Chapter Summary

Key Takeaways

• IAM manages user identities and access throughout the identity lifecycle.
• Authentication verifies identity, while authorization determines permissions.
• Common authentication factors include knowledge, possession, and biometrics.
• RBAC, ABAC, DAC, and MAC are common access control models.
• Least Privilege limits users to only the permissions they require.
• Cryptography protects confidentiality, integrity, authentication, and non-repudiation.
• Symmetric encryption uses one key, while asymmetric encryption uses public and private keys.
• Hashing verifies integrity, while digital signatures verify authenticity.
• PKI manages digital certificates and trusted public keys.
• Network security uses firewalls, IDS, IPS, VPNs, and segmentation to protect communications.
• Secure protocols such as HTTPS, TLS, SSH, SFTP, and IPSec protect data in transit.
• Layered security provides stronger protection than relying on a single security control.

Trust should always be verified, and every access request should be appropriately controlled.