Identity and Access Management

CISSP Domain 5 in depth: identification, authentication, authorization and accountability for physical and logical access, identifiers and identity proofing with NIST SP 800-63-4 assurance levels, Login.gov and REAL ID, NIST SP 800-63B-4 password rules and salted password hashing, one-time passwords, FIDO2 passkeys and biometrics under Illinois BIPA and other state laws, directories, single sign-on and Kerberos, federation with SAML 2.0, OAuth 2.0 and OpenID Connect, discretionary, mandatory, role-based, attribute-based and risk-based access control, policy-based authorization and privileged access management, the joiner, mover and leaver life cycle with SCIM and access reviews, credential, phishing and token attacks, cloud and workload identities in zero trust under OMB M-22-09, and a capstone IAM program design.

CISSP-114 12 lessons · 5 h 41 min

Offered by HSM University · CISSP Exam Prep

This is the American version of this course. See the Canadian version.

What you'll learn

Distinguish identification, authentication, authorization and accountability, and apply them to physical and logical access for human and non-human identities
Design identifiers, account types and identity proofing processes, and select identity assurance levels under NIST SP 800-63-4 and Canadian and US digital identity frameworks
Evaluate authentication factors and apply NIST SP 800-63B-4 password rules, including length, blocklists and secure password storage with salted, slow hashing
Select multifactor, passwordless and biometric authenticators by assurance level and phishing resistance, and interpret FAR, FRR and CER
Explain directories, single sign-on and Kerberos, and protect identity infrastructure as Tier 0 against ticket and key attacks
Compare SAML 2.0, OAuth 2.0 and OpenID Connect, and design and validate federated integrations with third-party services
Choose among discretionary, mandatory, role-based, rule-based, attribute-based and risk-based access control for given assets and requirements
Implement policy-based authorization with enforcement and decision points, separation of duties, cloud policy evaluation and privileged access management
Manage the joiner, mover and leaver life cycle with automated provisioning, reconciliation and effective access reviews that satisfy auditors
Recognize credential, phishing, session, recovery and privilege attacks and justify countermeasures, especially phishing-resistant authentication
Govern cloud and non-human identities with managed identities, secrets management and entitlement analysis, and place identity at the center of zero trust
Design and prioritize an IAM program for an organization using risk analysis, and apply effective strategies to Domain 5 exam questions

Course content

12 lessons · 5 h 41 min total · final exam

1 IAM concepts and the AAA model 30 min · quiz
2 Identification and identity proofing 29 min · quiz
3 Authentication factors and passwords 31 min · quiz
4 Multifactor, passwordless and biometric authentication 29 min · quiz
5 Single sign-on, directories and Kerberos 28 min · quiz
6 Federation: SAML, OAuth 2.0 and OpenID Connect 28 min · quiz
7 Authorization and access control models 31 min · quiz
8 Implementing authorization: RBAC, ABAC and privileged access 27 min · quiz
9 The identity and access provisioning life cycle 26 min · quiz
10 Access attacks and countermeasures 28 min · quiz
11 Identity in the cloud and zero trust 28 min · quiz
12 Capstone: designing IAM for an organization 26 min · quiz
E Final exam 20 questions

Requirements

CISSP-101 How the CISSP Works

Recommended background. You can start any course at any time.