4.1 Baseline System Hardening, IAM, and Privileged Access Management
Implement rigorous OS hardening baselines, multi-factor authentication factors, and Privileged Access Management (PAM) vaulting architectures.
🎯 Key CompTIA Security+ Exam Takeaways
- OS baseline hardening minimizes the attack surface by disabling unused services, closing ports, removing default accounts, and patching.
- UEFI Secure Boot cryptographically validates bootloader and kernel digital signatures against firmware keys to block bootkits.
- True Multi-Factor Authentication (MFA) requires two or more distinct factor categories: knowledge, possession, biometrics, location, or behavior.
- Privileged Access Management (PAM) secures administrative accounts through encrypted credential vaulting, automated rotation, and session recording.
- Attribute-Based Access Control (ABAC) evaluates dynamic subject, resource, and environmental context (time, location, device health) for fine-grained access control.
Security operations begin with endpoint hardening and identity governance. System hardening establishes a defensible baseline by removing default vendor passwords, disabling unnecessary background services and listening ports, enforcing host-based firewalls, and applying security baselines (such as CIS Benchmarks). Hardware-level hardening utilizes UEFI Secure Boot and Measured Boot, where the motherboard firmware cryptographically verifies the integrity of bootloaders and kernel drivers before execution, completely preventing low-level bootkit persistence.
Identity and Access Management (IAM) controls the digital lifecycle of enterprise identities. Robust access control enforces the principle of least privilege—granting users only the minimum permissions necessary to execute their assigned job responsibilities. Multi-Factor Authentication (MFA) is non-negotiable for enterprise security, requiring verification across distinct factor categories: something you know (passwords), something you have (hardware FIDO2 security keys, authenticator apps), or something you are (biometric fingerprints).
For high-privilege credentials (domain administrators, root accounts, cloud architects), organizations implement Privileged Access Management (PAM). PAM solutions eliminate permanent administrative privileges on user workstations. Administrators log into a secure PAM portal, 'check out' credentials from an encrypted vault with Just-In-Time (JIT) temporary elevation, and have their administrative sessions fully video-recorded and keystroke-logged for auditing. Once the task concludes, the PAM solution automatically rotates the password.
⚠️ Common Pearson VUE Exam Traps
- Believing requiring a password, a PIN, and a security question constitutes three-factor authentication; all three represent the exact same factor: 'something you know'.
- Allowing IT administrators to browse the web or check email from domain administrator accounts; PAM mandates dedicated, vaulted administrative accounts separate from daily user accounts.
Knowledge Checkpoint
To prevent domain administrator credentials from remaining permanently active on admin workstations, an enterprise implements a centralized tool that stores all privileged passwords in an encrypted vault, generates dynamic one-time passwords for each admin session, automatically rotates credentials upon checkout, and records full video sessions of administrative activity. What enterprise solution is this?