>> Welcome back.
>> Here we are at the end of the IAAA section.
>> Remember, that stands for identification,
authentication, authorization, and auditing.
Let's go over auditing.
Whenever you hear the term compliance,
immediately think audit.
Audits are all about verifying compliance.
It could be compliance with internal policies,
external laws or regulations,
compliance with a contract or an industry standard.
But it's all about compliance.
Are we performing the processes as stated?
Are we meeting those standards?
Auditors document.
They record, they audit,
but they never correct.
They do not modify.
As a matter of fact, really,
auditor's shouldn't even necessarily provide it,
>> remediation, because that is
>> a violation of the separation of duties.
The exam is not going to get into that,
but auditors are often going to suggest remediation.
But really, auditors are only
>> going to audit and report.
>> That wraps up identity and access management.
Don't forget the four pieces of access control.
Identification is making a claim.
Authentication provides proof of your claim
>> using something you know,
>> something you have, something you are,
something you do, or somewhere you are.
Those are the main types of authentication.
The best form of authentication is multi-factor.
Authorization, what rights and permissions do you have
>> based on your identity.
>> Auditing is all about being able to test compliance.
That wraps up this chapter.