CompTIA SecurityX (CAS-005)Security ArchitectureEasy
A security architect is designing an authentication system for a highly distributed global workforce accessing various cloud and on-premises applications. The goal is to simplify user access, reduce administrative overhead, and enhance security by providing a single, consistent identity for each user across all services without directly exposing internal identity stores. Which security architecture component would BEST achieve this?
- AA Data Loss Prevention (DLP) solution.
- BA Virtual Private Network (VPN) concentrator.
- CA Security Information and Event Management (SIEM) system.
- DAn Identity Broker.
Show answer & explanationAnswer & explanation
Correct answer: D. An Identity Broker.
An Identity Broker acts as an intermediary, translating identity information between different identity providers and service providers. This allows users to authenticate once and gain access to multiple applications (SSO) without each application needing to directly integrate with various identity stores, simplifying management and enhancing security.
Why the other options are wrong
- A. A DLP solution focuses on preventing sensitive data exfiltration, not on identity management or simplifying user access.
- B. A VPN concentrator provides secure remote access to a private network, but it doesn't manage identities or provide SSO across various applications.
- C. A SIEM system is used for collecting, analyzing, and correlating security logs, not for managing user authentication or simplifying access across applications.
Identity Broker
An Identity Broker is a service that acts as an intermediary between an Identity Provider (IdP) and a Service Provider (SP), translating identity protocols and attributes to enable single sign-on (SSO) across disparate systems and abstracting identity complexities.
- Facilitates Single Sign-On (SSO).
- Translates identity protocols (e.g., SAML, OAuth, OIDC).
- Abstracts complexity of multiple identity sources from applications.
- Enhances security by centralizing authentication and authorization policies.
Memory trick: The broker bridges identities, opening all doors.