6.5. Authentication Systems
💡 First Principle: Authentication systems are the infrastructure that implements identity verification at scale — they are not just login pages but complete ecosystems of directories, protocols, trust relationships, and credential stores that determine who can prove their identity across every system in the organization.
Why this matters: The CISSP tests whether you understand the architectural components of authentication infrastructure — not just "what is MFA" but "how does Kerberos authenticate a user to a file server through a domain controller, and what happens if the KDC is compromised?" Protocol-level understanding is required for scenario questions about authentication failures and attack vectors.
⚠️ Common Misconception: "Active Directory IS Kerberos." Active Directory is a directory service that uses Kerberos as its default authentication protocol, but AD also supports NTLM (for backward compatibility), LDAP (for directory queries), and certificate-based authentication. Kerberos can exist without AD, and AD uses protocols beyond Kerberos. The exam tests this distinction.
