Logical Security: Least Privilege, Zero Trust, ACLs, MFA, SAML, SSO, JIT, PAM, MDM, DLP, IAM, and Directory Services
Unit 4: Security Concepts. Lesson 14 of 41 in APlus Academy Core 2.
Logical security is the set of rules and systems that decide who may do what on the network. The exam tests these as definitions and as "which measure fixes this scenario."
The principles
- Principle of least privilege: every account, service, and program gets only the rights its job requires, and no more. A receptionist is not a local administrator; a backup service cannot browse the web. Least privilege limits what malware can do when it runs as that user.
- Zero Trust model: never trust a connection because of where it comes from; being inside the building or on the VPN proves nothing. Every request is authenticated and authorized, every device is checked, and access is granted per resource. The opposite of the old "hard shell, soft inside" network.
- Access control lists: the list attached to a resource that says which identities may do which actions: NTFS permissions on a folder, firewall rules on a router, rules on a switch port. Reading an ACL is reading who is allowed and who is denied.
Multifactor authentication
Authentication factors are something you know (password, PIN), something you have (phone, token, card), and something you are (biometric). MFA requires two different factors, so a stolen password alone fails. Methods the exam names:
- Email: a code sent to the mailbox; weak if the mailbox uses the same password.
- Hardware token: a key fob showing a rotating code or a USB security key; strongest common option.
- Authenticator application: generates codes on the phone or pushes an approve prompt.
- SMS and voice call: a code by text or spoken; usable but vulnerable to SIM swapping.
- TOTP (time-based one-time password): the six-digit code that changes every 30 seconds, generated from a shared secret and the clock; what authenticator apps and many tokens produce.
- OTP (one-time password or passcode): any code good for one use, delivered by any of the above.
Identity and access systems
- SAML (Security Assertion Markup Language): the standard that lets an identity provider tell a web application "this user is authenticated and here are their attributes." It is how web single sign-on works between a company's login and cloud services.
- SSO (single sign-on): one login gives access to many systems; convenient, and one compromised password reaches everything, so pair it with MFA.
- Just-in-time access: administrative rights are granted only when requested, for the task, for a limited time, then removed automatically. No standing admin accounts waiting to be stolen.
- PAM (privileged access management): the system that vaults administrator credentials, checks them out for a session, rotates them, records what was done, and enforces just-in-time access.
- MDM (mobile device management): enrolls phones, tablets, and laptops; enforces encryption, passcodes, app policies; wipes lost devices.
- DLP (data loss prevention): watches data leaving by email, upload, USB, or print, recognizes sensitive content (card numbers, health records, classified labels), and blocks or logs it.
- IAM (identity and access management): the umbrella: creating and removing accounts, assigning roles, authenticating, and auditing who has access to what.
- Directory services: the database behind IAM: Active Directory in Windows domains, queried with LDAP; holds users, groups, computers, and policies.
Scenarios
- A user's password was phished, but the attacker could not log in: MFA.
- An intern can delete files in the finance share: violates least privilege; fix the ACL.
- Admin accounts sit unused most of the week but are always active: just-in-time access through PAM.
- Employees log into ten cloud apps with one corporate login: SSO with SAML.
- A spreadsheet of customer card numbers was emailed outside: DLP would have blocked it.
- A lost phone holds company mail: MDM remote wipe.
- Nobody trusts the office network anymore; every access is verified: Zero Trust.
Logical Security: Least Privilege, Zero Trust, ACLs, MFA, SAML, SSO, JIT, PAM, MDM, DLP, IAM, and Directory Services, explained slowly
Why least privilege matters more than any product
Every piece of malware runs with the rights of the account that launched it. If that account is a standard user, the malware can encrypt the user's documents but cannot install a rootkit, disable the antivirus, or spread to system files. If the account is a local administrator, everything is possible. Least privilege is therefore the cheapest and most effective security control on a workstation: make everyone standard, give administrators a separate admin account they use only when needed, and give service accounts exactly the rights their task requires.
Zero Trust in one picture
old model Zero Trust firewall = the wall every resource has its own gate inside = trusted nothing is trusted by location VPN = full access each app checks identity, device health, context one login per day continuous verification, least privilege per request
Zero Trust is a design philosophy rather than a product: identity-based access, device compliance checks, micro-segmentation so a compromised PC cannot roam, MFA everywhere, and logging of every access decision.
Factors and methods, sorted
factor examples something you know password, PIN, security question something you have hardware token, phone with authenticator app, smart card, SMS code (the phone) something you are fingerprint, face, retina, voice
Two methods from the same factor (password plus PIN) are not multifactor. MFA method strength, strongest first: hardware security key, authenticator app push or TOTP, voice or SMS code, email code. SMS and voice fall to SIM swapping, where an attacker convinces the carrier to move the victim's number to a new SIM. TOTP works offline because both sides compute the code from a shared secret and the current 30-second window; a wrong clock breaks it.
The identity alphabet in a scenario
A company adopts a cloud HR application. IAM decides that HR staff get access and defines the role. The directory (Active Directory) holds the accounts, and an identity provider synchronizes with it. SAML lets the HR application trust the identity provider's assertion, so users get SSO: they sign in once and reach HR, mail, and the file service. MFA protects that one sign-in. Administrators of the HR system get no standing rights; when they need them they request just-in-time access through PAM, which checks out a privileged credential for two hours and records the session. MDM makes sure phones reaching HR data are encrypted and can be wiped. DLP stops an HR export of salaries from being emailed to a personal address. Each acronym did one job.
ACLs, practical
An ACL is read top to bottom on firewalls and routers: the first matching rule wins, and an implicit deny sits at the end. On NTFS, permissions are cumulative across groups, with an explicit Deny beating any Allow. When a scenario says "the user is in two groups and cannot access the folder," look for a Deny on one of them.
How the exam asks it
"Which principle states that users should have only the access needed for their job?" (least privilege). "Which model assumes no implicit trust based on network location?" (Zero Trust). "Which MFA method is MOST vulnerable to SIM swapping?" (SMS). "Which standard enables SSO between an identity provider and a web application?" (SAML). "Which practice grants administrator rights only when needed for a limited time?" (just-in-time access). "Which solution prevents sensitive data from being emailed outside?" (DLP).
What to memorize
Least privilege, Zero Trust, ACL. Factors: know, have, are. Methods: email, hardware token, authenticator app, SMS, voice, TOTP, OTP. SAML for web SSO; SSO one login; JIT temporary rights; PAM privileged credential control; MDM devices; DLP data leaving; IAM the umbrella; directory services such as Active Directory over LDAP.