SSCP Systems Security Certified PractitionerAccess ControlsMedium
A large multinational corporation is integrating its diverse, geographically dispersed identity management systems. The goal is to allow employees to use their corporate credentials from their home domain to authenticate to applications hosted in another domain (e.g., an employee from the European division logging into an application hosted by the Asian division) without creating duplicate accounts. Which of the following identity and access management concepts is best suited for this requirement?
- APrivileged Access Management (PAM)
- BFederated Identity Management
- CSingle Sign-On (SSO)
- DIdentity Governance and Administration (IGA)
Show answer & explanationAnswer & explanation
Correct answer: B. Federated Identity Management
Federated Identity Management allows users to authenticate once in their home domain and then access resources in other domains without re-authenticating or creating new accounts. This is precisely what the multinational corporation requires for its geographically dispersed systems.
Why the other options are wrong
- A. PAM focuses on securing and managing highly privileged accounts within an organization, not cross-domain user authentication.
- C. SSO enables access to multiple applications within a single security domain after one authentication, but doesn't inherently span different domains.
- D. IGA focuses on managing identities and access within an organization, including provisioning and compliance, but not cross-domain authentication.
Federated Identity Management
A system that allows for the portability of identity and authentication information across different security domains, enabling users to access resources in multiple organizations or domains with a single set of credentials.
- Enables authentication across trust boundaries.
- Often uses standards like SAML, OAuth, OpenID Connect.
- Crucial for cloud services and large, dispersed organizations.
Memory trick: Federated ID: Like a global passport, your home ID works everywhere you're trusted.