1. Chapter 13: Managing Identity and Authentication

2. Controlling Access to Assets Comparing subjects and objects Types of access control – Preventative– Detective – Corrective– Deterrent – Recovery– Directive – Compensation – Administrative, logical/technical, physical The CIA Triad

3. Comparing Identification and Authentication 1/3 Registration and proofing of identity Authorization and accountability Authentication factors – Type 1: Something you know – Type 2: Something you have – Type 3: Something you are

4. Comparing Identification and Authentication 2/3 Passwords – Strong passwords Age, complexity, length, history – Passphrases – Cognitive – One-time passwords Smartcards – Common Access Card (CAC) – Personal Identity Verification (PIV) card

5. Comparing Identification and Authentication 3/3 Tokens – Synchronous dynamic password tokens – Asynchronous dynamic password tokens Biometrics – Fingerprints, face, retina, iris, palm, hand geometry, heart/pulse, voice, signature, keystroke – Errors: Type 1: FRR and Type 2: FAR CER Multifactor authentication Device authentication

6. Implementing Identity Management 1/2 Centralized vs. decentralized Single sign-on – LDAP – PKI – Kerberos KDC, TGT, ST – Federation SAML, SPML, XACML – Scripted access, SESAME, KryptoKnight

7. Implementing Identity Management 2/2 Credential management systems Integrating identity services – IDaaS Managing sessions AAA protocols – RADIUS – TACACS+ – Diameter

8. Managing the Identity and Access Provisioning Life Cycle Provisioning Account review Account revocation