2.1.5. Identity and Access Management
💡 First Principle: Identity is the new perimeter — in cloud and hybrid environments where traditional network boundaries are fluid, controlling who can access what is more reliable than controlling where traffic comes from.
Credential theft is the single most common initial access technique. Once an attacker has valid credentials, they look exactly like a legitimate user to most security controls. This is why identity controls — MFA, PAM, SSO with anomaly detection — are so critical: they add friction to credential abuse and create detection signals when credentials are used anomalously.
MFA (Multi-Factor Authentication) requires two or more factors: something you know (password), something you have (token, phone), something you are (biometrics). MFA defeats password spray and credential stuffing attacks — knowing the password isn't enough. However, MFA can be bypassed via MFA fatigue attacks (flooding the user with push notifications until they approve one), SIM swapping, and adversary-in-the-middle proxy attacks.
SSO (Single Sign-On) authenticates once and grants access to multiple systems via token. Security benefit: users maintain one strong credential instead of many weak ones; authentication events centralize for monitoring. Risk: a compromised SSO credential grants access to everything it's federated with.
Federation extends identity trust across organizational boundaries — enabling users from one organization to authenticate to another's systems using their own identity provider. SAML and OIDC (an identity layer built on OAuth, which by itself is an authorization framework) are the dominant protocols. Security concerns include token hijacking and misconfigurations in attribute mapping.
PAM (Privileged Access Management) controls and monitors high-privilege accounts (domain admins, root, service accounts). Core PAM capabilities:
- Just-in-time access (privileges granted only when needed, then revoked)
- Session recording (full video and keystroke logs of admin sessions)
- Credential vaulting (admin passwords stored in PAM; users check out credentials rather than knowing them permanently)
- Dual control (two administrators must approve sensitive actions)
CASB (Cloud Access Security Broker) sits between users and cloud services to enforce security policy — visibility into what SaaS apps are being used (shadow IT discovery), data loss prevention for cloud data, and authentication enforcement.
| IAM Control | Primary Threat Defeated | Residual Risk |
|---|---|---|
| MFA | Credential theft, password spray | MFA fatigue, SIM swap, AITM proxy |
| PAM | Insider threat, lateral movement to admin | Over-privileged service accounts outside PAM scope |
| SSO + SIEM | Anomalous login detection | SSO token theft bypasses individual app auth |
| CASB | Shadow IT, cloud data exfil | Encrypted traffic inspection limitations |
| Passwordless | Phishing, keylogging | Device compromise |
Account lifecycle and service accounts. Deprovisioning must be part of offboarding: accounts of departed employees left active are a standing way in for former staff or anyone holding their credentials, and the cause is an offboarding process that never removes access. Service accounts are non-human: an interactive logon by one (LogonType 2 or 10) is abnormal and suggests stolen credentials used for lateral movement, so deny interactive and RDP logon rights to them.
⚠️ Exam Trap: SSO creates a "single point of compromise" risk — if the identity provider is breached, all federated applications are exposed. This doesn't make SSO bad (the centralization also centralizes monitoring and security controls), but it means protecting the IdP is critical.
Device Management: Mobile and Endpoint
Identity controls decide who is signing in; device management decides what they are signing in from. Mobile device management (MDM), often delivered as part of a unified endpoint management platform, enrolls phones, tablets, and laptops so the organization can push configuration, inventory what exists, and evaluate each device against a compliance policy.
| Capability | What it gives the SOC |
|---|---|
| Compliance policy | Rules such as minimum OS version, encryption, passcode, and not jailbroken or rooted |
| Actions for noncompliance | Mark the device noncompliant, notify the user, remotely lock it, or retire it (remove corporate data) |
| Conditional access integration | The identity provider can require a compliant device, so a rooted or outdated device is refused at sign-in |
| Inventory | A list of managed devices, which also exposes unmanaged ones connecting to corporate services |
For the analyst, the value is that device health becomes an access decision rather than an alert to chase. UEBA or the SIEM can flag a sign-in from a risky phone; MDM compliance combined with conditional access refuses it automatically.
⚠️ Exam Trap: MDM enforces device state; it does not replace EDR. An enrolled, compliant laptop can still run malicious code, which is why endpoints need both device management and endpoint detection.
Reflection Question: An attacker steals a developer's SSO session token from their browser cookie store. The developer has MFA enabled. Has MFA been "bypassed"? Explain what happened and what additional control would have detected or prevented the token theft.
