Domain 5 is identification, authentication, authorization and accountability, applied to people, devices and services. It covers access control models, the identity lifecycle, federation, and privileged access.
Case Study: The "Omni-Key" Insider Threat
QuickCash Inc. operates 300 ATMs. To save time, the regional manager created one administrative account, "SuperAdmin", password "Welcome123!", and shared it among the five field technicians. The account had unrestricted rights on the ATM management console, including PIN resets and account limits. The physical master keys for the ATM safes lived in an unlocked desk drawer in the regional office, in an envelope labelled "ATM Keys".
A technician who knew he was about to be dismissed logged in as SuperAdmin from home. There was no MFA. He created ten customer accounts with high withdrawal limits, took the master keys from the drawer, drove to five ATMs, put each into service mode with the shared key, and withdrew $200,000 in cash using the accounts he had made.
The logs showed SuperAdmin logging in and SuperAdmin creating accounts. Five people could have been SuperAdmin. QuickCash could not prove which one until the cash was gone.
The white paper's access-management controls read like a list of what QuickCash lacked: MFA for technicians, administrators and any remote access; role-based access limiting each user to the minimum their job needs; default and shared passwords replaced. Its physical controls add key management and unique locks, and it notes that attackers installing malware may pose as technicians precisely because a technician's access is rarely questioned.
One organization each, three to six questions apiece in the printed examination. Nothing here gives an answer away — the scenario is what the question hands you before it asks.
QuickCash Inc runs 300 ATMs with five field technicians who once shared a single 'SuperAdmin' account, until one of them used it from home to create fake customer accounts. The shared account is gone, every technician now has a named identity, and the company is rebuilding around that. Its directory runs on two domain controllers in the regional office, and the ATM management console authenticates against them. The board has bought a cloud service desk and a cloud expense tool, and both want their own logins. The five field technicians need administrative rights on the console, but only while a work order is open. The regional manager who created SuperAdmin still signs off every access request. The next audit closes in eight weeks.
QuickCash Inc · 300 ATMs, five field technicians
QuickCash Inc's five field technicians share a single administrative account on the machine management console. One of them used it from a home computer to create fake customer records and withdraw $200,000. The logs show only that the shared account logged in from a residential address, and no individual can be tied to any transaction. The security manager has budget for one change this quarter and must choose. The console accepted the login on the shared password alone, from a machine nobody had ever seen before, at a time nobody was rostered.
QuickCash Inc · 300 cash machines
Presenting a post-mortem to QuickCash Inc's board, the chief information security officer is asked why a single shared administrative design was dangerous even before anyone misused it. The board also wants to know why nobody noticed that an employee who had transferred departments three times in five years could approve invoices, modify vendor master records and view payroll, a combination no current duty requires. Elsewhere the company has rolled out app-generated time-based codes as a second factor on webmail, after employees typed passwords into lookalike login pages, and wants to know what still gets through.
QuickCash Inc · board and audit committee
A red team at Ardleigh Bank has demonstrated that compromising one component of its Kerberos realm would let them forge ticket-granting tickets for any principal and impersonate anyone to any service. An earlier incident report describes an attacker who gained administrator rights on one workstation, extracted the local administrator hash and authenticated to two hundred other workstations with it directly, cracking nothing. Field staff in areas with unreliable mobile coverage need a second factor, and company policy bars personal phones from work use. Attackers published ninety percent of a stolen password table within hours.
Ardleigh Bank · directory and endpoint security
One identity per person, always. Privileged access goes through a PAM system: the technician checks out a time-limited credential for a named task, the session is recorded, and the credential expires. MFA on every remote and privileged path. Roles split by job: a field technician gets service-mode rights on assigned machines, not console administration; account creation and limit changes belong to a separate role, and setting a limit above a threshold needs a second approver. That is separation of duties, and it would have stopped the fake accounts on the first day.
The leaver process starts when the decision to dismiss is made, before the employee is told. Access ends with the decision, not with the exit interview.
Physical keys are credentials. They live in a key cabinet with a log, under dual control, and a machine entering service mode outside a scheduled ticket raises an alert. The white paper's monitoring section lists exactly the transaction signals that would have fired here: rapid maximum withdrawals and unusual frequency from a single card.
The technician was identified from the ATM's camera, not from the logs. QuickCash retired the shared account, issued individual credentials with MFA, moved the keys into a controlled cabinet, and rewrote its termination procedure so revocation precedes notification.
Scenarios like this test IAAA and non-repudiation (shared accounts destroy accountability), least privilege and separation of duties, the account lifecycle and why deprovisioning is time-critical, the access control models and where RBAC fits, the factor types behind MFA, and the idea that physical access is part of identity management, not a separate concern.
The company in this scenario is a composite. The controls are documented in: