2.3 Identity & Access Management: Least Privilege, MFA & PAM Governance

🎯 Essential Technical Takeaways

• The Principle of Least Privilege mandates that users are granted only the minimum permissions necessary to perform their assigned role.
• Attribute-Based Access Control (ABAC) evaluates dynamic context (location, device health, time, data classification) beyond static RBAC roles.
• FIDO2 / WebAuthn hardware security keys are phishing-resistant because cryptographic assertions are bound to the specific browser domain URL.
• Privileged Access Management (PAM) enforces credential vaulting, session recording, and Just-In-Time (JIT) ephemeral elevation.

Identity and Access Management (IAM) is the central security control governing digital access. Under NIST SP 800-53 and AICPA Trust Services Criteria CC6.1, access must adhere strictly to the Principle of Least Privilege: users are granted only the specific rights necessary to execute their job responsibilities, for the minimum duration required. Access models have evolved from static Role-Based Access Control (RBAC)—which binds permissions to job titles—to dynamic Attribute-Based Access Control (ABAC), which evaluates multi-factor context including user role, device security posture, IP location, and data sensitivity in real time.

Authentication mechanisms must withstand advanced credential harvesting. Legacy Multi-Factor Authentication (MFA) relying on SMS codes or simple mobile push notifications is vulnerable to SIM swapping and Adversary-in-the-Middle (AiTM) reverse proxy phishing. Phishing-resistant MFA—specifically FIDO2 / WebAuthn hardware security keys—uses public-key cryptography bound directly to the browser's domain origin, preventing attackers from intercepting and replaying credentials to fake websites.

Privileged accounts (root, domain admin, global admin) represent high-value targets. Organizations must deploy dedicated Privileged Access Management (PAM) vaults that: (1) vault administrative credentials and rotate passwords automatically after every use; (2) require phishing-resistant MFA to access the vault; (3) enforce Just-In-Time (JIT) ephemeral access where privileges expire automatically after task completion; and (4) record all keystrokes and video sessions of administrative activities for audit review.

⚠️ CPA Evolution Exam Traps & Control Pitfalls

• Believing SMS text message codes provide phishing-resistant multi-factor authentication (they are vulnerable to SIM swapping and proxy phishing).
• Allowing employees to retain accumulated permissions across department transfers (privilege creep).
• Sharing root or domain administrator credentials among multiple engineers without individual PAM attribution.