L12. Identity & Access Management: RBAC, PAM & Directories
Course outlineLesson 12 of 20
Identity is the new perimeter. IAM controls determine who can access what resources and under which conditions. This lesson covers access control models, privileged account management, and directory services.
Access Control Models
| Model | How Access Is Assigned | Use Case |
|---|---|---|
| DAC (Discretionary) | Resource owner grants access | Standard file system permissions |
| MAC (Mandatory) | System enforces labels/clearances; owner cannot override | Government/military (Top Secret, Secret, etc.) |
| RBAC (Role-Based) | Permissions assigned to roles; users assigned to roles | Most enterprise environments |
| ABAC (Attribute-Based) | Dynamic policies based on user, resource, and environment attributes | Cloud IAM (AWS IAM, Azure RBAC conditions) |
| Rule-Based | Fixed rules applied to all users (e.g., time-of-day restrictions) | Firewall ACLs |
Privileged Access Management (PAM)
Privileged accounts (domain admin, root, service accounts) are the highest-value targets for attackers. PAM controls and monitors them:
- Password vaulting: stores privileged credentials in a secure vault; generates and rotates them automatically
- Just-in-time (JIT) access: grants elevated privileges only when needed, for a limited duration
- Session recording: records privileged sessions for audit and forensic analysis
- Least privilege: each account should have only the access required for its specific function
Directory Services
LDAP (Lightweight Directory Access Protocol): the protocol for querying and modifying directory services. Runs on port 389 (LDAP) or 636 (LDAPS). Active Directory (AD): Microsoft's implementation of directory services using LDAP + Kerberos + DNS. Provides authentication, authorization, and policy enforcement via Group Policy. RADIUS: used for network access control (AAA for VPN, Wi-Fi, switches). Authenticates users before granting network access. Kerberos: authentication protocol used by Active Directory. Uses tickets (TGT, service tickets) issued by the KDC (Key Distribution Center) to avoid sending passwords over the network.- ✓MAC enforces access based on classification labels; the data owner cannot override system-enforced labels
- ✓RBAC assigns permissions to roles, not individuals; users are assigned to roles (most common enterprise model)
- ✓PAM protects privileged accounts through vaulting, JIT access, session recording, and least privilege enforcement
- ✓LDAP is the protocol (port 389/636); Active Directory is Microsoft's directory service implementation using LDAP + Kerberos
- ✓Kerberos uses tickets (TGT from KDC) to authenticate users without sending passwords across the network
1. A government organization classifies data as Top Secret and ensures that even the document owner cannot grant access to users without the appropriate clearance. Which access control model is this?
2. A PAM solution grants a sysadmin root-level access to a server for exactly 2 hours to complete a maintenance task, then automatically revokes the access. What PAM feature is this?
3. Which authentication protocol does Active Directory use to issue tickets that allow users to access network services without re-entering their password?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.