Unit 2: Implement Identity and Access Management, Secure Enterprise Network Architecture - Subjective Questions

Authentication is the process of verifying the identity of a user, device, or entity attempting to access a system, ensuring that the claimed identity is genuine.

The three primary authentication factors are:

• Something you know (Knowledge factor): Information the user memorizes.
  • Examples: passwords, PINs, security question answers.
• Something you have (Possession factor): A physical item the user owns.
  • Examples: smart cards, hardware tokens, OTP generators, mobile phones.
• Something you are (Inherence factor): A biometric characteristic unique to the user.
  • Examples: fingerprints, facial recognition, iris scans, voice recognition.

Multi-Factor Authentication (MFA) combines two or more of these factors to significantly strengthen security, since compromising multiple independent factors is far more difficult for an attacker.

Although often used together, authentication and authorization are distinct security processes.

Example:

• When you log into a banking app using your username and password (and OTP), that is authentication.
• When the app then decides that you can view your account balance but cannot access another customer's account, that is authorization.

Both processes work together: authentication establishes identity, and authorization enforces permissions based on that identity.

Role-Based Access Control (RBAC) assigns permissions to roles rather than to individual users. Users are then assigned to roles, inheriting the permissions associated with those roles.

Key features of RBAC:

• Simplifies administration in large organizations.
• Follows the principle of least privilege.
• Example: A "Manager" role may access payroll data, while an "Intern" role cannot.

Comparison of Access Control Models:

Summary:

• DAC is flexible but prone to misuse since owners control access.
• MAC is highly secure and rigid, using classification labels (e.g., Top Secret, Confidential).
• RBAC balances security and manageability, making it ideal for enterprise environments.

Identity Management (IdM) is the framework of policies, processes, and technologies used to manage digital identities and control their access to resources throughout their lifecycle.

Key components of Identity Management:

• Identity Lifecycle Management: Handles creation, modification, and deactivation of user accounts (provisioning and de-provisioning).
• Authentication Services: Verify user identities (passwords, MFA, biometrics).
• Authorization & Access Control: Define and enforce what resources identities can access.
• Single Sign-On (SSO): Allows one set of credentials to access multiple applications.
• Directory Services: Centralized repositories (e.g., LDAP, Active Directory) that store identity data.
• Federation: Enables identity sharing across organizations (e.g., SAML, OAuth, OpenID Connect).
• Audit & Compliance: Tracks access and ensures regulatory compliance.

Benefits:

• Improves security and reduces unauthorized access.
• Enhances user productivity through SSO.
• Simplifies compliance and auditing.

Single Sign-On (SSO) is an authentication scheme that allows a user to log in once with a single set of credentials and gain access to multiple independent applications or systems without re-authenticating.

How it works:

• The user authenticates with a central Identity Provider (IdP).
• The IdP issues a token (e.g., SAML assertion or JWT).
• Applications (Service Providers) trust this token to grant access.

Advantages:

• Improved user experience: One login for many services.
• Reduced password fatigue: Fewer passwords to remember.
• Centralized access control: Easier management and auditing.
• Fewer help-desk calls for password resets.

Disadvantages:

• Single point of failure: If SSO credentials are compromised, all linked services are at risk.
• Availability dependency: If the IdP goes down, access to all services is blocked.
• Complex implementation: Requires careful configuration and strong protection (often MFA).

SSO is commonly implemented using protocols like SAML, OAuth 2.0, and OpenID Connect.

These three protocols enable federated identity and secure authentication/authorization across systems, but serve different purposes.

Key distinctions:

• SAML is XML-based and widely used in enterprise SSO scenarios.
• OAuth 2.0 is purely an authorization framework—it lets an app access resources on behalf of a user (e.g., "Allow App X to access your Google Drive") without sharing passwords.
• OpenID Connect adds an authentication layer on top of OAuth 2.0, providing identity information via an ID token (JWT).

Summary: Use SAML for legacy enterprise SSO, OAuth 2.0 for delegated authorization, and OIDC for modern authentication needs.

Multi-Factor Authentication (MFA) is an authentication method that requires the user to present two or more independent credentials from different authentication factor categories.

The factor categories are:

• Something you know (password, PIN).
• Something you have (token, phone, smart card).
• Something you are (biometrics).
• (Sometimes) Somewhere you are (location) and Something you do (behavioral patterns).

Why MFA is stronger than single-factor authentication:

• Defense in depth: An attacker must compromise multiple independent factors.
• Mitigates stolen passwords: Even if a password is leaked, the attacker still lacks the second factor.
• Resists phishing and brute-force attacks: A stolen password alone is insufficient.

Example: Withdrawing money from an ATM uses MFA—your debit card (something you have) and PIN (something you know).

Conclusion: By requiring factors that are difficult to compromise simultaneously, MFA dramatically reduces the risk of unauthorized access compared to relying on a password alone.

An Enterprise Network Architecture is the logical and physical design of an organization's network, structured to balance performance, scalability, and security.

Typical layered structure:

• Core Layer: High-speed backbone for fast data transport between distribution devices.
• Distribution Layer: Routing, filtering, and policy enforcement between access and core.
• Access Layer: Connects end devices (PCs, phones, printers) to the network.

Network zones:

• Internal/Trusted Zone (LAN): Contains internal resources and workstations.
• DMZ (Demilitarized Zone): A perimeter network between the internal LAN and the untrusted internet.
• External/Untrusted Zone: The public internet.

Role of the DMZ:
The DMZ is a buffer zone that hosts public-facing servers such as web, email, and DNS servers. It is positioned between two firewalls (or on a firewall's separate interface).

• Allows external users to access public services without direct access to the internal network.
• If a DMZ server is compromised, the attacker is isolated from the trusted internal LAN.
• Enforces strict firewall rules controlling traffic between internet ↔ DMZ ↔ internal LAN.

Benefit: The DMZ adds a critical layer of defense in depth, protecting sensitive internal assets from external threats.

Network segmentation is the practice of dividing a computer network into smaller, isolated sub-networks (segments or zones), each with its own security controls and access policies.

Methods of segmentation:

• Physical segmentation: Using separate hardware/switches.
• Logical segmentation: Using VLANs (Virtual LANs) and subnets.
• Micro-segmentation: Fine-grained isolation at the workload/application level (common in data centers and cloud).

Security benefits:

• Reduced attack surface: Limits lateral movement of attackers between segments.
• Containment of breaches: A compromise in one segment does not automatically spread.
• Improved access control: Policies restrict traffic between segments.
• Better performance: Reduces congestion and broadcast domains.
• Regulatory compliance: Isolates sensitive data (e.g., PCI-DSS cardholder data environment).

Example: Separating the guest Wi-Fi network from the corporate network prevents guest devices from reaching internal servers.

Conclusion: Segmentation is a cornerstone of the defense-in-depth and zero-trust strategies, limiting the blast radius of security incidents.

A firewall is a network security appliance (hardware or software) that monitors and controls incoming and outgoing network traffic based on predefined security rules, acting as a barrier between trusted and untrusted networks.

Types of firewalls:

• Packet-Filtering Firewall:

  • Operates at the network layer.
  • Examines packet headers (source/destination IP, ports, protocol).
  • Fast but stateless; cannot inspect packet content.

• Stateful Inspection Firewall:

  • Tracks the state of active connections.
  • Makes decisions based on connection context, not just individual packets.
  • More secure than simple packet filters.

• Proxy Firewall (Application-Level Gateway):

  • Operates at the application layer.
  • Acts as an intermediary, inspecting full application-layer content.
  • High security but can introduce latency.

• Next-Generation Firewall (NGFW):

  • Combines traditional firewall features with deep packet inspection, intrusion prevention (IPS), application awareness, and threat intelligence.

Conclusion: The choice of firewall depends on performance needs, required inspection depth, and the organization's security posture.

Both IDS and IPS are network security appliances that monitor traffic for malicious activity, but they differ in their response.

Detection methods (common to both):

• Signature-based: Matches known attack patterns.
• Anomaly-based: Detects deviations from normal behavior.
• Heuristic/behavioral: Uses rules and machine learning.

Summary:

• An IDS is like a security camera—it observes and reports.
• An IPS is like a security guard—it observes and actively stops threats.

Many modern systems combine both as IDPS (Intrusion Detection and Prevention Systems).

A Virtual Private Network (VPN) creates a secure, encrypted connection (a "tunnel") over an untrusted public network such as the internet, allowing remote users or sites to communicate as if on a private network.

Working of a VPN:

1. The VPN client authenticates with the VPN server/gateway.
2. Data packets are encrypted and encapsulated inside new packets (tunneling).
3. Encapsulated packets travel across the public network.
4. The receiving end decrypts and decapsulates the data, restoring the original packets.

Role of tunneling protocols:
Tunneling protocols define how data is encapsulated and secured within the tunnel.

• IPsec (Internet Protocol Security): Operates at the network layer; provides encryption, integrity, and authentication. Common for site-to-site VPNs.
• SSL/TLS VPN: Operates at the transport/application layer; used for secure remote access via browsers.
• L2TP: Layer 2 Tunneling Protocol, often combined with IPsec.
• OpenVPN / WireGuard: Modern open-source protocols offering strong security and performance.

Benefits:

• Confidentiality via encryption.
• Integrity of transmitted data.
• Remote secure access to corporate resources.

Conclusion: VPNs enable secure communication over insecure networks, essential for remote work and inter-site connectivity.

Secure communication protocols are standardized methods that ensure confidentiality, integrity, and authentication of data exchanged over networks.

TLS/SSL (Transport Layer Security / Secure Sockets Layer):
TLS is the successor to the now-deprecated SSL. It secures communication between a client and server (e.g., HTTPS web traffic).

TLS Handshake (simplified):

1. Client Hello: Client sends supported cipher suites and a random value.
2. Server Hello: Server selects a cipher suite and sends its digital certificate.
3. Authentication: Client verifies the server's certificate using a trusted Certificate Authority (CA).
4. Key exchange: Both parties establish a shared session key (e.g., via Diffie-Hellman).
5. Secure session: Data is encrypted using symmetric encryption with the session key.

Security services provided:

• Confidentiality: Encryption prevents eavesdropping.
• Integrity: Message Authentication Codes (MACs) detect tampering.
• Authentication: Certificates verify server (and optionally client) identity.

Common uses: HTTPS, secure email (SMTPS/IMAPS), VPNs, and API communication.

Conclusion: TLS is the backbone of secure internet communication, protecting data in transit from interception and modification.

The Principle of Least Privilege (PoLP) states that every user, process, or system should be granted only the minimum level of access and permissions necessary to perform its legitimate function—and nothing more.

Application in access management:

• Granular permissions: Assign specific rights rather than broad administrative access.
• Role-based assignment: Use RBAC so users inherit only role-appropriate permissions.
• Just-in-time (JIT) access: Grant elevated privileges temporarily and revoke them after use.
• Regular access reviews: Periodically audit and remove unnecessary permissions.
• Separation of duties: Divide critical tasks among multiple users to prevent abuse.

Benefits:

• Reduced attack surface: Compromised accounts have limited capabilities.
• Containment: Limits damage from insider threats or malware.
• Improved auditability: Easier to track who can do what.
• Regulatory compliance: Meets requirements of standards like ISO 27001 and PCI-DSS.

Example: A database backup service account should only have read access to the database, not permission to modify or delete records.

Conclusion: PoLP is a foundational security principle that minimizes risk by limiting access strictly to what is required.

Zero Trust Architecture (ZTA) is a security model based on the principle "never trust, always verify." It assumes that threats can exist both outside and inside the network, so no user or device is trusted by default—regardless of location.

Core principles of Zero Trust:

• Verify explicitly: Authenticate and authorize every request using all available signals (identity, device, location, behavior).
• Least privilege access: Grant minimal, just-enough access.
• Assume breach: Design as if attackers are already inside; minimize blast radius through segmentation.
• Continuous verification: Trust is never permanent; re-evaluate continuously.

Comparison with the Traditional Perimeter Model:

Conclusion: The traditional model fails when attackers breach the perimeter or when resources move to the cloud. Zero Trust addresses modern distributed environments by enforcing strict, continuous verification for every access request.

Authentication protocols standardize how identities are verified across networks.

Kerberos:

• A ticket-based network authentication protocol using symmetric key cryptography.
• Relies on a trusted third party called the Key Distribution Center (KDC), which has:
  • Authentication Server (AS)
  • Ticket Granting Server (TGS)
• Working:
  1. User authenticates to the AS and receives a Ticket Granting Ticket (TGT).
  2. The TGT is presented to the TGS to obtain a service ticket.
  3. The service ticket grants access to the target service.
• Benefits: Mutual authentication, no plaintext passwords on the network, uses time-stamped tickets to prevent replay.
• Widely used in Microsoft Active Directory.

RADIUS (Remote Authentication Dial-In User Service):

• A client-server AAA protocol (Authentication, Authorization, Accounting).
• A RADIUS server centrally authenticates users connecting via network access devices (VPNs, Wi-Fi, switches).
• Working: The network device (NAS) forwards user credentials to the RADIUS server, which validates them and returns accept/reject plus authorization attributes.
• Commonly used for remote access and enterprise Wi-Fi (802.1X).

Summary: Kerberos excels at internal network SSO, while RADIUS provides centralized AAA for remote and network access.

A VLAN (Virtual Local Area Network) is a logical grouping of network devices into separate broadcast domains, regardless of their physical location, created by configuring switches.

How VLANs work:

• Switch ports are assigned to specific VLANs.
• Devices in the same VLAN communicate as if on the same physical LAN.
• Traffic between VLANs requires a router or Layer 3 switch (inter-VLAN routing).
• 802.1Q tagging identifies VLAN membership in Ethernet frames.

Security contributions:

• Traffic isolation: Separates sensitive departments (e.g., Finance, HR) into different VLANs.
• Reduced broadcast domains: Limits exposure of broadcast traffic.
• Access control: Policies and ACLs restrict inter-VLAN communication.
• Containment: Limits lateral movement of attackers across departments.
• Guest isolation: Keeps guest devices separate from corporate resources.

Example: Placing IoT devices on a dedicated VLAN prevents a compromised smart device from reaching critical servers.

Conclusion: VLANs provide flexible, cost-effective logical segmentation that enhances both network performance and security.

Public Key Infrastructure (PKI) is a framework of hardware, software, policies, and procedures used to create, manage, distribute, store, and revoke digital certificates that bind public keys to identities, enabling secure communication.

Key components of PKI:

• Certificate Authority (CA): A trusted entity that issues and signs digital certificates.
• Registration Authority (RA): Verifies identities before the CA issues certificates.
• Digital Certificates (X.509): Electronic documents binding a public key to an identity.
• Certificate Repository: Stores and distributes certificates.
• Certificate Revocation List (CRL) / OCSP: Lists or checks revoked/invalid certificates.
• Key pairs: A mathematically linked public key and private key.

Role in secure communication:

• Authentication: Certificates verify the identity of parties (e.g., servers in TLS).
• Confidentiality: Public keys encrypt data that only the private key can decrypt.
• Integrity & Non-repudiation: Digital signatures confirm data origin and prevent denial.

Example: When you visit an HTTPS website, PKI verifies the server's certificate issued by a trusted CA before establishing an encrypted session.

Conclusion: PKI underpins trust on the internet, enabling encryption, digital signatures, and authentication at scale.

Encryption secures data by transforming plaintext into ciphertext. Two main categories exist: symmetric and asymmetric.

Symmetric encryption:

• The same key encrypts and decrypts.
• Mathematically: and where is the shared key.
• Fast but requires a secure channel to share the key.

Asymmetric encryption:

• Uses a public key to encrypt and a private key to decrypt (or vice versa for signatures).
• Solves the key distribution problem.

Combined use in practice (Hybrid encryption):

• Asymmetric encryption securely exchanges a symmetric session key.
• The fast symmetric key then encrypts the actual bulk data.
• This is exactly how TLS works.

Conclusion: Symmetric encryption provides speed, asymmetric provides secure key exchange and authentication; together they deliver efficient, secure communication.

Enterprises deploy specialized network appliances to improve security, performance, and availability. Two important ones are proxy servers and load balancers.

Proxy Server:
A proxy server acts as an intermediary between clients and other servers.

• Forward Proxy: Sits between internal clients and the internet.
  • Hides client IP addresses, enforces content filtering, caches content, and logs usage.
• Reverse Proxy: Sits in front of internal servers.
  • Handles incoming requests, provides SSL termination, caching, and hides backend server details.

Security benefits: Anonymity, content filtering, access control, and an additional inspection point.

Load Balancer:
A load balancer distributes incoming network traffic across multiple backend servers.

• Methods: Round-robin, least connections, IP hash, weighted distribution.
• Layers: Layer 4 (transport) or Layer 7 (application) load balancing.

Benefits:

• High availability: Reroutes traffic if a server fails.
• Scalability: Handles increased load by adding servers.
• Performance: Prevents any single server from being overwhelmed.
• Health checks: Monitors server status.

Conclusion: Proxy servers enhance security and control over traffic flow, while load balancers ensure reliability and scalability—both essential in robust enterprise network design.