Identity, Authentication, and Access Control at Scale
Identity as a Control Plane
Authentication and Authorization
Identity systems answer two distinct questions: who are you, and what may you do? Authentication establishes identity claims, while authorization evaluates permissions in a policy context. At scale, both require careful handling of lifecycle, federation, and revocation.
Access Control Models
Authentication Factors
Something you know
- Passwords, PINs
- Vulnerable to phishing and reuse
Something you have
- Hardware tokens, devices
- Stronger against credential reuse
Which access model is based primarily on user attributes, resource attributes, and environmental context?
ABAC uses attribute-driven policy evaluation rather than only roles or ownership.
Correct answer: ABAC
Why are passwords alone considered weak at scale?
Password-only systems fail frequently because humans reuse passwords and attackers automate attacks.
Correct answer: They are vulnerable to reuse, phishing, guessing, and credential stuffing.
Enterprise Identity Lifecycle
-
1
Step 1: Provision accounts from authoritative sources.
-
2
Step 2: Enforce strong authentication and least privilege.
-
3
Step 3: Monitor role changes and anomalous access.
-
4
Step 4: Revoke access promptly on status changes.
-
5
Step 5: Audit entitlements and privileged actions regularly.
What is the main goal of Zero Trust architecture?
Zero Trust removes implicit trust and requires ongoing verification for access decisions.
Correct answer: Continuously verify identity, device, and context
Operational Risk
Authorization bugs often appear where identity data, policy engines, and application logic are integrated without explicit testing of edge cases.