IAM concepts and the AAA model

Every security control eventually asks the same question: who is this, and what are they allowed to do? Identity and access management, IAM, is the discipline that answers it consistently, for people, devices, services and software, across every system an organization runs. When IAM works, the right subjects reach the right objects for the right reasons, and the organization can prove it afterwards. When it fails, the failures are expensive: an orphaned account used months after an employee left, a contractor with administrator rights nobody remembers granting, a stolen password that opens a hundred applications because single sign-on was built without strong authentication. Breach reports year after year find stolen or misused credentials among the most common ways attackers get in, which is why identity is now often called the new perimeter.

Domain 5 of the CISSP, Identity and Access Management, carries about 13 % of the exam weight under the outline ISC2 has used since 15 April 2024 (checked October 2026; ISC2's outline page announced no replacement, but ISC2 reviews outlines through a job task analysis roughly every three years, so confirm the current outline before you book). It has six sub-domains: 5.1, control physical and logical access to assets; 5.2, design identification and authentication strategy; 5.3, federated identity with a third-party service; 5.4, implement and manage authorization mechanisms; 5.5, manage the identity and access provisioning life cycle; and 5.6, implement authentication systems. This course is independent study material. It is not produced, endorsed or reviewed by ISC2, and none of its questions are taken from any real exam. Every scenario is original and written to train the judgment the exam rewards.

Subjects, objects and access

Access control is described in terms of subjects and objects. A subject is an active entity that requests access: a user, a process running on a user's behalf, a service account, a device or an automated workload. An object is a passive entity that holds information or provides a function: a file, a database table, a printer, an API endpoint, a building or a room. Access is the flow of information or the use of a function between them, and an access control is any mechanism that permits, denies or limits that flow. The roles can change: a program is an object while it sits on disk and a subject when it runs and opens files.

Rights and permissions are the specific operations a subject may perform on an object, such as read, write, execute, delete, approve or change ownership. Privileges are rights that affect the system itself, such as installing software, creating accounts or changing audit settings. Much of IAM consists of deciding which rights each subject needs, granting no more than that, and taking them away as soon as they are no longer needed.

Sub-domain 5.1 reminds you that access control covers physical as well as logical assets. Badge readers, mantraps, visitor management and key control are access controls in exactly the same sense as passwords and permissions. A well-designed program uses the same identity for both: the employee record that drives the directory account also drives the badge, so that one leaver process revokes both. Physical site and facility design is covered in CISSP-112; here we treat physical access as one more object that the identity system must govern.

The access control triple and AAA

Granting access involves a sequence of distinct steps, and the exam expects you to keep them apart. Identification is the claim: a subject asserts an identity, by typing a user name, presenting a badge, or sending a certificate or a client identifier. Authentication is the proof: the subject demonstrates that the claim is true with something it knows, has or is. Authorization is the decision: given an authenticated identity, the system determines what that identity may do with a specific object. Accountability is the record: actions are logged and tied to the identity so that the subject can be held responsible. Many texts call the first three the access control triple and add auditing or accounting to make four. Networking texts use AAA for authentication, authorization and accounting.

Keeping the steps separate prevents common design errors. A system that authenticates strongly but authorizes loosely, giving every authenticated user access to everything, has not controlled access at all. A system that identifies users with shared accounts can authenticate them but can never hold any individual accountable, because the log shows only the shared name. And a system that logs everything but never reviews the logs has accounting on paper only. Accountability requires unique identification, reliable authentication and protected, reviewed audit trails; remove any of the three and nobody can be held responsible.

Non-repudiation is related to accountability but stronger. It means a subject cannot credibly deny having performed an action, which normally requires that only that subject could have produced the evidence, such as a digital signature made with a private key the subject alone controls. Logs alone rarely provide non-repudiation, because administrators can alter them and passwords can be shared, but signed transactions, hardware-backed keys and tamper-evident log storage move a system closer. Digital signatures are covered in CISSP-112.

Why IAM is central to security

Three trends have moved identity to the center of security architecture. First, users, data and applications have left the corporate network: staff work from home, applications run as cloud services and partners connect directly. The network boundary no longer separates trusted from untrusted, so access decisions must rest on who and what is asking. Second, attackers have shifted from exploiting software to using valid credentials, because phishing and password reuse make that easier and because activity under a valid account blends into normal traffic. Third, the number of non-human identities, such as service accounts, API keys, cloud workload roles and bots, now exceeds the number of human ones in most organizations, and these identities often hold powerful, long-lived privileges with little oversight.

Zero trust, introduced for networks in CISSP-113, makes identity explicit. Under NIST SP 800-207, every request is authenticated and authorized on its own merits using the identity of the subject, the health of the device and the context of the request, and no request is trusted merely because of where it came from. Lesson 11 returns to identity in zero trust architectures.

Logical and physical access in one program

A mature IAM program has a few core components. An authoritative source of identity, usually the human resources system for employees and a vendor management system for contractors, says who should exist. A directory or identity store, such as Active Directory, an LDAP directory or a cloud identity provider, holds accounts, groups and attributes. An identity governance and administration, IGA, system automates provisioning, approvals and access reviews. Authentication services verify credentials and issue sessions or tokens. Authorization is enforced by applications, operating systems, databases and gateways. Privileged access management, PAM, controls administrator accounts. Logging and analytics, often a SIEM, collect evidence.

events = [
    ('08:40:02', 'priya.s', 'authn', 'passkey', 'success'),
    ('08:40:05', 'priya.s', 'authz', 'payroll-report:read', 'permit'),
    ('08:41:17', 'priya.s', 'authz', 'payroll-run:approve', 'deny'),
    ('08:52:40', 'svc-backup', 'authn', 'password', 'failure'),
    ('08:52:41', 'svc-backup', 'authn', 'password', 'failure'),
    ('08:52:43', 'svc-backup', 'authn', 'password', 'success'),
]
from collections import Counter
failures = Counter(e[1] for e in events if e[2] == 'authn' and e[4] == 'failure')
denials = [e for e in events if e[2] == 'authz' and e[4] == 'deny']
print('Failed authentications by account:', dict(failures))
for t, who, _, obj, _ in denials:
    print(f'Denied at {t}: {who} tried {obj}')
print('Service accounts using passwords:', sorted({e[1] for e in events if e[1].startswith('svc') and e[3] == 'password'}))

Failed authentications by account: {'svc-backup': 2}
Denied at 08:41:17: priya.s tried payroll-run:approve
Service accounts using passwords: ['svc-backup']

Centralized and decentralized administration

Access administration can be centralized, with one team and one system managing identities and rights for everyone, or decentralized, with each application owner or business unit managing its own users. Centralized administration gives consistency, easier audits and fast revocation, at the cost of a bottleneck and a single point of failure that must be designed for resilience. Decentralized administration is responsive to local needs but tends to produce inconsistent rules, duplicate accounts and leavers who keep access in systems nobody remembered. Most organizations use a hybrid: a central identity provider and governance process, with application owners responsible for approving access to their own data. The exam usually favors central control of identity and authentication with delegated, documented ownership of authorization decisions.

Remote access authentication protocols illustrate centralized AAA. RADIUS, defined in RFC 2865, authenticates users for network access and VPNs; it runs over UDP, encrypts only the password attribute and combines authentication and authorization in one response. TACACS+, used mainly for administering network devices, runs over TCP, encrypts the whole payload and separates authentication, authorization and accounting so that each command an administrator types can be authorized and logged. Diameter, RADIUS's successor, is used mainly in mobile networks. Network access control with 802.1X, which uses RADIUS behind the scenes, is covered in CISSP-113.

Design principles that run through IAM

Several security principles from Domain 3 shape every IAM decision. Least privilege grants each subject only the access needed for its task, for only as long as needed. Need to know restricts access to information to those whose duties require it, even among people with the same clearance. Separation of duties splits sensitive tasks so that no single person can complete them alone, such as requesting and approving a payment. Defense in depth layers authentication, authorization and monitoring so that one failure does not give full access. Fail secure means that if an access control component fails, it denies rather than permits. Economy of mechanism keeps the access model simple enough to understand and audit, which is why a handful of well-defined roles beats thousands of individual grants.

A manager also weighs usability. Controls that frustrate users get bypassed: passwords written on notes, shared accounts created to avoid waiting for approval, and multifactor prompts approved without thought. Good IAM design reduces the number of times users must authenticate, through single sign-on, while making each authentication stronger, and automates access so that people receive what they need on their first day without informal workarounds.

Thinking like a manager

CISSP questions on IAM rarely ask you to configure a protocol. They ask what a security manager should do first, what best reduces risk, or which control addresses the root cause. Start from the access control steps: is the problem that we do not know who someone is, that we cannot prove it, that they have too much access, or that we cannot tell what they did? Prefer answers that fix the process, such as automated deprovisioning tied to HR, over answers that fix one instance, such as disabling one account. Prefer unique identities, strong authentication, least privilege and reviewed logs, in that order of foundation. And remember that people, not just systems, are subjects: policy, training and accountability matter as much as technology.