Domains 4 and 5: networks and identity and access management

This lesson tours two domains that each carry 13 % of the exam. Domain 4, Communication and Network Security, covers how networks are designed, built and protected: network models, protocols, components, secure channels and network attacks. Domain 5, Identity and Access Management (IAM), covers how people and systems are identified, authenticated and authorized, and how their access is managed over time. The two domains are closely linked. Network controls decide which traffic may flow; identity controls decide who and what may use the resources at the end of it. Modern approaches such as zero trust blur the boundary further by making identity, rather than network location, the main basis for access decisions.

Domain 4 at a glance

The 2024 outline for Domain 4 asks candidates to apply secure design principles in network architectures, secure network components and implement secure communication channels according to design. Within those headings sit many topics: the OSI and TCP/IP models; IP version 4 and version 6; secure protocols; converged protocols such as voice over IP and storage networking; micro-segmentation and software-defined networking; wireless, cellular and satellite networks; content distribution networks; network access control; endpoint security; and remote access. Candidates who have worked as network administrators will recognize much of this, but the exam emphasizes the security reasoning behind each design choice.

Network models

The Open Systems Interconnection (OSI) model divides networking into seven layers, each providing services to the layer above. It is a conceptual model rather than a description of any real protocol stack, but it gives a shared language for locating problems and controls. The TCP/IP model, which describes how the internet actually works, uses four layers that map onto the OSI layers.

Knowing the layers helps you reason about controls. A packet-filtering firewall works mainly at layers 3 and 4, examining addresses, protocols and ports. A web application firewall works at layer 7, understanding HTTP requests. Encryption can be applied at different layers: IPsec at layer 3, TLS above the transport layer and application-level encryption at layer 7. A question about which control best addresses a particular attack often comes down to identifying the layer at which the attack operates.

Secure protocols and components

Many original internet protocols, such as Telnet, FTP and early versions of SNMP, send data, including passwords, in plain text. Secure replacements exist and should be used: SSH instead of Telnet, SFTP or FTPS instead of FTP, HTTPS (HTTP over TLS) instead of HTTP, SNMPv3 instead of earlier versions and DNSSEC to protect the integrity of DNS answers. TLS 1.2 and 1.3 are the current secure versions; older SSL and early TLS versions are deprecated.

Network components include routers, switches, firewalls, proxies, load balancers, intrusion detection and prevention systems, and network access control systems. Firewalls come in several types: packet filters that examine headers, stateful firewalls that track connections, application-level gateways or proxies that understand specific protocols, and next-generation firewalls that combine these with user identity and application awareness. Networks are divided into segments or zones of different trust, such as a demilitarized zone (DMZ) for public-facing servers, and micro-segmentation applies fine-grained policies between individual workloads. Software-defined networking separates the control plane from the data plane, which makes networks programmable but concentrates risk in the controller.

Wireless, remote access and attacks

Wireless networks extend the attack surface beyond the building. Current guidance is to use WPA3, or at least WPA2 with AES, with enterprise authentication through 802.1X where possible. Older WEP and WPA should not be used. Remote access typically uses virtual private networks (VPNs), either IPsec or TLS-based, or increasingly zero trust network access, which grants access to specific applications after verifying the user and device, rather than placing the user on the internal network.

Common network attacks include denial of service and distributed denial of service (DDoS), eavesdropping, on-path (man-in-the-middle) attacks, ARP spoofing, DNS cache poisoning, session hijacking, and attacks on wireless networks such as rogue access points and evil twins. Defences combine secure protocols, segmentation, monitoring, filtering and capacity planning.

Domain 5 at a glance

Domain 5, Identity and Access Management, covers controlling physical and logical access to assets; designing identification and authentication strategies for people, devices and services; federated identity with third-party services; implementing and managing authorization mechanisms; managing the identity and access provisioning life cycle; and implementing authentication systems. Its central idea is simple: every access to a resource should be by a known identity, verified to an appropriate level of assurance, permitted by policy and recorded.

Identification, authentication, authorization and accountability

Access control involves four steps. Identification is the claim of an identity, such as entering a username. Authentication is proving the claim. Authorization is deciding what the authenticated identity may do. Accountability is recording actions so they can be traced to the identity, through logging and auditing. Accountability depends on unique identities; shared accounts destroy it.

Authentication factors fall into three classic types. Type 1 is something you know, such as a password or PIN. Type 2 is something you have, such as a smart card, hardware token or phone running an authenticator app. Type 3 is something you are, a biometric such as a fingerprint, face or iris. Some schemes add context such as location or behaviour. Multifactor authentication combines factors of different types; two passwords are still a single factor. Phishing-resistant methods, such as FIDO2 security keys and passkeys, are now preferred for high-risk access.

Biometric systems make two kinds of error. A false rejection (Type I error) denies a legitimate user; a false acceptance (Type II error) admits an impostor. Raising the system's sensitivity lowers false acceptances but raises false rejections. The crossover error rate (CER), where the two rates are equal, is used to compare systems: a lower CER means a more accurate system.

Access control models

Authorization is enforced through access control models. Discretionary access control (DAC) lets the owner of a resource decide who may access it, as with file permissions on most desktop operating systems. Mandatory access control (MAC) enforces access based on labels, such as classifications and clearances, set by the system and not changeable by users; it is used in military and high-security systems. Role-based access control (RBAC) grants permissions to roles, and users receive permissions by being assigned roles, which simplifies administration in large organizations. Rule-based access control applies global rules, such as firewall rules or time-of-day restrictions. Attribute-based access control (ABAC) makes decisions by evaluating attributes of the user, the resource, the action and the environment against policies, which supports fine-grained and context-aware decisions.

Federation, single sign-on and the identity life cycle

Single sign-on (SSO) lets users authenticate once and access many systems. Federation extends SSO across organizations, so that a user authenticated by their own organization (the identity provider) can access a partner's or cloud provider's service (the relying party or service provider). Common standards include SAML 2.0 for enterprise web SSO, OAuth 2.0 for delegated authorization and OpenID Connect, built on OAuth, for authentication. Inside organizations, Kerberos provides SSO using tickets issued by a key distribution centre, and directories such as LDAP-based services store identities.

The identity life cycle covers provisioning when someone joins, changes when they move roles and deprovisioning when they leave, often summarized as joiners, movers and leavers. Privilege creep, the gradual accumulation of access as people change roles, is a common problem; regular access reviews, in which managers confirm that each user's access is still needed, help control it. Privileged accounts, such as administrators and service accounts, need extra protection through privileged access management: vaulting credentials, granting just-in-time elevation, recording sessions and reviewing use.

Zero trust: where networks and identity meet

Zero trust is a strategy rather than a product, and it shows how closely Domains 4 and 5 are linked. Traditional network design assumed that anything inside the perimeter could be trusted, so a single compromised laptop could often reach many internal systems. Zero trust removes that assumption. Every request to access a resource is evaluated on its merits, using the identity of the user, the health and identity of the device, the sensitivity of the resource and contextual signals such as location and time. Access is granted with least privilege, for as short a time as practical, and all activity is logged and monitored.

In practice, organizations move toward zero trust gradually. Common steps include strong, phishing-resistant multifactor authentication for all users; an accurate inventory of devices with health checks; micro-segmentation to limit lateral movement; replacing broad VPN access with application-specific access; and continuous monitoring with automated responses. Publications such as NIST SP 800-207 describe zero trust architectures, and government agencies in both Canada and the United States have published guidance encouraging their adoption.

Throughout both domains, remember the CISSP mindset: the right control is the one that addresses the actual risk at the right layer, for the right identity, at a justified cost.