RMFInsider

CISSP Domain 5, Identity and Access Management, is about 13% of the exam and covers the full lifecycle of identities and access: identification, authentication, authorization, accountability, the access control models, federation and single sign-on, and the provisioning and deprovisioning process. For DoD professionals it is the most familiar domain on the list. You authenticate with a CAC every morning, you process DD Form 2875s, you run account reviews for AC-2, and you have almost certainly argued with someone about whether a service account needs a separate privileged credential. The exam calls those things by their formal names and asks you to reason about them.

Previous spokes: Domain 3 and Domain 4. The all-domains overview is the index.

The four steps, and the vocabulary trap

• Identification: claiming an identity. Username, EDIPI, badge number.
• Authentication: proving it. Password, PIN plus CAC certificate, biometric.
• Authorization: what the proven identity is allowed to do. Group membership, ACLs, roles.
• Accountability: logging who did what. AU family, non-repudiation through signatures.

The exam tests whether you can keep these separate under pressure. A question describing a password reset is authentication, not authorization. A question about a user reading a file they should not have is authorization, not authentication. Practitioners blur these in conversation; the exam does not.

Authentication factors and the CAC

Something you know (password, PIN), something you have (token, smart card, phone), something you are (biometric). Somewhere you are and something you do appear as additional attributes. Multi-factor means two different categories, not two of the same category; two passwords is single-factor with extra steps.

The CAC is a textbook two-factor implementation: the card holds private keys (something you have) unlocked by a PIN (something you know). The certificates on it come from the DoD PKI, which makes the CAC also the best real-world anchor for the PKI material in Domain 3. When the exam describes certificate-based authentication with a hardware token and asks what class of credential that is, picture the card in your pocket. When a CAC is not an option, hardware security keys and IA-2 covers the FIDO2 alternative and its exam-relevant properties.

Biometrics: the error rates

False rejection rate (Type I error, a legitimate user denied), false acceptance rate (Type II, an impostor accepted), and the crossover error rate where the two are equal, which is how biometric systems are compared. The exam likes to ask which error is worse for a high-security facility. False acceptance. Every time.

Access control models

• Discretionary (DAC): the owner of the resource decides who gets access. NTFS permissions on a file share. Flexible, and the reason your share drive permissions are a mess.
• Mandatory (MAC): the system enforces access based on labels and clearances, and the owner cannot override it. Classified systems. Bell-LaPadula lives here.
• Role-based (RBAC): access follows the role, users are assigned to roles. Active Directory groups done properly. The answer to any question about scaling access management for a large organization.
• Attribute-based (ABAC): policies evaluate attributes of the user, resource, and environment (clearance, data classification, time of day, device posture). This is the model behind zero trust, and it is showing up more on the exam and in DoD architecture documents at the same time.
• Rule-based: access decided by explicit rules, like a firewall ACL. Often confused with RBAC in questions; the abbreviation is the trap.

The identity lifecycle: provisioning to deprovisioning

This is the DD 2875 process with exam labels. Provisioning creates the account with the right access after approval. Periodic review (access recertification) confirms the access is still appropriate. Modification handles role changes, where privilege creep lives: the analyst who moved teams three times and still has access from all three. Deprovisioning removes access when someone leaves, and the exam will test that it should be immediate for terminations and that shared or service accounts need special handling because there is nobody to “leave.”

Your quarterly AC-2 account review is access recertification. Your stale-account disable task is automated deprovisioning. If you can describe those in a control implementation statement, you can answer the exam’s lifecycle questions.

Federation, SSO, and the protocols

• SAML: XML-based federation. Identity provider asserts identity to a service provider. Enterprise SSO, and what most DoD web SSO is built on.
• OAuth 2.0: authorization delegation (letting an app act on your behalf), not authentication by itself.
• OpenID Connect: an authentication layer on top of OAuth 2.0. When a question says “authenticate with OAuth,” the technically correct answer usually involves OIDC.
• Kerberos: ticket-based authentication with a Key Distribution Center; the default in Active Directory. Know that it relies on time synchronization and that the KDC is a single point of failure to protect.
• RADIUS and TACACS+: AAA for network access. TACACS+ encrypts the whole payload and separates authentication from authorization; RADIUS encrypts only the password. That difference is a recurring question.
• LDAP: the directory protocol underneath, and LDAPS is the version you are allowed to use.

Attacks on identity

Credential stuffing, password spraying, phishing and MFA fatigue (push bombing), pass-the-hash and pass-the-ticket in Kerberos environments, Kerberoasting of service accounts, session hijacking, and privilege escalation. The mitigations the exam wants are the ones in your STIGs: MFA everywhere, least privilege, separate admin accounts, credential guard and LSA protection, short session lifetimes, and monitoring for anomalous authentication.

Where DoD habits help and where they hurt

Help: you have implemented MAC-style labeling, RBAC through AD groups, PKI-based MFA, and a documented provisioning process. Other candidates have read about these. You have been yelled at about them.

Hurt: the exam wants the general principle, not the DoD implementation. If a question asks how to reduce administrative overhead for access in a 10,000-user organization, the answer is RBAC, not “submit a 2875.” And the exam’s ideal answer often involves accepting some risk in exchange for business function, which is the opposite reflex from a career spent saying no. Thinking like a manager is the corrective.

How to study Domain 5

One session on the models and the identification-through-accountability sequence. One session on the protocols, making a table of what each one does and what it does not. Then map your own account lifecycle to the exam’s lifecycle vocabulary. After that, questions. This domain has the highest ratio of “I already knew that, I just did not know the name” of any domain for DoD candidates, which makes it a fast, satisfying study week. Practice questions with explanations are in the CISSP Command Center, and the study hours post will tell you how much time to give it.

Next: Domain 6, Security Assessment and Testing, which for an ISSO is basically a chapter about your own job.