Identity &amp; Access Management

AI application security · Intermediate

802.1X Network Access Control

802.1X Network Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

AI Secrets Management

AI secrets management protects API keys, tokens, certificates, and credentials used by models, agents, pipelines, and tools.

API security · Advanced

API Token Scope Design

API token scope design grants an automation client only the operations, resources, environments, and duration needed for its approved purpose.

Authorization · Intermediate

Access Control Lists on Hosts

Host access control lists extend basic owner-group-other permissions with named user and group entries, default inheritance, and more precise authorization for shared files and directories.

Assurance practice · Intermediate

Access Reviews and Recertification

Access reviews verify that users, services, groups, roles, and privileged accounts still need the permissions they hold.

Identity lifecycle practice · Intermediate

Access Tokens, ID Tokens, and Refresh Tokens

Access Tokens, ID Tokens, and Refresh Tokens is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Account Deprovisioning

Account deprovisioning removes or disables access, sessions, credentials, tokens, groups, roles, and recovery methods when access is no longer authorized.

Establish rules for when accounts may be created, shared, elevated, accessed remotely, or used for administrative work. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Identity architecture concept · Intermediate

Active Directory Configuration (M1015)

Harden Active Directory so directory design, delegation, authentication, and replication do not create avoidable attack paths. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Active Directory Domains, Trees, Forests, and Trusts

Active Directory organizes identities and resources into domains; related domains form trees, one or more trees form a forest, and trusts define which security principals may be recognized across boundaries.

Agentic AI security · Advanced

Agentic AI Authorization

Agentic AI authorization ensures every tool call and consequential action is permitted for the initiating identity, current context, resource, and purpose.

Access control model · Intermediate

Attribute-Based Access Control

Attribute-based access control evaluates characteristics of the subject, resource, action, and environment to make a contextual access decision.

Digital identity · Foundational

Authenticate Users, Services, and Hardware (PR.AA-03) — NIST CSF 2.0 Subcategory

Apply PR.AA-03 to achieve this CSF 2.0 outcome: Users, services, and hardware are authenticated.

Authentication Factors

Authentication factors are independent categories of evidence used to prove control of an identity, commonly something known, possessed, or inherent to the user.

Identity model · Beginner

Authentication, Authorization, and Accounting

AAA separates three connected functions: verifying identity, deciding allowed actions, and recording activity for accountability and investigation.

Secure automation · Advanced

Automation Secret Management

Automation secret management keeps passwords, tokens, keys, and certificates out of code and logs while delivering them only to authorized jobs at execution time.

Emergency access control · Advanced

Cloud Break-Glass Access

Break-glass access provides a tightly controlled emergency path when normal identity, federation, or administrative mechanisms are unavailable.

Cloud authorization practice · Advanced

Cloud IAM Policy Analysis

Cloud IAM policy analysis evaluates effective permissions, conditions, inheritance, wildcard use, trust relationships, resource scope, and paths to privilege escalation.

Cloud architecture assurance practice · Advanced

Cloud Identity Boundary Validation

Cloud identity boundary validation tests whether accounts, subscriptions, projects, tenants, organizations, roles, and trust relationships enforce the intended separation of duties and blast radius.

Cloud authentication practice · Advanced

Cloud Session and Token Security

Cloud session and token security governs issuance, scope, lifetime, storage, revocation, audience, refresh, and monitoring for interactive and workload access.

Adaptive access control · Advanced

Conditional Access for Hybrid Networks

Conditional access for hybrid networks combines identity, device, location, risk, application, and session context to make dynamic access decisions across cloud and on-premises resources.

Nonhuman identity security · Intermediate

Credential Access Protection (M1043)

Reduce credential theft by limiting where secrets exist, how they are stored, and which processes or administrators can retrieve them. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Database Credential and Service-Account Security

Database credential and service-account security limits how nonhuman identities are created, stored, rotated, monitored, and granted database privileges.

Troubleshooting practice · Advanced

Discretionary Access Control

Discretionary Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Enterprise IAM Troubleshooting

Enterprise IAM troubleshooting isolates failures across identity proofing, directory data, federation, tokens, conditional access, authorization, MFA, session, and application integration layers.

Authentication standard · Intermediate

FIDO2 and WebAuthn

FIDO2 combines public-key authentication protocols with WebAuthn so users can sign in using phishing-resistant credentials bound to legitimate services.

Identity architecture · Intermediate

Federation and Single Sign-On

Federation allows one trusted identity system to assert information to another service, while single sign-on reduces repeated authentication across connected applications.

Service-account security concept · Advanced

Federation and Trust Relationships

Federation and Trust Relationships is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Group Managed Service Accounts

Group Managed Service Accounts are Active Directory accounts whose complex passwords are automatically managed and made available only to authorized hosts, reducing the need to store or manually rotate service credentials.

Architecture practice · Advanced

Identity Architecture

Identity architecture defines how people, workloads, devices, services, and organizations are identified, authenticated, authorized, governed, and audited.

Identity practice · Beginner

Identity Lifecycle Management

Identity lifecycle management governs how accounts and access are requested, created, changed, reviewed, suspended, and removed.

NIST CSF Category profile · Intermediate

Identity Management, Authentication, and Access Control (PR.AA) — NIST CSF 2.0 Category

Use PR.AA to manage identity life cycle, proofing, credentials, authentication, assertions, authorization, permissions, and physical access within the Protect Function.

Identity assurance practice · Intermediate

Identity Proofing

Identity proofing establishes evidence that an applicant is the person or entity they claim to be before an identity is enrolled or credentials are issued.

Access architecture practice · Intermediate

Identity Proofing and Credential Binding (PR.AA-02) — NIST CSF 2.0 Subcategory

Apply PR.AA-02 to achieve this CSF 2.0 outcome: Identities are proofed and bound to credentials based on the context of interactions.

Integrated Physical and Logical Access Control

Integrated physical and logical access control coordinates identity, credentials, badges, devices, locations, systems, authorization, logging, and revocation without creating hidden trust escalation.

Connected-device identity concept · Advanced

IoT Device Identity

IoT device identity is the set of cryptographic and lifecycle mechanisms used to distinguish one physical or logical device from another, authenticate it to services and peers, and bind actions and data to an accountable device record.

Authentication protocol · Intermediate

Just-in-Time Access

Just-in-Time Access is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Kerberos

Kerberos is a ticket-based network authentication protocol that lets users and services prove identity without repeatedly sending passwords across the network.

Authentication protocol concept · Advanced

Kerberos in Active Directory

Kerberos in Active Directory is a ticket-based authentication system in which domain controllers acting as key distribution centers issue time-limited tickets that let users and services prove identity without repeatedly transmitting passwords.

Access-control principle · Beginner

Least Privilege

Least privilege reduces avoidable exposure by limiting users, services, applications, and devices to the permissions they actually require.

Identity lifecycle · Intermediate

Linux Account Lifecycle

Linux account lifecycle management governs creation, modification, suspension, deletion, home directories, shells, group membership, service identities, and residual access from onboarding through deprovisioning.

Privilege management · Intermediate

Linux Capabilities and Privilege Delegation

Linux capabilities and controlled privilege delegation split broad superuser power into narrower rights so services and administrators receive only the authority required for a task.

Secure automation · Advanced

Machine Identity Governance for Automation

Machine identity governance manages service accounts, workload identities, certificates, tokens, and keys used by automation as governed identities with owners and life cycles.

Manage Identities and Credentials (PR.AA-01) — NIST CSF 2.0 Subcategory

Apply PR.AA-01 to achieve this CSF 2.0 outcome: Identities and credentials for authorized users, services, and hardware are managed by the organization.

Access control model · Intermediate

Manage Permissions and Authorizations (PR.AA-05) — NIST CSF 2.0 Subcategory

Apply PR.AA-05 to achieve this CSF 2.0 outcome: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.

Mandatory Access Control

Mandatory access control enforces centrally defined rules using security labels, classifications, and clearances that ordinary users cannot alter.

Mobile platform-security concept · Foundational

Mobile App Permissions

Mobile app permissions authorize access to protected device capabilities and data such as location, camera, microphone, contacts, files, sensors, notifications, nearby devices, and background activity.

Mobile identity-security concept · Advanced

Mobile Authentication and Authorization

Mobile authentication and authorization combine user, device, application, and backend trust decisions so a mobile client can establish an identity while servers enforce what that identity may do with each resource and transaction.

Security control · Beginner

Multi-factor Authentication (M1032)

Require more than one independent factor for sensitive authentication so a stolen password or token alone is insufficient. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Multifactor Authentication

Multifactor authentication strengthens sign-in by requiring independent evidence from different factor categories rather than relying on one credential alone.

Legacy authentication protocol concept · Advanced

NTLM Authentication

NTLM is a Windows challenge-response authentication family retained for compatibility when Kerberos or modern authentication cannot be used; its weaker trust properties make dependency reduction an important defensive goal.

Authorization framework · Intermediate

OAuth 2.0

OAuth 2.0 is an authorization framework that lets a client obtain limited access to a resource on behalf of a user or itself without receiving the user's password.

Operational technology architecture · Advanced

OAuth 2.0 Authorization

OAuth 2.0 Authorization is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

OT Remote Access Governance

OT remote access governance limits who can connect, from what managed path, for what approved purpose, to which assets, for how long, and under what monitoring and response controls.

Federated identity protocol · Intermediate

OpenID Connect

OpenID Connect adds an identity layer to OAuth 2.0 so a relying application can authenticate a user and receive standardized identity claims.

Identity administration concept · Intermediate

Organizational Units and Delegation

Organizational units are Active Directory containers used to organize objects, apply Group Policy, and delegate narrowly defined administrative tasks without granting broad domain privileges.

Authentication architecture · Intermediate

PAM Authentication Policy

Pluggable Authentication Modules centralize Linux authentication decisions through ordered policy stacks that can combine passwords, lockouts, multifactor methods, directories, and session controls.

Authentication technology · Foundational

Passkeys

Passkeys are FIDO credentials that use public-key cryptography to provide passwordless, phishing-resistant sign-in through a device or credential provider.

Authentication policy · Intermediate

Password Aging and Lockout Policy

Password aging and lockout policy coordinates credential lifetime, failed-attempt controls, recovery, service-account handling, and monitoring without creating predictable resets or denial-of-service risk.

Authentication practice · Beginner

Password Policies (M1027)

Set password and passphrase requirements that resist guessing, reuse, default credentials, and unsafe recovery practices without encouraging predictable workarounds. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Password Security

Password security combines user-friendly length, protection against reuse and compromise, secure storage, rate limiting, recovery controls, and stronger authentication where needed.

Authentication strategy · Foundational

Passwordless Authentication

Passwordless authentication verifies identity without requiring the user to enter a memorized password, using methods such as public-key credentials, device-bound keys, or one-time links.

Privacy rights operations · Intermediate

Privacy Rights Request Verification

Privacy rights request verification confirms that a requester is entitled to act without collecting excessive new data or exposing another person’s information.

Identity security program · Intermediate

Privileged Access Management

Privileged access management protects accounts, roles, credentials, and workflows that can make high-impact changes or bypass ordinary controls.

Privileged Access Workflows

Privileged Access Workflows is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Privileged Account Management (M1026)

Control the creation, use, elevation, monitoring, and retirement of highly privileged human and machine accounts. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Cloud automation security · Advanced

Protect and Verify Identity Assertions (PR.AA-04) — NIST CSF 2.0 Subcategory

Apply PR.AA-04 to achieve this CSF 2.0 outcome: Identity assertions are protected, conveyed, and verified.

Provider SDK Credential Security

Provider SDK credential security controls how command-line tools and software development kits discover, store, select, refresh, and use cloud or service credentials.

Privileged remote access · Intermediate

RADIUS and TACACS+

RADIUS and TACACS+ is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Remote Server Administration

Remote server administration protects consoles, RDP, SSH, web portals, out-of-band controllers, and support sessions through strong identity, segmented access, encryption, monitoring, and session control.

Access control model · Beginner

Risk-Based Physical Access (PR.AA-06) — NIST CSF 2.0 Subcategory

Apply PR.AA-06 to achieve this CSF 2.0 outcome: Physical access to assets is managed, monitored, and enforced commensurate with risk.

Role-Based Access Control

Role-based access control assigns permissions to defined job or functional roles and then assigns identities to those roles.

Database access control · Intermediate

Role-Based Database Access

Role-based database access assigns permissions to managed job or service roles rather than granting broad rights directly to individual accounts.

Federated identity protocol · Intermediate

Rule-Based Access Control

Rule-Based Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

SAML

Security Assertion Markup Language is an XML-based standard used to exchange authentication and authorization assertions between an identity provider and a service provider.

SAML Authentication

SAML Authentication is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Identity lifecycle practice · Intermediate

SCIM Provisioning

SCIM Provisioning is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Service Account Management

Service account management governs nonhuman identities used by applications, services, automation, devices, and integrations throughout their lifecycle.

Privilege management · Intermediate

Session Management

Session Management is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Sudo Policy Design

Sudo policy design grants named users or groups tightly scoped administrative commands while preserving accountability, command context, and safer alternatives to persistent root sessions.

Identity control · Intermediate

Temporary Cloud Credentials

Temporary cloud credentials provide time-limited access tokens or keys instead of persistent secrets.