Domain 4 of 4 · Chapter 3 of 4

Architect identity authorization

Unlock the complete study guide + 1,500 practice questions across 12 full exams.

Bundled into the existing Information Systems Security Architecture Professional premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Five decisions behind an authorization design
  • Least privilege as capability, scope, and duration
  • Separation of duties, static and dynamic
  • Who may decide: discretionary and mandatory
  • Default deny and the unevaluable request
  • Authorization for non-interactive identities
  • Selecting role, attribute, or rule-based control
  • Tokens and certificates as carriers of authority
  • The four policy functions of an ABAC design
  • Single sign-on and the limit of a shared session
  • Physical, logical, and administrative planes
  • Issuance and the accountable approver
  • Entitlement review by risk and by event
  • Groups, nesting, and effective privilege
  • Suspension, revocation, and propagation
  • Persistent content policy with DRM
  • Separate identities for privileged work
  • Just-in-time elevation over standing privilege
  • Credential brokering and rotation with PAM
  • Privileged session records that name a person
  • Emergency access that survives its dependencies
  • Reading the stem: which decision is under test

Which authorization approach fits the decision being made

Design questionRole-based (RBAC)Attribute-based (ABAC)Rule-basedCapability tokenCertificate-based
What drives the decision?Membership in an assigned organizational roleAttributes of subject, object, action, and environmentSystem-defined conditions such as time, zone, or valueA scoped grant the caller presentsA validated certified identity or its attributes
Fits best whenJob functions are stable and auditableDecisions must be fine-grained and contextualOne condition applies across many subjectsAuthority is delegated across a boundaryParties authenticate with keys rather than shared secrets
How separation of duties is expressedMutually exclusive roles, statically or at access timePolicy rules that exclude conflicting attribute combinationsConditions that block a conflicting actionSeparate narrowly scoped tokens per operationDistinct certificates or attributes per function
Main design dependencyA role catalog narrow enough to stay least-privilegedAttribute authority, provenance, and freshnessConsistent condition semantics across enforcement pointsScope, audience, and lifetime limits on issuanceLocal mapping from certified identity to permitted actions
Primary failure modeRole explosion or overbroad roles granted wholesaleStale or unreachable attributes producing wrong decisionsA temporary condition frozen into permanent structureA long-lived bearer token reused after theftTrusting every holder of a trusted authority's certificate
Governed by which planeLogical, with administrative approval of role assignmentLogical, with administrative ownership of attribute sourcesLogical, sometimes correlated with physical zonesLogical, at the enforcement point that accepts itLogical, with administrative control of the trust anchor

Decision tree

Is authority carried across a service boundary? Does the presenter hold a delegated grant? Does context beyond job function drive the decision? Yes No Capability token Scope, audience, expiry Certificate-based Map identity locally Role-based (RBAC) Stable job functions Does the condition hold system-wide? Yes No No Yes Rule-based System-wide condition Attribute-based (ABAC) Needs attribute authority Yes No Always: default deny, least privilege, separation of duties Combining is normal: role permissions constrained by contextual rules
Cheat sheet

Cheat sheet

  • Least privilege limits capability, scope, and duration
  • Separation of duties prevents one principal from completing a critical process alone
  • Discretionary and mandatory controls differ in who governs access
  • Non-interactive access requires explicit workload authorization
  • Authorization should deny requests not affirmatively allowed
  • RBAC maps stable job functions to permissions
  • ABAC evaluates subject, object, action, and environmental attributes
  • Rule-based control evaluates global conditions rather than job membership
  • Capability tokens should be constrained by scope, audience, and lifetime
  • Authorization architecture must align physical, logical, and administrative controls
  • Single sign-on centralizes authentication without granting universal access
  • Certificate authentication must be mapped to local authorization
  • Authorization controls serve distinct physical, logical, and administrative planes
  • ABAC separates policy administration, information, decision, and enforcement
  • Access issuance requires approval from an accountable authority
  • Entitlement reviews should be risk-based and event-triggered
  • Suspension preserves a reversible state while revocation withdraws authorization
  • Security-group membership is an entitlement requiring governance
  • Digital rights management extends policy to protected content usage
  • Administrators should use separate privileged and routine identities
  • Just-in-time elevation reduces standing administrative privilege
  • PAM should broker privileged credentials and rotate reusable secrets
  • Privileged-session monitoring must preserve actor and approval context
  • Emergency access must be usable, exceptional, and independently reviewed

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations Whitepaper
  2. NIST SP 800-207: Zero Trust Architecture Whitepaper
  3. AWS IAM User Guide: Security best practices in IAM
  4. CWE-269: Improper Privilege Management
  5. NIST SP 800-192: Verification and Test Methods for Access Control Policies/Models Whitepaper
  6. NIST IR 7316: Assessment of Access Control Systems Whitepaper
  7. OWASP Authorization Cheat Sheet
  8. CWE-862: Missing Authorization
  9. CWE-863: Incorrect Authorization
  10. OWASP Secrets Management Cheat Sheet
  11. NIST Role Based Access Control project: the RBAC reference model
  12. Azure RBAC documentation: What is Azure role-based access control?
  13. NIST SP 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations Whitepaper
  14. AWS IAM User Guide: What is ABAC for AWS?
  15. Google Cloud IAM documentation: IAM Conditions overview
  16. OWASP Session Management Cheat Sheet
  17. CWE-522: Insufficiently Protected Credentials
  18. Google Cloud IAM documentation: IAM overview
  19. Microsoft Entra: Manage emergency access accounts
  20. ISC2 ISSAP certification: exam outline and content areas