IAM, Logging, and Security Architecture

Identity and access management (IAM), logging, and security are the three major concepts that serve as the main building blocks of an organization’s security. In today’s ever-evolving security landscape, these concepts (if properly implemented) can secure the base of an organization’s environment. If absent or improperly implemented, it can expose an organization to many IAM issues, such as unauthorized access due to inadequate role-based permissions, potentially allowing access to sensitive data, and ineffective or missing multi-factor authentication (MFA) implementation, which may increase the risk of account compromise and unauthorized access. It can also cause logging issues such as insufficient logging details, causing incomplete records of security events and making it difficult to investigate and respond to incidents effectively, and lack of centralized log management, which can complicate incident investigation and response, making it slower and less effective. There is also the risk of security architecture issues such as inadequate network segmentation arising, which can expose lateral movement threats within the network and increased risk of a wider impact and poorly configured firewalls and access controls, potentially leaving open vulnerabilities that attackers could exploit to gain unauthorized access to the system.

Design and planning are the key first steps to creating a secure environment. First, a cybersecurity analyst must choose between infrastructure models, such as virtualization, containerization, on-premises, cloud, or hybrid. During this process, you must be aware of and understand common operating system (OS) concepts, including system hardening, filesystems, system processes, logging, and underlying hardware architecture. You must then include network design concepts to integrate these systems while continuing to keep security in mind. After the systems and networks are designed, you must be able to use and manage them securely. This is where access concepts and technologies will be integrated into the design to further facilitate an overall secure organization.

This chapter will discuss the CIA triad, teaching about infrastructure concepts, such as virtualization and containerization, alongside operating system concepts and network architecture. You will learn about the logging setup and its importance as related to system security and health. IAM criticality and concepts will be examined. The chapter will end by discussing encryption and sensitive data protection.

This chapter covers Domain 1.0: Security Operations, objective 1.1 Explain the importance of system and network architecture concepts in security operations in the CompTIA CySA+ CS0-003 exam.

The exam topics covered are as follows:

• Infrastructure concepts
• Operating system concepts
• Log ingestion
• Network architecture concepts
• IAM
• Encryption and data protection