Identity, Access Management, and Authentication for Privacy Flashcards

Which access control model grants permissions based on a user's role within the organization rather than their individual identity?

Answer: Role-based access control (RBAC)

RBAC assigns permissions to roles (e.g., HR analyst, system admin), and users inherit those permissions by being assigned to a role, simplifying least-privilege enforcement.

What is the 'principle of least privilege' as applied to personal data access?

Answer: Users and systems should only have access to the personal data required to perform their specific function

Least privilege minimizes the number of people and systems with access to personal data, reducing insider threat risk and limiting breach scope.

An employee transfers to a new department. Which identity management process ensures their old access rights are removed and new ones are assigned?

Answer: Access recertification or provisioning/deprovisioning workflow

A role-change provisioning workflow automatically deactivates the employee's previous role permissions and grants those appropriate to their new function.

What privacy risk does 'orphaned accounts' (accounts of former employees that were not deprovisioned) create?

Answer: Unauthorized access to personal data by individuals who no longer have a legitimate need

Orphaned accounts can be used by former employees or attackers to access personal data without authorization, directly violating data access controls.

Which authentication method provides the strongest privacy protection by ensuring that even if a password is stolen, unauthorized access is prevented?

Answer: Multi-factor authentication (MFA)

MFA requires a second factor (e.g., TOTP code, hardware token) in addition to the password, significantly reducing the risk of unauthorized access from credential theft.

What is the privacy advantage of using 'single sign-on' (SSO) federated identity over separate credentials for each application?

Answer: Reduces the number of places where credentials and identity data are stored, lowering exposure

SSO centralizes authentication so that identity data is managed in one place, reducing credential sprawl, orphaned accounts, and the attack surface for identity-based breaches.