Unit 2: Implement Identity and Access Management, Secure Enterprise Network Architecture

I. Orientation: The Access Control Model

Identity and Access Management (IAM) rests on the AAA framework (Authentication, Authorization, Accounting), which answers three sequential questions — who are you, what may you do, and what did you do. Network architecture then enforces these decisions at the perimeter and interior through layered controls (defense in depth).

• Identity: the claimed representation of a subject — a user, device, or service — expressed as a username, certificate, or principal ID.
• Credential: the secret or token that proves the identity (password, private key, OTP).
• Subject vs. object: the subject requests access; the object (file, host, API) is the protected resource.
• Least privilege: every subject receives only the permissions its task requires — the default assumption behind every later section.
• Zero trust: no implicit trust by network location; every request is authenticated and authorized ("never trust, always verify").
• CIA triad: Confidentiality, Integrity, Availability — the properties all mechanisms below defend.

II. Authentication — Proving Identity

Authentication verifies that a subject is who it claims to be before any access is granted.

A. Authentication Factors and Methods

• Something you know: passwords, PINs — cheapest, weakest; vulnerable to guessing and reuse.
• Something you have: smart card, TOTP token, hardware key (FIDO2/YubiKey).
• Something you are: biometrics — fingerprint, iris, face.
• Multi-factor authentication (MFA): combines two or more distinct factors; a password plus a TOTP code resists stolen-credential attacks.
• TOTP generation: code = HMAC-SHA1(secret, floor(unix_time / 30)) truncated to 6 digits — the 30-second window syncs client and server without network traffic.

B. Password Protection

• Never store plaintext: store a salted hash.
• Salting: append a unique random value per user before hashing to defeat rainbow tables.
• Key stretching: use slow algorithms (bcrypt, scrypt, Argon2) to raise brute-force cost.

stored = Argon2(password + salt, memory=64MB, iterations=3)

C. Authentication Protocols

1. Kerberos: ticket-based, used in Active Directory. The Key Distribution Center issues a Ticket Granting Ticket (TGT); the client then obtains per-service tickets, avoiding repeated password transmission.
2. Challenge-response (CHAP): the server sends a nonce; the client returns a hash of nonce + secret, so the secret never travels the wire.

• EAP: extensible framework carrying methods like EAP-TLS over 802.1X for port-based network access.

III. Authorization — Granting Permissions

Authorization decides what an authenticated subject is permitted to do with an object.

A. Access Control Models

1. Discretionary (DAC): the object owner sets permissions (e.g., UNIX rwx bits). Flexible but prone to privilege sprawl.
2. Mandatory (MAC): a central policy and security labels (Secret, Top Secret) govern access; subjects cannot override — used in SELinux and military systems.

• Role-Based (RBAC): permissions attach to roles, roles to users — e.g., a billing-clerk role grants invoice access regardless of individual.
• Attribute-Based (ABAC): policy evaluates attributes (department, time, device posture) — "allow if user.dept == 'HR' AND time ∈ business_hours".

B. Authorization Principles

• Least privilege: grant the minimum rights needed.
• Separation of duties: split sensitive tasks so no single user completes a fraud end-to-end (one requests payment, another approves).
• Implicit deny: anything not explicitly allowed is refused — the safe default in firewall and ACL rule sets.

C. Accounting (Auditing)

• Logging: record authentication events, access grants, and admin actions with timestamps and source.
• Non-repudiation: signed logs ensure a subject cannot deny an action.

IV. Identity Management — Lifecycle and Federation

Identity management administers digital identities across their full lifecycle and shares them between trust domains.

A. Identity Lifecycle

• Provisioning: create accounts and assign initial roles on hire.
• Review (recertification): periodically re-validate that privileges still match job needs.
• Deprovisioning: disable accounts immediately on termination to close the orphaned-account risk.

B. Directory Services

• LDAP: hierarchical directory protocol; entries identified by Distinguished Names such as cn=jsmith,ou=staff,dc=corp,dc=com.
• Active Directory: Microsoft's LDAP + Kerberos implementation grouping users, computers, and policies into domains.

C. Single Sign-On and Federation

• SSO: one authentication grants access to many applications within a session, reducing password fatigue.
• SAML: XML-based assertions; an Identity Provider (IdP) vouches for a user to a Service Provider (SP) via a signed assertion.
• OAuth 2.0: delegated authorization — issues scoped access tokens so an app acts on a user's behalf without seeing the password.
• OpenID Connect: an authentication layer on OAuth 2.0 that adds an identity token (JWT) describing the user.
• Federation: linking identities across organizations so one home credential works at a partner's services.

D. Privileged Access Management

• PAM: vaults and rotates administrator credentials, enforces just-in-time elevation, and records privileged sessions to limit standing admin power.

V. Enterprise Network Architecture — Structuring Trust

Secure network architecture partitions the network so a breach in one zone cannot freely reach others.

A. Segmentation and Zones

• DMZ (demilitarized zone): a buffer subnet hosting public-facing servers (web, mail) between the untrusted Internet and the internal LAN.
• VLANs: logically separate traffic on shared switches; inter-VLAN traffic must pass a Layer-3 control point.
• Screened subnet: two firewalls bracket the DMZ — one external, one internal — so no single rule failure exposes the core.

B. Zero Trust Architecture

• Micro-segmentation: enforce policy per workload rather than per subnet.
• Policy enforcement point: every flow is authenticated and authorized regardless of origin, removing the trusted interior assumption.

C. Network Access Control (NAC)

• Posture assessment: admit a device only if it meets health criteria (patched OS, running AV) via 802.1X at the switch port.
• Quarantine VLAN: non-compliant devices are placed in a remediation network with limited reach.

D. Resilience Design

• Redundancy: dual links and failover devices preserve availability.
• Air gap: physical isolation of the most sensitive systems from any network.

VI. Network Security Appliances — Enforcement Devices

These appliances inspect and filter traffic to enforce the architecture's policy.

A. Firewalls

1. Stateless (packet filter): evaluates each packet against ACLs on IP/port — fast but blind to connection state.
2. Stateful: tracks the connection table, permitting return traffic only for established sessions.

• Next-Generation Firewall (NGFW): adds application awareness, user identity, and deep packet inspection — can block "Facebook chat" while allowing the site.

B. IDS and IPS

1. IDS (detection): passively monitors a mirrored copy of traffic and alerts — out of band, cannot stop an attack.
2. IPS (prevention): sits inline and drops malicious packets in real time.

• Signature-based: matches known attack patterns; misses novel threats.
• Anomaly-based: flags deviation from a learned baseline; catches unknowns but yields more false positives.

C. Proxies and Content Filtering

• Forward proxy: mediates outbound requests, caching and filtering user web access.
• Reverse proxy: fronts internal servers, hiding them and distributing load.

D. Specialized Appliances

• WAF: inspects HTTP to block SQL injection and XSS against web apps.
• Load balancer: spreads traffic across servers for availability; can terminate TLS.
• UTM: consolidates firewall, IPS, antivirus, and filtering into one device for smaller sites.

VII. Secure Communications — Protecting Data in Transit

Secure communications apply cryptography so data crossing untrusted networks stays confidential and tamper-evident.

A. TLS and PKI

• TLS handshake: negotiates a cipher, authenticates the server via its certificate, and derives a session key.
• Public Key Infrastructure: a Certificate Authority signs certificates binding a public key to an identity; clients trust the CA's root.
• Hybrid encryption: asymmetric keys exchange a symmetric session key, which then encrypts bulk data efficiently.

Client ── ClientHello (ciphers) ──▶ Server
Client ◀── Certificate + ServerHello ── Server
Client ── key exchange ──▶ derive shared session key
both  ── AES-GCM encrypted application data ──

B. VPNs

1. IPsec: operates at Layer 3; tunnel mode encrypts the entire original packet between gateways for site-to-site links. Uses ESP for confidentiality and AH/IKE for integrity and key exchange.
2. SSL/TLS VPN: operates at the application layer, reachable through a browser — convenient for remote individual users.

C. Secure Protocols

• HTTPS: HTTP over TLS (port 443).
• SSH: encrypted remote shell and tunneling (port 22), replacing Telnet.
• SFTP/FTPS: secured file transfer replacing plaintext FTP.
• DNSSEC: signs DNS records to guarantee authenticity, countering cache poisoning.

D. Cryptographic Services

• Confidentiality: symmetric ciphers (AES-256) conceal content.
• Integrity: hashes (SHA-256) detect modification.
• Authenticity + non-repudiation: digital signatures combine a hash with the sender's private key.
• Perfect forward secrecy: ephemeral key exchange (ECDHE) ensures a compromised long-term key cannot decrypt past sessions.