |
|---|---|
| Something you know | Password, PIN |
| Something you have | Smart card, hardware token, phone authenticator, passkey device |
| Something you are | Fingerprint, face, iris |
| Context (supporting) | Location, device health, time |
Multifactor authentication (MFA) requires factors from different categories. Two passwords are not MFA.
Passwordless and phishing resistance
Passwordless methods such as FIDO2/WebAuthn passkeys and smart cards use public key cryptography bound to the site, so they resist phishing. SMS codes are weaker because they can be intercepted or redirected through SIM swapping.
Biometric accuracy
| Measure | Meaning |
|---|---|
| False rejection rate (FRR), Type I error | A legitimate user is rejected |
| False acceptance rate (FAR), Type II error | An impostor is accepted |
| Crossover error rate (CER / EER) | Where FRR equals FAR; lower CER means a more accurate system |
For high-security areas, a false acceptance (Type II) is the more dangerous error. Tuning sensitivity up lowers FAR but raises FRR.
Registration, proofing and identity establishment
Before credentials are issued, verify identity to an appropriate level (identity proofing), for example checking government documents for higher-risk access. Credentials are only as trustworthy as the proofing behind them.
Session management
Limit session lifetime, re-authenticate for sensitive actions, generate new session identifiers at login, and terminate sessions on logout and inactivity.
Credential management
Password policies following current guidance favour length and checking against breached-password lists over forced frequent changes and complex composition rules. Use password managers and secrets vaults; avoid credentials in code.
Single sign-on and related approaches
| Approach | Meaning |
|---|---|
| Single sign-on (SSO) | One authentication grants access to many systems |
| Federated identity | Trust between organizations so one's identities are accepted by another |
| Just-in-time (JIT) access | Privileges granted only when needed, for a limited time |
| Groups and roles | Manage access by role rather than per user |
SSO improves usability and centralizes control, but the SSO credential becomes a high-value target, so protect it with MFA.
Physical access with multiple factors
A badge alone can be lost or shared. Adding a PIN pad or biometric reader at a sensitive door provides a second factor at the moment of entry without staffing the door.
How the exam asks about this
- "Badge-only server room; badges sometimes lost; no guard." Add a PIN or biometric reader.
- "Which error is most serious for a vault's biometric system?" False acceptance (Type II).
- "Password and security question." Not MFA; both are something you know.
What to remember for the exam
- MFA means different factor types.
- FRR is Type I, FAR is Type II; lower CER is better.
- Phishing-resistant MFA uses public key methods such as FIDO2.
- Proof identity before issuing credentials.
- SSO helps users and control but needs strong protection.
Shared accounts destroy accountability. Every action must be traceable to one identity.
Common mistakes
Counting two knowledge factors as MFA.
Mixing up FAR and FRR.
Forcing frequent password changes while ignoring breached-password checks.
Check yourself
What is a Type II biometric error?
A false acceptance: an impostor is accepted.
Why are FIDO2 passkeys phishing resistant?
They use public key cryptography bound to the legitimate site, so credentials cannot be replayed to a fake site.
What does the crossover error rate indicate?
The point where false acceptance and false rejection rates are equal; lower means more accurate.
Topic 1 of 4 in Identity and Access Management (IAM)
Test yourself on Identity and Access Management (IAM)
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.