Identity, Access, and Security Architecture

Week of 2026-10-27 · Download .docx

Objectives

Describe the three MFA factor categories and explain why factors must come from different categories.
Compare DAC, MAC, RBAC, and ABAC access control models and identify the correct model from a scenario.
Explain the Zero Trust model and contrast it with the traditional perimeter security model.
Apply the principle of least privilege and explain its role in reducing insider threat and breach blast radius.
Name and describe each of the five NIST Cybersecurity Framework functions.

Key terms

MFA: Multi-Factor Authentication — requiring at least two authentication factors from different categories (know, have, are) to verify identity.
DAC: Discretionary Access Control — the resource owner decides who can access it; common in standard file systems.
MAC: Mandatory Access Control — access is based on system-enforced labels (classification levels); used in government and military environments.
RBAC: Role-Based Access Control — permissions are assigned to roles and users are assigned to roles; the most common enterprise access model.
ABAC: Attribute-Based Access Control — access decisions use combinations of user, resource, and environmental attributes; the most granular and flexible model.
Zero Trust: Security architecture that assumes no implicit trust and requires explicit authentication and authorization for every request regardless of network location.
least privilege: The principle that each user, process, or system should have only the minimum access required to perform its authorized function.
SSO: Single Sign-On — a user authenticates once to an identity provider and receives access to multiple connected applications without re-entering credentials.
SAML: Security Assertion Markup Language — an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider.
IDS: Intrusion Detection System — monitors network traffic for attack signatures and generates alerts; does not automatically block traffic.
IPS: Intrusion Prevention System — monitors network traffic for attack signatures and can automatically block or drop malicious traffic in real time.
NIST CSF: NIST Cybersecurity Framework — a voluntary framework organizing cybersecurity activities into five functions: Identify, Protect, Detect, Respond, and Recover.
defense in depth: A security strategy that applies multiple independent, overlapping layers of controls so no single failure exposes the entire system.
microsegmentation: Dividing a network into small, individually controlled zones with strict east-west access policies to limit lateral movement after a breach.

The concept

Module 3 addresses the architecture and controls that govern who can access what, how those identities are verified, and how the overall security posture is structured. These concepts map directly to Security+ Domain 4 (Identity and Access Management) and Domain 3 (Security Architecture).

## Authentication and MFA

Authentication verifies who a user claims to be. The three factor categories are: something you know (passwords, PINs, security questions), something you have (hardware tokens, smart cards, TOTP authenticator apps), and something you are (biometrics — fingerprint, face ID, retina scan). MFA requires at least two factors from different categories. A password plus a PIN is still one factor — both are 'something you know.' A password plus a hardware token is genuine MFA — one from 'know,' one from 'have.' The categories must be distinct because a single attack type (a keylogger) can capture any number of 'know' factors, but cannot capture a physical hardware token.

## Access Control Models

Four access control models appear on Security+ exams. DAC (Discretionary): the owner of a resource decides who can access it — standard for most personal file systems; easy to manage but hard to enforce organizationally. MAC (Mandatory): access is controlled by system-enforced labels — a 'Secret' clearance user cannot read a 'Top Secret' file even if the file owner wants to share it; used in government and military. RBAC (Role-Based): permissions are attached to roles, not individuals; new employees get a role and inherit correct access; departing employees lose access when the role is removed — the most common model in enterprise environments. ABAC (Attribute-Based): access decisions evaluate combinations of attributes including user department, resource sensitivity, time of day, and location — the most flexible model but complex to implement and manage.

## Zero Trust and Least Privilege

Zero Trust is not a product — it is an architecture philosophy. The traditional 'castle and moat' model trusted all traffic inside the perimeter. Zero Trust eliminates this assumption: every request, whether from inside or outside the network, is authenticated, authorized, and continuously validated. Micro-perimeters replace the network perimeter. Microsegmentation creates small zones with independent access policies, preventing an attacker who compromises one zone from moving freely to another. The principle of least privilege is foundational to Zero Trust: every identity — human or machine — receives only the minimum access its function requires. Unused privileges are revoked promptly.

## Security Frameworks and Architecture Controls

The NIST Cybersecurity Framework organizes cybersecurity activities into five functions. Identify: catalog assets, assess risks, understand the threat environment. Protect: implement safeguards — access controls, training, data security. Detect: monitor for anomalies and security events. Respond: contain, eradicate, and document incidents. Recover: restore systems, implement lessons learned, improve resilience. IDS monitors traffic and alerts; IPS monitors and automatically blocks. A WAF specifically filters HTTP/HTTPS traffic to protect web applications. Defense in depth layers all of these controls so no single failure is catastrophic.

Worked examples

Example 1: Selecting the correct access control model from a scenario: A hospital needs to ensure that nurses can view patient records for patients currently assigned to their ward but cannot view records for patients in other wards, and that attending physicians can view all records for their specialty but not billing information. Identify the access control model. RBAC partially fits — roles (Nurse, Physician) are clearly defined. However, the ward-level restriction for nurses and specialty-level restriction for physicians involve dynamic attributes (ward assignment, specialty, record type) that RBAC alone cannot express without creating an impractical number of roles. The correct model is ABAC: the access decision evaluates the user's role, ward or specialty assignment, and the record's attributes simultaneously. A pure RBAC implementation would require creating a separate role for each combination (e.g., NurseWard3, NurseWard4), which is unmanageable at scale.

Example 2: Mapping an incident to the NIST CSF: A company discovers that an attacker accessed its HR database using stolen credentials. Walk through the NIST CSF response. Identify: the security team determines that the HR database contains PII for 4,200 employees and that it was accessible with single-factor credentials — a risk that should have been identified in the risk assessment. Protect: MFA is added to all HR system logins; the HR database is moved behind a more restrictive network segment; employee access is reviewed against least privilege. Detect: SIEM alerts are tuned to flag unusual query volumes from the HR database. Respond: the stolen credentials are revoked; affected employees are notified per breach notification law; forensics determines what data was accessed. Recover: the company implements a lessons-learned review; the incident is documented; the security policy is updated to mandate MFA for all systems handling PII.

Common mistakes

Confusing MFA with two-step verification that uses two passwords. Two passwords are both 'something you know' — a keylogger captures both simultaneously. Genuine MFA requires factors from different categories: only the combination of 'know' with 'have' or 'are' provides meaningful layered protection.
Selecting RBAC when a scenario describes dynamic, attribute-based access decisions. If access depends on a combination of factors — role, time, location, resource sensitivity — that cannot be captured in a manageable set of static roles, the model is ABAC. If simple role assignment suffices, it is RBAC. The distinguishing signal is whether attributes beyond the role are evaluated at access time.
Thinking Zero Trust means no one is ever trusted. Zero Trust requires verified trust — every request is authenticated and authorized. The 'never trust' part means there is no implicit trust based on network location. Users who authenticate correctly and are authorized for a resource are granted access; Zero Trust does not mean perpetual access denial.
Confusing IDS and IPS capabilities. An IDS is passive — it detects and alerts. An IPS is active — it detects and blocks. On exam questions, if the scenario requires automatic blocking without human intervention, the answer is IPS. If the scenario describes alerting a security analyst, the answer is IDS. 'Passive' = IDS; 'active' = IPS.
Listing only the NIST CSF as five functions from memory but in the wrong order. The correct order is Identify, Protect, Detect, Respond, Recover — it follows the logical lifecycle: first know what you have (Identify), then guard it (Protect), then watch for attacks (Detect), then handle them (Respond), then bounce back (Recover). The order reflects operational sequence and is tested directly.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. A user authenticates with a password and a PIN. Does this satisfy MFA requirements?

Yes, because two credentials are provided
No, because both are 'something you know' factors from the same category
Yes, if the PIN is at least 6 digits
No, because MFA requires three factors

2. A government database system uses classification labels (Unclassified, Secret, Top Secret) to control access, and users cannot override these controls even for files they own. This is:

RBAC
DAC
MAC
ABAC

3. Zero Trust's 'never trust, always verify' principle means:

Users are never granted access regardless of credentials
No user inside the network is trusted without continuous authentication and authorization
Encryption alone is sufficient for security
Physical access to the data center eliminates all network trust requirements

4. Which NIST CSF function covers restoring systems and services after an incident?

Identify
Protect
Respond
Recover

5. Microsegmentation limits breach impact by:

Encrypting all internal traffic between servers
Dividing the network into small zones with independent access policies that prevent lateral movement
Requiring MFA for every application login
Scanning endpoints for malware at regular intervals

Self-check answers

1. B — MFA requires factors from different categories. A password and a PIN are both 'something you know.' A single attack type — such as a keylogger — can capture both simultaneously. True MFA requires combining 'know' with 'have' or 'are.'
2. C — MAC (Mandatory Access Control) applies system-enforced labels that cannot be overridden by resource owners. The system enforces the policy; individual users have no discretion. This model is standard in government and military environments.
3. B — Zero Trust eliminates implicit trust based on network location. Internal users must still authenticate and be authorized for each resource — trust is earned per-request, not assumed because traffic originates inside the perimeter.
4. D — The Recover function covers activities to restore capabilities and services after a cybersecurity incident, including restoring backups, implementing lessons learned, and improving resilience. Respond covers containment and eradication; Recover covers restoration.
5. B — Microsegmentation creates granular network zones with strict east-west access controls. An attacker who compromises one workload cannot freely access adjacent workloads — each zone must be explicitly authorized. This directly limits lateral movement and breach blast radius.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top