Leo, the newly appointed CISO at MSDCorp, had already strengthened governance, risk, and physical security. But one critical gap remained—Identity and Access Management (IAM). He knew that if identities were not protected, the whole fortress could collapse from the inside.
This is where Domain 5 of CISSP became his guiding map.
1. The Challenge of Access
When Leo entered the security operations center, he noticed employees logging in with weak credentials, shared accounts, and no multi-factor authentication.
- Core challenge: Weak authentication and poor identity lifecycle management are high-risk areas in IAM.
- Leo’s Thought: “A castle is only as strong as its gates. If the keys are stolen or copied, invaders walk right in.”
2. Building Strong Authentication
Leo started by enforcing multi-factor authentication (MFA) across critical systems—ensuring “something you know, something you have, and something you are.”
- Exam Note: Authentication factors:
- Knowledge (password, PIN)
- Possession (smart card, token)
- Inherence (biometrics)
- Stronger when combined.
Leo rolled out smart cards for employees and biometric verification for high-privilege administrators.
3. Defining Identity Lifecycle
He mapped the entire identity lifecycle:
- Provisioning (creating accounts for new employees)
- Management (updating access as roles change)
- De-provisioning (revoking access upon exit)
Exam Note: Role-Based Access Control (RBAC) ensures “least privilege” and “need to know.”
Leo introduced automatic account disabling after termination, ensuring no “ghost accounts” lingered.
4. Controlling Access with Models
Leo implemented access control models to suit business needs:
- DAC (Discretionary Access Control): Flexible but weaker (owner decides).
- MAC (Mandatory Access Control): Strict, government-like, uses labels (Top Secret, Secret, etc.).
- RBAC (Role-Based): Best for MSDCorp—permissions assigned to roles, not individuals.
- ABAC (Attribute-Based): Used for cloud applications, evaluating multiple attributes (user, resource, environment).
Note: Be ready to match access models to scenarios.
5. Authorization and Accountability
Leo emphasized the difference between identification, authentication, authorization, and accountability (IAAA):
- Identification – Claiming an identity (username).
- Authentication – Proving identity (password, token).
- Authorization – Granting rights (files, systems).
- Accountability – Tracing actions (audit logs).
Note: CISSP often tests on IAAA sequence.
He introduced centralized logging and SIEM monitoring, ensuring every action tied back to a verified identity.
6. Privileged Access Management
Leo noticed admins had unrestricted access—a dangerous “god mode.”
He deployed Privileged Access Management (PAM):
- Just-in-time admin access.
- Password vaulting and rotation.
- Session monitoring and recording.
Note: Privileged accounts are the #1 target for attackers.
7. Closing the Loop – Federated and Cloud IAM
As MSDCorp expanded globally, Leo enabled Federated Identity Management with SAML, OAuth, and OpenID Connect—allowing employees to securely use one identity across multiple systems and cloud providers.
- Exam Note:
- SAML → XML-based, often for SSO in enterprises.
- OAuth → Authorization framework (e.g., login with Google).
- OpenID Connect → Authentication layer built on OAuth.
Final Conclusion
After six months, Leo stood in front of the board. The IAM program had transformed MSDCorp. Every identity was secured, every action accountable, and privileged accounts no longer uncontrolled.
He smiled and said:
“We’ve not just built gates; we’ve built intelligent guardians. IAM is the trust fabric of our enterprise.”
Key Takeaways for CISSP Domain 5
- IAM secures who can access what, when, and how.
- Know authentication factors, identity lifecycle, and access control models.
- Understand IAAA (Identification, Authentication, Authorization, Accountability).
- Privileged accounts must be tightly controlled.
- Federation (SAML, OAuth, OIDC) is critical in modern cloud ecosystems.
“Always align IAM with least privilege, defense-in-depth, and zero trust—this is the heart of Domain 5.”
