Identity and Access Management

Learn the five authentication factor categories and the specific reasons password-based authentication has become the single highest-risk identity surface. By the end of this lesson you will be able to name all five factor categories and explain why combining them across categories (not within) is the modern MFA baseline, explain why fast cryptographic hashes make password storage with SHA-256 alone insufficient, and distinguish credential-stuffing from password-spraying attacks on Beacon Harbor's login surfaces.

Build on Lesson 1's factor-category foundation to understand which specific second factors are phishable (SMS, voice call, security questions), which are phishing-resistant (FIDO2 keys, platform authenticators, certificate-based auth), and how modern identity platforms use risk signals to require stronger factors only when the sign-in context demands it. By the end you will be able to rank the common second-factor choices by resistance to AITM phishing, explain what makes FIDO2/WebAuthn cryptographically phishing-resistant, and describe when conditional access risk-based policies belong in the authentication flow.

Build on Lab 1's hands-on decode and understand WHEN each federation protocol belongs in Beacon Harbor's identity architecture. By the end you will be able to draw the SAML browser-POST flow and identify what travels at each hop, draw the OIDC Authorization Code with PKCE flow and name the three token types (access, id, refresh), explain the authentication-vs-authorization distinction that OAuth 2 alone does not solve, and tell a developer why OIDC on top of OAuth 2 is the modern baseline instead of SAML for new applications.

Learn the three dominant authorization models used in modern enterprise systems — Role-Based (RBAC), Attribute-Based (ABAC), and Relationship-Based (ReBAC) — and when each is correct. By the end you will be able to design the authorization model for a new Beacon Harbor application given its data model and access requirements, explain the "role explosion" problem that drives teams from RBAC to ABAC or ReBAC, and name specific signals in a system's requirements that call for ABAC over RBAC.

Learn the Zero Trust architectural stance — "never trust, always verify" — and how its three principles (verify explicitly, use least privilege, assume breach) replace the legacy perimeter-based security model. By the end you will be able to describe how Zero Trust Network Access (ZTNA) replaces the legacy VPN, explain microsegmentation at the application level, and audit a Beacon Harbor sign-in flow against the three Zero Trust principles.

Learn Privileged Access Management (PAM) and identity governance — the two specialized disciplines around high-value accounts and ongoing access control. By the end you will be able to design a PAM strategy using just-in-time elevation (PIM) with break-glass fallback, explain why standing privileged access is the single biggest internal risk, and run an access review that produces an actionable outcome rather than rubber-stamp noise.