Study Hub / ISC2 CISSP (CISSP) / Domain 5.0
CISSP Domain 5.0: Identity and Access Management — Explained
Domain 5.0 is the gatekeeper domain: proving who someone is (identification & authentication), deciding what they may do (authorization), and proving what they did (accountability). Plus the access-control models, compared side by side.
I&A: identification, authentication, accountability
- Identification — claiming an identity (username). Authentication — proving it (password, token, biometric). Identification without authentication is a name tag.
- Authentication factors — something you know (password, PIN), something you have (token, smart card, phone), something you are (biometrics). Two factors from different categories = MFA; two passwords isn't MFA.
- Biometrics — FAR (false accept: impostor admitted — the security failure) vs. FRR (false reject: legitimate user denied — the usability failure). Tuning trades one against the other; crossover error rate (CER) compares systems.
- Accountability — audit trails tying actions to identities: without it, authentication is theater. Clipping levels, reviewed logs, and non-repudiation make actions attributable.
- Single sign-on — authenticate once, access many (Kerberos, SAML, OAuth/OIDC): better UX and security (one strong auth instead of password reuse everywhere) — but the SSO credential becomes the master key, so protect it accordingly.
Access control models
- Discretionary (DAC) — owners decide (file permissions you set yourself). Flexible, and prone to over-sharing — the owner's judgment is the policy.
- Mandatory (MAC) — the system decides via labels (clearances/classifications): users can't override even on "their" files. Bell-LaPadula territory — government rigidity.
- Role-based (RBAC) — permissions attach to roles, users get roles. "Accountants can read the ledger" — scales beautifully, the enterprise standard.
- Rule-based — global rules apply to all (firewall-style: "no logins after hours"). Attribute-based (ABAC) — decisions from attributes (user dept + resource classification + time + location): the most flexible, finest-grained.
- Least privilege & separation of duties — minimum access to do the job; critical actions split across people (the person who writes checks can't sign them). Design principles, not products.
Provisioning and attacks on identity
- Lifecycle — provisioning (create with least privilege), review/recertification (does she still need it?), deprovisioning (immediate on departure — orphaned accounts are attacker starter kits).
- Password attacks — dictionary (likely words), brute force (everything), rainbow tables (precomputed hashes — defeated by salting), credential stuffing (breach reuse), pass-the-hash (stolen hash reused directly).
- Session attacks — hijacking (steal the session token), fixation (plant a known session ID). Defenses: secure/HttpOnly cookies, TLS everywhere, session timeouts and rotation.
- Kerberos — tickets, not passwords, cross the network: AS/TGS issue ticket-granting and service tickets; mutual authentication; time-sensitive (clock skew breaks it). The SSO workhorse of Windows domains.
The must-memorize table: access control models
Who decides access in each model.
| Model | Decider | Example |
|---|---|---|
| DAC (Discretionary) | Data owner | File share permissions you set |
| MAC (Mandatory) | System (labels/clearance) | Classified government systems |
| RBAC (Role-based) | Role assignment | "Accountants read the ledger" |
| ABAC (Attribute-based) | Attributes evaluated at request | Dept + clearance + time + location |
| Rule-based | Global rules | Firewall rules, time restrictions |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A system requires users to authenticate with a password plus a hardware token. Why is this stronger than two passwords?
- A. A. It isn't — any two factors are equal
- B. B. It uses two different factor categories (know + have) — compromising one doesn't compromise the other
- C. C. Hardware tokens are unhackable
- D. D. Passwords expire faster
Show answer & reasoning
B. MFA's strength is factor diversity: a phished password doesn't yield the token, and a stolen token doesn't reveal the password. Two passwords are one factor twice — one keylogger defeats both. Different categories, independent compromise paths.
2. A file server lets each document owner set who may read their files. An auditor flags inconsistent, over-permissive sharing. Which model is in use, and what's the structural issue?
- A. A. MAC — too rigid
- B. B. DAC — owners decide, so policy is only as disciplined as the least careful owner
- C. C. RBAC — roles are misconfigured
- D. D. ABAC — attributes are wrong
Show answer & reasoning
B. Owner-controlled sharing is discretionary (DAC): flexible by design, inconsistent by nature. The auditor's finding isn't a misconfiguration — it's the model's inherent weakness. Fixing it structurally means moving toward RBAC/MAC, not training every owner to be a security expert.
3. A biometric system is tuned so almost no legitimate users are ever rejected, but the auditor worries about impostors. Which metric captures the auditor's concern?
- A. A. FRR (False Rejection Rate)
- B. B. FAR (False Acceptance Rate) — impostors admitted; the security-side error
- C. C. CER (Crossover Error Rate)
- D. D. Throughput
Show answer & reasoning
B. FAR = the system wrongly accepts an impostor — the security failure. Tuning for convenience (low FRR) raises FAR; the auditor cares about the security side of the trade. CER (C) is for comparing systems (lower = more accurate), not for naming the concern.
4. An employee is terminated Friday at 5 PM. Their VPN account is still active Monday morning. What failed, and why does it matter?
- A. A. Nothing — accounts expire automatically
- B. B. Deprovisioning — orphaned accounts are prime attacker targets: valid credentials with no owner watching
- C. C. Authentication — the password was too weak
- D. D. Authorization — least privilege wasn't applied
Show answer & reasoning
B. The identity lifecycle requires prompt deprovisioning on departure. An orphaned account is a valid credential nobody monitors — attackers specifically hunt these. The fix is procedural: HR-triggered, same-day (or automated) deprovisioning with recertification audits catching stragglers.
This was one domain. The simulator drills all 8.
This free preview covered Identity & Access Management (Domain 5.0, 13%). Not covered here: Communication & Network Security (Domain 4.0, 13%); Security Assessment & Testing (Domain 6.0, 12%); Security Operations (Domain 7.0, 13%). The three most operational domains — network security, assessment, and security operations — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CISSP Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy