Certified Information Systems Security Professional (CISSP) — Lesson 3: Identity Governance, Access Management, Assessment, and Security Testing

Learning Objectives

• Translate identity lifecycle, authentication design, and authorization models into actions that can be implemented and verified.
• Compare viable approaches to control assessment and record the trade-offs affecting penetration and audit evidence.
• Resolve the exception in which users retain excessive privileges because role changes are not reflected in provisioning and review processes without creating a new control gap.

Detailed Topics

• Evaluate identity lifecycle against policy, risk appetite, architecture constraints, and measurable acceptance criteria.
• Use authentication design to resolve a course-specific decision and record why rejected options were not selected.
• Inspect authorization models for hidden assumptions, inherited responsibilities, and downstream operational effects.
• Translate control assessment into a repeatable workflow that another practitioner can review and operate.
• Test penetration and audit evidence for normal behavior, boundary conditions, and an adverse scenario relevant to the lesson.

Instructor Demonstration

The instructor reviews the available facts, builds the required artifacts, and challenges the proposed solution. Particular attention is given to what access model and testing scope provide sufficient assurance without blocking critical work and the warning signs that appear when users retain excessive privileges because role changes are not reflected in provisioning and review processes.

Hands-On Exercise

Work through the scenario and map privileged access and create an assurance plan for a sensitive service. Your evidence package must include the identity governance matrix and security assessment plan.

1. Inventory the facts, assets, stakeholders, constraints, and evidence relevant to identity lifecycle.
2. Perform the core analysis for authentication design and authorization models, recording assumptions and rejected options.
3. Introduce the adverse condition where users retain excessive privileges because role changes are not reflected in provisioning and review processes and revise the proposed response.
4. Complete the identity governance matrix and security assessment plan with ownership, acceptance criteria, residual concerns, and the next review date.

Scenario Analysis

• Identify which assumption has the greatest effect on what access model and testing scope provide sufficient assurance without blocking critical work.
• Compare two viable approaches involving control assessment and explain their security and operational trade-offs.
• Specify the evidence required before the identity governance matrix and security assessment plan can be accepted.

Troubleshooting Guidance

Investigate the exception by comparing the documented design with observed behavior and retained evidence. Test one factor at a time, especially where users retain excessive privileges because role changes are not reflected in provisioning and review processes, and record why the corrective action addresses the root cause.

Validation Checklist

• The scope and ownership for identity lifecycle are explicit and agreed.
• The selected treatment for authentication design is supported by scenario evidence rather than assumption.
• The exception involving users retain excessive privileges because role changes are not reflected in provisioning and review processes was tested and its impact was recorded.
• The identity governance matrix and security assessment plan identifies acceptance criteria, residual risk, responsible owners, and follow-up actions.

Lesson Outcome

Learners can apply Identity Governance, Access Management, Assessment, and Security Testing, explain what access model and testing scope provide sufficient assurance without blocking critical work, and support the conclusion with a reviewable identity governance matrix and security assessment plan.